eRMA v10 product brochure · edition v10-P03
Operational resilience, connected from impact to proof.
One platform to understand what the organization depends on, assess impact and risk, prepare and exercise recovery, respond to live events, and keep the evidence auditors ask for.
One model behind every resilience decision
Every feature reads the same dependency graph and the same recovery objectives. When a BIA is approved, a vendor fails or a storm crosses a region, the change shows up everywhere it matters: in risks, plans, exercises, the incident room and each person's to-do list.
Built for practitioners
Covers BC, DR and enterprise risk in one place, with the familiar vocabulary of RTO, MTPD, MBCO, impact tolerance, risk appetite and severe but plausible scenarios.
Aligned to the standards
Follows ISO 22301:2019, ISO/TS 22317 and ISO 31000, and supports regulatory regimes such as DORA, PRA SS1/21, FFIEC, SAMA and CBUAE.
Evidence by default
Approvals, change history, control tests, exercise results and Recovery Proof are recorded as the work is done, not assembled at audit time.
Roles held by teams
Owner, approver, tester, risk manager and risk oversight are team roles, so access follows the organization chart and survives staff changes.
1Understand the organization
Map what the organization delivers, everything that delivery depends on, and when and how each site works.
Business services
Owner team, approval team and links; RTO and criticality come from the BIA. A Profile records volume, peak periods, minimum service level and delivery channels, and regulation links record notification duties.
Processes and applications
Registers with owners, approval teams, objectives approval, recovery order, link editors and notifications.
Locations, employees, vendors
Contact and emergency details, reachability, where-used, data-quality findings and organization hierarchy.
Location operations
Time zone, operating hours and public holidays per site; a resilience profile with utilities, alternate site and assembly points; site status from Normal to Evacuated.
Dependency designer and impact map
Create links by drag and drop, review and save them together, and trace what fails upstream and downstream of any record.
Map (GIS)
Site and asset positions, area search, saved layers and live hazard feeds, with spread and concentration views.
2Assess impact
The BIA sets the recovery objectives that every other feature reads.
Business Impact Analysis
Impact rated per category over time against defined criteria, with a trace that explains every calculated value. Groups pass their values down to the records in them.
BIA campaigns
Survey form editor, weighted scoring, claim and release, tiered approval, gap checks and live progress.
+Enterprise Risk Management (ERM)
An ISO 31000 risk register in which each risk is a record of its own: assessed by a method, backed by evidence and outside intelligence, ranked for action and treated by tested controls.
Enterprise risk register
Each risk has a status, an owner team and an optional approval team, and links to many records: directly, for context, or inferred from the dependency graph with its path.
Priorities and treatment
A priority score with a "Why is this #4?" breakdown; Priorities, Treatment and Emerging views; a monthly trend and a PDF report.
Hazard intelligence
Six licensed sources (ThinkHazard!, INFORM, USGS, FEMA NRI and NFHL, ASCE 7-22) suggest a likelihood per site and list hazards no risk covers yet. Intelligence suggests; people rate.
Seven-step assessment
Context to sign-off on a 5 x 5 matrix: inherent and residual ratings, appetite, velocity and proximity, and evidence that cannot change once cited.
Control library and bow-tie
Controls with ISO 22301 and ISO 27001 references, and a bow-tie of causes, controls and consequences for each risk.
Control tests and attestation
Tests with segregation of duties (tester, reviewer and owner differ), attestation, and a remediation action for every failed test.
Scenarios and coverage
Severe but plausible scenarios linked to risks. A high risk with no scenario or plan behind it is shown as a gap.
Risk teams and Restricted risks
Risk manager and risk oversight are team rights. A sensitive risk can be Restricted to its owner, approval and risk teams.
+Compliance (GRC)
Shows which regulations and obligations apply to which records, how controls meet them, and the evidence that they do. It links to the records already in eRMA instead of copying them.
Regulations and versions
Each regulation is kept with its versions, so every obligation traces back to the text in force.
Obligations and where they apply
Obligations applied to services, processes, applications and locations. Each record lists its obligations on its own Obligations tab.
Control mapping
Obligations mapped to controls in the eRMA control library, so one tested control can satisfy many obligations.
Posture and traceability
Compliance posture per regulation and obligation, with a trace from rule to control to evidence.
Compliance assessments
Structured assessments of how well obligations are met, recorded with their results.
Obligation attestations
Owners confirm that their obligations are met, with a record of who confirmed what and when.
Compliance roles
Separate rights to manage, decide and administer compliance, switched on with the module.
Service regulation linksIn eRMA v10
Every business service records the regulations it falls under, with jurisdiction, designation and notification duty.
3Prepare: strategies, plans, exercises
The question every owner asks is: "If what I depend on is disrupted, what are my options to keep delivering, and have they been proven to work?"
Strategy coverage
Options of four kinds (Continue, Resume, Recover, Respond) per dependency, tested against the BIA, with a To do list ranked by criticality and gap.
Plan options builder
Drag an option onto a dependency, rank and select it, reuse options from a library with a seat check at the receiving site, and create a plan from it.
Plans and templates
Plans built from templates, read one procedure at a time, with a Gantt timeline and designed Plan RTO, print preview, PDF and checklist packs.
Plan Sequencer
Order plans against each other in a scenario's Sequence tab, simulate the timeline, check RTO results and team load, then play it back.
Teams
Response and recovery teams with members, duties, records, approvals and plans. Teams hold every role in the programme.
Exercises
Each exercise tests a scenario as an exercise incident, with a measured result against RTO for every entity, evidence and a report.
4Respond and recover
Incident Management takes an event from first alert to a closed record with evidence. The dependency graph and recovery objectives show which services are at risk and how much time is left.
Scenarios
The scope one event would hit: entities, plans, threats and a map footprint, built by depth from any record and activated straight into an incident.
Services affected
Lists the services hit, their owners and RTOs, with an enterprise-wide banner when the impact is broad.
Live command picture
Tasks, issues, messages with acknowledgement, a communications log and a decision log, updated live for every viewer, with pause and close.
Roll call
Staff safety checks using each employee's current whereabouts, with "need help" responses followed up.
Map watch and incident from map
Live hazard feeds and alerts near watched sites. Draw a footprint and open an incident with the exposed assets already filled in.
Review and Recovery Proof
A closed incident keeps its full record and closing report. The review records follow-up actions and the evidence that objectives were met.
5Govern and operate the programme
Keeps the programme current, controlled and auditable without adding administrative work.
MyWorkspace
What needs me, what I own and how resilient we are: reviews, approvals, tasks, my top risks, posture and "Can I keep delivering?".
Approvals and change log
Approval teams with tiers on records, edit history and snapshot change logs.
Security Access Manager
Team grants per record or in bulk, change sets you can undo for 30 days, findings with one-click fixes, and access review exports.
Employee Kiosk
Staff keep their own contacts, whereabouts and schedule current, and see their teams, duties and access.
Data management
Excel and CSV import, export and round-trip packs with dry runs, update mode and published entity definitions.
Document store
One store for files on any record: versions, links, withdrawal with a reason, never deleted, checked on every download.
Where eRMA v10 supports ISO 22301:2019
| Clause | Requirement | eRMA v10 features |
|---|---|---|
| 8.2.2 | Business impact analysis | BIA, inheritance from groups, BIA campaigns, service profile |
| 8.2.3 | Risk assessment | Risk register, seven-step method, hazard intelligence, priorities, map concentration |
| 8.3 | Strategies and solutions | Strategy coverage by RTO, MBCO and endurance; options library; teams |
| 8.4 | Plans and procedures | Plans and templates, Plan Sequencer, incident management, roll call |
| 8.5 | Exercise programme | Exercises with per-entity results against RTO; control tests |
| 9.1 / 10 | Evaluation and improvement | MyWorkspace, risk trend, incident review, Recovery Proof, change log |
Risk management follows ISO 31000; controls carry ISO 22301 and ISO 27001 references. Risk register, method, hazard intelligence, priorities and control tests are part of the optional ERM module; regulations and obligations are part of the optional Compliance (GRC) module.
See your own dependencies, risks, objectives and plans in one place.
Ask for a demo built around a business service you care about. The demo follows it from the BIA and its risks, through strategy and plan, to an exercise and a live incident.