Business continuity management: What, Where and When?