Home / Products / Turnkey BCM
Product · audit and implementation · 1-2 months

Turnkey BCM: audit and raise your survival metrics

We test how ready your company is for two critical scenarios — a ransomware attack and a fire that closes a site — and then raise your survival metrics. The audit is one third of the work. Two thirds is fixing: new plans, new arrangements, measurable recovery. Delivered in Russia, in English, for teams that report to a foreign parent, an insurer or a group auditor.

from 300,000 RUB fixed scope · 1-2 months · free fixes included
Take the free assessment first →

The value, in numbers

7 days → 2typical downtime after ransomware, cut by tested recovery — based on industry loss statistics
6 months → 1business interruption after a fire — from our experience running continuity in heavy industry
from 300,000 RUBthe programme — against months of protected revenue; we prove the risk economics to your CFO in your own numbers
2/3of the work is fixing and raising metrics, not writing a report

What you receive — the artefacts

Every element below is a working document you keep. This is what you are paying for — and what your board, your insurer and your auditors will see.

Readiness score
46/100
Ransomware track52
Fire track41
Readiness audit reportYour position against both scenarios — honest, scored, with the three loudest gaps on top
Process × impact
HRLogisticsSalesFinanceLegalERPProcurementAdminWarehouse
← low impactcritical →
Risk map of key processesWhich process carries which scenario risk, and what one lost day costs — per process
Single points of failure
1 supplier · key raw material6M RUB/day
1 system · ERP4M RUB/day
1 person · chief engineerrisk
1 route · site accessrisk
Register of single points of failureOne supplier, one system, one person, one site — found, priced, with the fix decision recorded
Revenue → EBITDA
Revenue 100− COGS− opexEBITDA 38
where a lost day actually bites
Revenue → EBITDA resilience modelHow your revenue is actually made, what costs create it, and where a disruption cuts into profit
Stress-test day · log
T+0 · ERP goes darkstart
T+40m · manual mode onok
T+2h · orders resumeok
Findings logged7
Stress-test protocolThe tabletop day, documented: what broke when CRM and ERP went dark and the site closed — with timings
BCM plan · DRP
1 · Activation and triggersp. 1
2 · Roles and authorityp. 3
3 · First hours checklistp. 5
4 · IT recovery (DRP)p. 9
Business continuity plan + IT disaster recovery planShort, executable, written for your worst day — not for a shelf
Recovery scheme
declare→workaround→restore
Target: back to normal72h
Owner per stepnamed
Recovery schemeWho does what, in which hour, with which authority — from disruption back to normal operations
Survival metrics · 90 days
Recovery time objective (RTO)2 days
Fire: business interruption1 month
Weeks 1-2 · free fixesdone
Weeks 3-12 · investment planbusiness case
Survival metrics + 90-day action planDashboard-ready metrics and the plan that raises them — free fixes done, paid ones proven by risk economics

How we get there

  1. Two scenarios, chosen with youBy default: a ransomware attack and a fire that closes a site. Depending on your industry we swap in what threatens you most — loss of a key supplier, departure of key executives, failure of a cornerstone contract.
  2. Facts and economicsHow much the company earns and from where; financing sources; concentration of clients, suppliers and contractors; technology and raw-material dependence; single points of failure and bottlenecks.
  3. Business model deep-diveHow revenue is formed, which costs create it, how it becomes EBITDA and net profit. Continuity planning that skips this step protects the wrong things.
  4. Interviews with the people who make the moneyWe find who is actually key, how they generate revenue, and by which principles they work today.
  5. Then we break those principles — on paperA desk-based stress test: CRM or ERP goes dark, the warehouse or production block is closed by fire. Nothing is switched off in reality — but the company lives the day in the room, and we watch what it is capable of, in detail.
  6. Recovery, designed togetherWe build the recovery scheme with your team, not for them. People execute plans they helped write.
  7. Metrics — and the upliftWe implement survival metrics, then raise them: new plans, new contract clauses, offline backups, fallback registers and channels. Everything fixable for free we fix together immediately; what needs investment we prove through risk economics — and leave you with a working plan.
A small example from the programme

Your client registry lives in the CRM — which is exactly what ransomware encrypts. So during the programme we export it to a simple offline file, stored away from the office, and agree a fallback channel: a Telegram contact for every key client, collected in advance, with message templates ready. Cost: zero. Effect on day X: sales keep talking to clients while IT recovers. The programme is full of fixes like this.

Frequently asked questions

Does the price include the fixes?

Everything fixable without capital spend is fixed together during the programme — plans, registers, fallback channels, contract wording, drills. Measures that need investment come with a risk-economics case proving they pay back; the decision stays yours.

Will you really switch off our systems?

No. The stress test is desk-based: we simulate the loss of CRM and ERP or the closure of a site in a structured exercise. Production is never touched — but the decisions, gaps and timings the day produces are real.

Our biggest risk is neither ransomware nor fire. Does the programme fit?

Yes. The two default scenarios are a starting point. For a trading house it may be the failure of a cornerstone contract; for a family business, the departure of key executives; for a manufacturer, a key supplier. We agree the two scenarios that genuinely threaten you at the start.

How is this different from the risk-place.org programme?

Same method, different market. This edition is delivered in Russia and priced in roubles, and the scenarios and regulatory context are local. The risk-place.org edition is built for the Gulf.

Two months from now, your survival metrics can be different numbers.

Fixed scope, 1-2 months, free fixes included.

or take the free assessment first →