Form 36 Version 6.1
Draft for Public Comment
DPC: 06/30139869 DC Head Office 389 Chiswick High Road London W4 4AL Telephone: +44(0)20 8996 9000 Fax: +44(0)20 8996 7001 www.bsi-global.com
Latest date for receipt of comments: 31 August 2006
Date: 23 June 2006 Origin: National Project no.: 2005/02478
Responsible committee: BCM/1 Interested committees: Title:
DPC BS 25999-1 Code of practice for business continuity management
Supersession information: If this document is published as a standard, the UK implementation of it will supersede NONE and partially supersede NONE . If you are aware of a current national standard which may be affected, please notify the content developer (contact details below). WARNING: THIS IS A DRAFT AND MUST NOT BE REGARDED OR USED AS A BRITISH STANDARD. THIS DRAFT IS NOT CURRENT BEYOND 31 AUGUST 2006. This draft is issued to allow comments from interested parties; all comments will be given consideration prior to publication. No acknowledgement will normally be sent. See overleaf for information on commenting. No copying is allowed, in any form, without prior written permission from BSI except as permitted under the Copyright, Designs and Patent Act 1988 or for circulation within a nominating organization for briefing purposes. Electronic circulation is limited to dissemination by e-mail within such an organization by committee members. Further copies of this draft may be purchased from BSI Customer Services, Tel: +44(0) 20 8996 9001 or email
[email protected]. British, International and foreign standards are also available from BSI Customer Services. British Standards on CD or Online are available from British Standards Publishing Sales Limited. Tel: 01344 404409 or email
[email protected]. Information on the co-operating organizations represented on the committees referenced above may be obtained from the responsible committee secretary. Cross-references The British Standards which implement International or European publications referred to in this draft may be found via the British Standards Online Service on the BSI web site http://www.bsi-global.com. Responsible Committee Secretary: Mr Kevin Laverty
Direct tel: 020 8996 7492 E-mail:
[email protected]
1
Introduction Your comments on this draft are welcome and will assist in the preparation of the consequent British Standard. If no comments are received to the contrary, this draft may be implemented unchanged as a British Standard. Submission The guidance given below is intended to ensure that all comments receive efficient and appropriate attention by the responsible BSI committee. Annotated drafts are not acceptable and will be rejected. All comments must be submitted, preferably electronically, to: Kevin Laverty 10 E National Content British Standards Institution 389 Chiswick High Road London W4 4AL Email:
[email protected] Tel: 020 8996 7492 Fax: 020 8996 7187. Comments should be submitted using the comments form installed at www.bsiglobal.com/bs25999. Any comments not submitted electronically should still adhere to these format requirements. All comments submitted should be presented as given in the example below. Template for comments and secretariat observations
Date: xx/xx/200x
Document: ISO/DIS xxxxx
1
2
(3)
4
5
(6)
(7)
M B
Clause No./ Subclause No./ Annex (e.g. 3.1)
Paragraph/ Figure/Table/N ote (e.g. Table 1)
Type of comment
Comment (justification for change) by the MB
Proposed change by the MB
Secretariat observations on each comment submitted
3.1
Definition 1
ed
6.4
Paragraph 2
te
Definition is ambiguous and needs clarifying.
Amend to read ‘... so that the mains connector to which no connection ...’ Delete reference to UV photometer.
The use of the UV photometer as an alternative cannot be supported as serious problems have been encountered in its use in the UK. Microsoft and MS-DOS are registered trademarks, and Windows is a trademark of Microsoft Corporation.
2
BS 25999-1
Code of practice for business continuity management
0630139869
3
BS 25999-1
Contents Foreword 1 Scope and applicability 2 Terms and definitions 3 What is business continuity management? 4 Overview of BCM 5 The business continuity management system (BCMS) 6 Programme management 7 Understanding the organization 8 Determining BCM options 9 Developing and implementing a BCM response 10 Exercising, maintenance, auditing and self-assessment of BCM arrangements 11 Embedding BCM in the organization’s culture
5 6 6 10 11 15 16 18 21 27 33 37
Bibliography
39
List of figures Figure 1 — The BCM lifecycle Figure 2 – Process of review and update of BCMS documentation Figure 2 ― BCM options
11 18 22
List of tables Table 1 —Types and methods of exercising BCM strategies
35
0630139869
4
BS 25999-1
Foreword Publishing information This British Standard was prepared by Subcommittee BCM/1/-/2, under the authority of Technical Committee BCM/1, Business continuity management. A list of organizations represented on this committee can be obtained on request to its secretary. This British Standard has been developed by practitioners throughout the global community, drawing upon their considerable academic, technical and practical experiences of business continuity management (BCM). It has been produced to provide a system based on good practice for business continuity management. It is intended to serve as a single reference point for identifying the range of controls needed for most situations where business continuity management is practised in industry and commerce, and to be used by large, medium and small organizations in industrial, commercial, public and voluntary sectors. BS 25999 is published in (will eventually comprise) two parts: — Part 1: Code of practice for business continuity management; — Part 2: Specification for business continuity management Part 2 specifies the process for achieving certification that business continuity capability is appropriate to the size and complexity of an organization. Use of this document As a code of practice, this British Standard takes the form of guidance and recommendations. It should not be quoted as if it were a specification and particular care should be taken to ensure that claims of compliance are not misleading. Any user claiming compliance with this British Standard is expected to be able to justify any course of action that deviates from its recommendations. Presentational conventions The provisions of this standard are presented in roman (i.e. upright) type. Its recommendations are expressed in sentences in which the principal auxiliary verb is “should”. Commentary, explanation and general informative material is presented in smaller italic type, and does not constitute a normative element. The word “should” is used to express recommendations of this standard. The word “may” is used in the text to express permissibility, e.g. as an alternative to the primary recommendation of the clause. The word “can” is used to express possibility, e.g. a consequence of an action or an event. Notes and commentaries are provided throughout the text of this standard. Notes give references and additional information that are important but do not form part of the recommendations. Commentaries give background information. Contractual and legal considerations This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. Compliance with a British Standard cannot confer immunity from legal obligations.
0630139869
5
BS 25999-1 1 Scope and applicability This British Standard establishes the process, principles and terminology of business continuity management (BCM). The purpose of this Standard is to provide a basis for understanding, developing and implementing business continuity within an organization and to provide confidence in business-to-business and business-to-customer dealings. It also enables the organization to measure its BCM capability in a consistent and recognized manner. This Standard provides a system based on BCM good practice. This standard is intended for use by anyone with responsibility for business operations, from board directors and chief executives through all levels of the organization; from those with a single site to those with a global presence; from sole traders and small-to-medium enterprises (SMEs) to organizations employing thousands of people. It is therefore applicable to anybody who holds responsibility for any operation, and thus the continuity of that operation. This standard is not intended as a beginner’s guide to business continuity management. This standard does not cover the activities of emergency planning (also known as emergency preparedness). NOTE In the United Kingdom, emergency planning is a management system which prepares for, protects against, and recovers from natural or man-made incidents that affect sections of society as a whole. That is, emergency planning pertains to activity that is conducted for the benefit of the public or society; business continuity management pertains to activity that is conducted for the benefit of a single organization.
2 Terms and definitions For the purposes of this part of BS 25999, the following definitions apply. 2.1 activity process or set of processes undertaken by an organization (or on its behalf) that produces or supports one or more products or services, for example, accounts, call centre, IT, manufacture, distribution 2.2 benchmarking TBS 2.3 business continuity strategic and tactical capability, pre-approved by management, of an organization to plan for and respond to incidents and business interruptions in order to continue business operations at an acceptable pre-defined level 2.4 business continuity management (BCM) holistic management process that identifies potential threats to an organization and the impacts to business operations those threats, if realized, might cause, and which provides a framework for building organizational resilience with the capability for an effective response
0630139869
6
BS 25999-1 that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities NOTE Business continuity management also involves the management of recovery or continuity in the event of an incident and management of the overall programme through training, rehearsals, and reviews, to ensure the business continuity plan stays current and up-to-date.
2.5 business continuity management lifecycle series of business continuity activities which collectively cover all aspects and phases of the business continuity management programme NOTE The business continuity management lifecycle is illustrated in Figure 1.
2.6 business continuity management programme ongoing management and governance process supported by senior management and resourced to ensure that the necessary steps are taken to identify the impact of potential losses, maintain viable recovery strategies and plans, and ensure continuity of products/services through , training, exercising, maintenance and assurance 2.7 business continuity plan (BCP) documented collection of procedures and information that is developed, compiled and maintained in readiness for use in an incident to enable an organization to continue to deliver its critical products and services 2.8 business continuity strategy approach by an organization that will ensure its recovery and continuity in the face of a disaster or other major incident or business interruption 2.9 business impact analysis process of analysing business functions and the effect that a business interruption might have upon them 2.10 business interruption event, whether anticipated (e.g., a public service strike or hurricane) or unanticipated (e.g. a blackout or earthquake), which disrupts the normal course of business operations 2.11 cost-benefit analysis financial technique that measures the cost of implementing a particular solution and compares this with the benefit delivered by that solution NOTE The benefit may be defined in financial, reputational, service delivery, regulatory or other terms appropriate to the organization.
0630139869
7
BS 25999-1 2.12 disruption TBS 2.13 exercising activity in which the business continuity plan(s) is rehearsed in part or in whole to ensure that the plan(s) contains the appropriate information and produces the desired result when put into effect NOTE An exercise can involve invoking business continuity procedures, but is more likely to involve the simulation of a business continuity incident, announced or unannounced, in which participants role-play in order to assess what issues might arise, prior to a real invocation.
2.14 impact evaluated consequence of a particular outcome 2.15 incident situation that might be, or could lead to, a business interruption, disruption, loss, emergency, incident or crisis 2.16 incident management plan clearly defined and documented plan of action for use at the time of an incident, typically covering the key personnel, resources, services and actions needed to implement the incident management process 2.17 invocation act of declaring that an organization’s business continuity plan needs to be put into effect in order to continue delivery of critical products or services 2.18 material of a scale or significance that would threaten an organization’s key objectives should it not occur 2.19 maximum tolerable period of disruption duration after which an organization’s viability will be irrevocably threatened if product and service delivery cannot be resumed 2.20 organization business or administration concern united and constructed for a particular end
0630139869
8
BS 25999-1 NOTE An organization can be a company, corporation, firm, enterprise, institution, charity, sole trader or association, or parts or combinations thereof.
2.21 products and services beneficial outcomes provided to customers or recipients, for example manufactured items, car insurance, regulatory compliance and community nursing 2.22 project management TBS 2.23 recovery time objective target time set for resumption of product, service or activity delivery after an incident NOTE The recovery time objective has to be less than the maximum tolerable period of disruption.
2.24 resilience ability of an organization to resist being affected by an incident 2.25 risk combination of the probability of a perceived threat or opportunity and the magnitude of its impact on objectives NOTE In some situations, risk arises from the possibility of deviation from the expected outcome or event.
2.26 risk appetite total amount of risk that an organization is prepared to accept, tolerate, or be exposed to at any point in time 2.27 risk assessment overall process of risk identification, analysis and evaluation 2.28 risk management structured application of management culture, policy, procedures, and practices to the tasks of analyzing, evaluating, and controlling risk 2.29 senior management person or group of people who directs and controls an organization at the highest level
NOTE Senior management, especially in a large multinational organization, might not be directly involved; however senior management accountability through the chain of command is manifest. In a small organization, senior management might be the owner or sole proprietor.
0630139869
9
BS 25999-1 2.30 stakeholders those with an interest in an organization’s achievements, e.g. customers, partners, employees, suppliers, shareholders, owners, government and regulators 2.31 threat TBS 3 What is business continuity management? Business continuity management (BCM) is an holistic management process that identifies, in advance, the potential impacts of a wide variety of disruptions to the organization’s ability to function, allowing that organization to tolerate the loss of part or all of its operational capability. BCM is a business-owned, business-driven process that establishes a fit-for-purpose strategic and operational framework that: •
proactively improves an organization’s resilience against the disruption or interruption of its ability to supply its products or services;
•
provides a tried and proven method of restoring an organization’s ability to supply its critical products and services to an agreed level;
•
delivers a proven capability to manage a business interruption (incident) and protect the organization’s reputation and brand.
The term BCM denotes the whole management system of providing and proving resilience and recovery. BCM will result in the creation of one or more business continuity plans. A small organization may have one business continuity plan that covers its entire operations. A very large organization may have dozens of business continuity plans, each of which specifies in detail the recovery of a particular part of its business. The degree to which BCM is implemented in an organization will be proportionate to its size and scale, and may be subject to such cost-benefit analysis as the organization deems appropriate. The key elements of BCM include: •
understanding the overall context within which the organization operates;
•
understanding the critical products and services that the organization has to deliver (its objectives);
•
understanding what barriers or interruptions can be encountered in trying to deliver these critical products and services;
•
understanding how the organization can continue to achieve these objectives should interruptions occur;
•
understanding the likely range of outcomes when controls and other mitigation strategies are implemented;
•
understanding the criteria or triggers for implementing incident and emergency response, and business recovery procedures;
0630139869
10
BS 25999-1 •
ensuring that all staff understand their roles and responsibilities when a major disruption occurs;
•
building consensus and commitment to the implementation, deployment and exercising of business continuity;
•
integrating business continuity as part of routine “business as usual”.
4 Overview of BCM 4.1 Elements of the business continuity management lifecycle The BCM system comprises six elements, as illustrated by the lifecycle diagram in Figure 1. With little modification, these can be implemented by organizations of all sizes, in all sectors: public, private, non-profit, educational, manufacturing, etc. The scope and structure of a BCM programme can vary, and the effort expended will be tailored to the needs of the individual organization, but the essential steps still have to be undertaken. Figure 1 — The BCM lifecycle
Understanding the organization
Exercising, maintenance auditing and selfassessment
BCM Programme Management
Determining BCM options
Developing and implementing a BCM Response
a) BCM Programme management (see Clause 6) Programme management enables the business continuity capability to be both established (where this is currently not the case) and maintained in a manner appropriate to the size and complexity of the organization.
0630139869
11
BS 25999-1 b) Understanding the organization (see Clause 7) The activities associated with “Understanding the organization” provide information that describes an organization’s critical products and services, and the activities and resources that are required to deliver those products and services. c) Determining BCM options (see Clause 8) Determining BCM options enables a range of strategies and tactical options to be evaluated. This allows an appropriate response to be chosen for each critical product or service, such that the organization can continue to deliver those products and services at an acceptable level of operation during and following a disruption. The choice made will take cognisance of the resilience and countermeasure options already present within the organization d) Developing and implementing a BCM response (see Clause 9) Developing and implementing a BCM response results in the creation of business continuity plans and incident management plans that detail the steps to be taken during and after an incident to restore operations. A proactive component of BCM is to mitigate threats, which includes eliminating or reducing the impact and likelihood of the threats. e) Embedding BCM in the organization’s culture (see Clause 10) Embedding BCM in the organization’s culture enables BCM to become part of the organization’s core values and instil confidence in all stakeholders in the ability of the organization to cope with major disruptions. f) BCM exercising, maintenance, auditing and self-assessment (see Clause 11) BCM exercising, maintenance and audit leads to the organization being able to demonstrate that its strategies and plans are effective, credible, and fit-for-purpose. COMMENTARY ON 4.1f) An incident might exceed the preparedness of an organization, even if it has carefully examined response measures against an anticipated level of damage. It is therefore imperative that management and its supporting structures do not adhere stubbornly to an existing plan, but use it as a basis for discussion, and make judgments according to the circumstances. A business continuity plan is never a substitute for informed and competent management decision-making.
4.2 BCM in a risk context BCM is complementary to a wider risk management framework that sets out to understand the risks to operations or business, and the consequences of those risks. Risk management embraces the need to manage risk around the critical activities that enable an organization to survive. BCM encompasses the identification and risk management of those products and services on which the organization depends for its survival, and which need to be accessible in time to enable the organization to retain credibility and continue to meet its responsibilities. Through BCM, an organization can recognize what needs to be done before an incident occurs to ensure its people, reputation, assets, systems and information are secure. With that recognition, the organization can then take a realistic view on the responses that are likely to be needed as and when an interruption occurs, so that it can be confident that it will manage through any consequences without unacceptable delay in delivering its products or services.
0630139869
12
BS 25999-1 4.3 BCM in the context of organizational strategy All organizations, whether large or small, have aims and objectives, such as to grow, to diversify, to acquire other businesses and so on. These aims and objectives are generally met via strategic plans to achieve the organization’s short, medium and long term goals. As business practices and their sensitivities change, BCM is increasingly a central and crucial strategic issue for organizations. BCM awareness and integration at the organization’s highest level will help to ensure that any continuity risks associated with new business opportunities are identified, and assessed for their acceptability. The consequences of an incident vary and can be far-reaching. These consequences might involve loss of life, loss of assets or income, or the failure of a critical activity on which the organization’s reputation or survival might depend. The consequences might not be to the organization. Examples of consequences include, but are not restricted to: •
damage to the physical environment;
•
interruptions to the technological infrastructure;
•
interruptions to supply of a public utility, such as electricity, water, transport or phone services;
•
a requirement to undertake a fundamental change to the legal, regulatory and political environment in which the organization operates; or
•
a supply chain failure, where an urgently needed “just-in-time” supplier or distributor might be directly affected by an incident, and whose failure to deliver could have an equally serious impact on the organization’s own ability to continue to deliver products and services.
BCM also needs to recognize the strategic importance of stakeholders. Examples of stakeholders include, but are not restricted to, internal and “outsourced” employees, customers, suppliers, distributors, investors and shareholders. Furthermore, as the consequences of a damaging incident unfold, new stakeholders emerge and have a direct impact on the eventual extent of the damage. Examples of these include competitors, environmentalists, regulators, and the media. In some cases, issue groups may attempt to apply negative pressure on the organization facing an interruption. All these issues are of strategic concern to the organization, and are thus necessarily key drivers for any effective management of risk exposures. Whilst the individual processes of business continuity can change with an organization’s size, structures and responsibilities, the basic principles remain exactly the same for voluntary, private or public sector organizations, regardless of their size, scope or complexity. 4.4 Why should an organization undertake BCM? BCM forms an important element of good business management, service provision and entrepreneurial prudence. Managers and owners have the responsibility to maintain the ability of the organization to function continuously. Organizations constantly make promises or have a duty to deliver products and services, i.e. they enter into contracts and otherwise raise expectations. All organizations have moral and social responsibilities, particularly where they provide an emergency response or a public or voluntary service. In some cases, organizations have a
0630139869
13
BS 25999-1 statutory duty to undertake BCM, e.g. those subject to the relevant provisions of the Civil Contingencies Act. Prudent management therefore recognizes the need for adequate risk recognition and risk management. BCM delivers the ability to conduct core business and provides the capability to adequately react to incidents or operational interruption, whilst protecting staff welfare and safety. In any organization, all business activity inevitably leads to risks and to the possibility of adverse circumstances arising from those risks. In addition to business risks, there are internal operational risks, such as process breakdown and technology failure, and external risks, such as flooding, utility disruption and terrorism. Progressive organizations now regard BCM not as a costly planning process, but as a key value added improvement process firmly integrated with risk management. 4.5 The benefits of an effective BCM programme The benefits of a BCM programme are that the organization: •
is able to proactively identify risks to its operation, and have in place a capability to mitigate and manage those risks;
•
maintains an ability to manage uninsurable risks, such as risk to reputation;
•
has in place an effective response to major disruptions;
•
is able to demonstrate that the programme is credible through a process of exercising and auditing;
•
may have a competitive advantage, conferred by the demonstrated ability to maintain customer service, profitability and employment of its staff; and
•
is able to demonstrate that the programme is iterative and is embedded as good business practice.
4.6 The outcomes of an effective BCM programme The outcomes of an effective BCM programme are that: •
critical activities are identified and protected, ensuring their continuity;
•
an incident management capability is enabled to avoid incidents becoming a crisis;
•
the organization’s understanding of itself, and its relationships with other organizations, relevant regulators or government departments, local authorities and the emergency services, is properly developed, documented and understood;
•
staff are trained to respond effectively to an incident or business interruption through appropriate exercising;
•
staff are properly supported and communicated with in the event of business interruption;
•
stakeholder requirements are understood and satisfied through effective delivery of these outcomes;
•
the organization’s reputation is protected; and
•
the organization remains legal and compliant.
0630139869
14
BS 25999-1 5 The business continuity management system (BCMS) 5.1 Overview COMMENTARY ON 5.1 The purpose of establishing a business continuity programme is: — to ensure that all BCM activities are conducted and implemented in an agreed and controlled manner; — to achieve a business continuity capability that meets the changing business needs and is appropriate to the size, complexity and nature of the organization; and — to put in place a clearly defined framework for the ongoing management of the BCM capability.
The BCM system incorporates the following processes: •
the set-up activities to implement a business continuity capability; and
•
ongoing management and maintenance of the business continuity capability.
The set-up activities, which may take the form of a project, incorporate the end-to-end design, build, implementation and initial exercising of the business continuity capability. The ongoing maintenance and management activities include embedding business continuity within the organization, exercising it regularly, and updating it, particularly when there is a significant change in personnel, process, technology or organizational structure. In summary, the BCM system represents the set-up, organization and ongoing management of the business continuity capability. 5.2 Context The organization should ensure that its BCMS is appropriate to the nature, scale, complexity, geography and criticality of its business activities and that it reflects its culture, dependencies and operating environment. The BCMS is an ongoing process designed to ensure that business continuity arrangements continue to meet the needs of the business in the event of a major incident or operationally disruptive event. This system should ensure that a business continuity capability is embedded in the organization’s business culture. 5.3 Development of a business continuity policy The organization should develop a business continuity policy stating the objectives of the BCM programme. Initially, this may be at a high level with further refinement and enhancement as the capability is developed. The policy should be regularly reviewed and updated in line with business needs. The business continuity policy should provide the organization with documented principles to which it will aspire and against which its business continuity capability should be measured. The BCM policy should be owned at a high level, e.g. a board director or elected representative. The organization may consider the following when developing its BCM policy. •
Defining the scope of BCM within the organization.
•
Defining the BCM principles, guidelines and minimum standards for the organization.
•
Referencing any relevant standards, regulations or policies that should be included or can be benchmarked.
0630139869
15
BS 25999-1 Business continuity should be incorporated in the development of new products and services that are critical to the organization’s continued success and into the change management process for existing products and services. The organization should maintain and review its BCM policy, strategies, plans and solutions on a regular basis. An organization may chose to limit the application of this British Standard to specific products, services or one or more geographic locations. Any such limitation in scope should be documented in the policy. 6 Programme management 6.1 Overview BCM programme management involves three steps: •
assign responsibilities (see 6.2);
•
project management (see 6.3); and
•
ongoing management (see 6.4).
6.2 Assign responsibilities (governance) The organization’s management should: •
appoint or nominate a competent person to be accountable for BCM policy and implementation; and
•
appoint or nominate an individual to implement the BCM programme (this person may be known as the BC manager).
If the organization’s structure so indicates, the BC manager may nominate representatives within business units to assist in the implementation of the BCM programme. The roles, accountabilities, responsibilities and authorities should be integrated into job descriptions and skill sets. The organization’s audit process should review these responsibilities. These responsibilities may be reinforced by including them in the organization’s appraisal, reward and recognition policy. 6.3 Project management The project management activities should include the design, build, implementation and initial exercising of the business continuity capability. The organization may adopt a recognized project management methodology to ensure that the project is effectively managed. 6.4 Ongoing management 6.4.1 Overview The ongoing management activities should include ensuring that business continuity is embedded within the organization, and is regularly exercised and updated. Business continuity arrangements and plans should be reviewed and updated whenever there is a
0630139869
16
BS 25999-1 significant change in personnel, process or technology, and when an exercise or incident highlights deficiencies. 6.4.2 Ongoing maintenance Individuals tasked with maintaining the business continuity management system may reside in many areas of an organization depending on its size, scale and complexity. It is essential, however, that a person with appropriate responsibility, e.g. board director or elected representative, has overall responsibility for BCM and is directly accountable for ensuring the continued success of this capability. COMMENTARY ON 6.4.2
In large organizations there might be a need for a team of business continuity representatives with differing roles and responsibilities. In smaller organizations, responsibility for business continuity may reside with one or more individuals. However BCM is resourced, there are activities that should be carried out both initially and on an ongoing basis. These should include: •
defining the scope, roles and responsibilities for BCM;
•
appointing a person or team to manage the BCM capability;
•
monitoring performance of the business continuity capability;
•
promoting business continuity across the organization and wider, where appropriate;
•
managing costs associated with the business continuity capability;
•
administering the exercise programme;
•
coordinating the regular review and update of the business continuity capability;
•
maintaining documentation appropriate to the size and complexity of the organization (see 6.5); and
•
establishing and monitoring a change and succession management regime.
6.5 BCMS documentation Individuals tasked with maintaining the business continuity management system should be responsible for coordinating the business continuity documentation. This may include the following: •
BCMS scope statement;
•
BCMS terms of reference;
•
BCM policy;
•
business impact analysis;
•
risk assessment;
•
BCM strategy/ strategies;
•
statement of applicability;
•
training programme;
•
incident management plans;
•
business continuity plans;
0630139869
17
BS 25999-1 •
SLAs, contracts and other evidence.
Figure 2 shows the process by which BCMS documentation might be reviewed and updated. Figure 2 – Process of review and update of BCMS documentation
BCMS documentation
BCMS scope statement BCMS terms of reference BCM policy Business impact analysis Risk assessment BCM strategy / strategies Statement of applicability Training programme Incident management plans Business continuity plans SLAs, contracts and other evidence
Catalyst for change Incidents Malfunctions Failures Risk management reports Test results Self audit observations External audit observations Change or asset management
Review and update
7 Understanding the organization 7.1 Introduction 7.1.1 The aim of this element of the BCM lifecycle is to set the requirements that will determine BCM options (see Clause 8) and develop a BCM response (see Clause 9). It establishes a BCM understanding of the organization and ensures that the BCM programme is aligned to its objectives, obligations and statutory duties. 7.1.2 A BCM understanding of the organization comes from: •
identifying the organization’s objectives and stakeholder obligations;
•
requiring senior management to identify critical products and services that support these objectives and obligations (which determine the BCM scope);
•
identifying the activities, assets and resources that support the delivery of these products and services;
•
assessing the impact and consequences over time of the failure of these activities (see 7.2); and
0630139869
18
BS 25999-1 •
identifying and evaluating the perceived threats that could disrupt its activities (see 7.5).
7.1.3 It is important that the organization understands the interdependencies of its activities and any reliance on external organizations. 7.2 Analysing the impact of disruption 7.2.1 The organization should determine and document the impact of a disruption to the activities that support its critical products and services. This process is commonly referred to as a business impact analysis (BIA). 7.2.2 For each activity supporting the delivery of products and services within the BCM scope, the organization should: a) assess the impacts over time that its loss or disruption would have; b) establish the maximum tolerable period of disruption of each activity by identifying: •
the maximum time period after an interruption within which it needs to be resumed,
•
the minimum level at which the activity needs to be performed on its resumption,
•
the length of time before normal levels of operation need to be resumed; and
c) identify any inter-dependent activities, assets or resources that have also to be recovered. 7.2.3 When assessing impacts, the organization should consider those that relate to its business aims and objectives, its values and its stakeholders. These may include: •
threats to staff or public safety and welfare;
•
breaches of statutory and regulatory requirements;
•
damage to reputation;
•
damage to financial viability;
•
deterioration to product or service quality;
•
environmental damage.
The organization should document its approach to assessing the impact of disruption and its findings and conclusions. COMMENTARY ON 7.2.3 During a disruption, impacts generally increase over time and affect each activity differently. Impacts might also vary depending on the day, month or point in the business lifecycle.
7.3 Identification of critical activities The organization may categorize its activities according to their priority for recovery. Those activities whose loss, as identified during the impact assessment, would have the greatest impact in the shortest time and which need to be recovered most rapidly, may be termed “critical activities”. Other activities that require advance arrangements to be in place in order to ensure that they can be recovered within their maximum tolerable period of disruption, may also be termed critical. The organization may wish to focus its planning activities on critical activities, but should recognize that other (“non-critical”) activities will also need to be recovered within their maximum tolerable period of disruption.
0630139869
19
BS 25999-1
COMMENTARY ON 7.3 Time periods The maximum time period for resuming activities can vary between seconds and several months depending on the nature of the activity. Activities that are time-sensitive might need to be specified with a great degree of accuracy, for example, to the minute or the hour. Less time-sensitive activities might require less accuracy. Maximum tolerable period of disruption The maximum tolerable period of disruption will influence each activity’s recovery time objective when determining BCM options (see Clause 8).
7.4 Estimating recovery requirements The organization should estimate the resources, facilities and services that each activity will require at resumption. These may include: a) staff resources, including numbers, skills and knowledge; b) supporting equipment and supplies; c) the works site and facilities required; d) external services and suppliers; and e) provision of electronic or paper records, or information about work-in-progress, all of which are sufficiently up-to-date and accurate to allow the activity to continue unimpaired. COMMENTARY ON 7.4 If records or work in progress information are unavailable, inaccurate, or not sufficiently-up–to-date, this could prevent or critically delay the resumption of activities. This information is used to formulate appropriate backup and records management strategies when determining BCM options (see Clause 8).
7.5 Review of the business impact analysis The business impact analysis should be reviewed and updated as the organization or the environment in which it operates changes. COMMENTARY ON 7.5 A business impact analysis can also be used to understand future recovery strategy requirements by incorporating planned changes to products, services, processes or organizations (e.g. mergers).
7.6 Evaluating threats to organizational activities (risk assessment) 7.6.1 The organization should understand how specific threats could disrupt its activities. This information should be used to identify ways of preventing the loss of or disruption to the organization’s critical products and services. This process is commonly referred to as risk assessment. The organization should, in particular, identify threats and vulnerabilities specific to its critical activities. 7.6.2 The organization should consider: •
internal threats, such as fire and staff loss; and
•
external threats, such as flooding and nearby hazard sites.
7.6.3 The purpose of the risk assessment is to identify measures that would: •
reduce the likelihood of a disruptive event;
•
shorten the period of disruption; and
0630139869
20
BS 25999-1 •
limit the impact on the organization’s critical products and services.
COMMENTARY ON 7.6.3 It might be beneficial to consult risk registers that have already been established elsewhere in the organization or by external bodies.
7.7 Sign-off Senior management should sign off the documented business impact analysis and risk assessment to ensure that these activities have been properly undertaken and subsequent solutions and plans provide the correct level of continuity response. 8 Determining BCM options 8.1 Introduction 8.1.1 This element of the business continuity management system logically follows the “understanding the organization” element. Selected options should remain applicable to the organization, regardless of its size and sector, and have regard for associated stakeholders who would suffer the consequences of an unplanned interruption to products or services. 8.1.2 The organization’s approach to determining BCM options should: a) provide continuity for the products or services of the organization following an incident, and b) implement appropriate measures to prevent incidents occurring, and/or reduce the potential effects of those incidents; c) take due cognisance of the resilience and countermeasure options already present within the organization, in order to avoid the development of duplicate controls. NOTE Figure 2 identifies the context and relationship between strategic and tactical planning for all organizations. COMMENTARY ON 8.1.2 The business impact analysis and risk assessment form the primary basis by which the organization will determine appropriate, scalable and cost effective strategic and tactical BCM options.
0630139869
21
BS 25999-1 1 2
Figure 2 ― BCM options Understand the
Product / Service
organization
Options
Strategic Options: Do nothing
Change, suspend or terminate
Document and sign off
Loss mitigation / risk treatment
Risk management programme
Business Continuity
Activity options based on acceptable operating levels
Tactical Options: Workforce, skills and knowledge
Workspace facilities
3 0630139869
22
Supporting technologies
Data and information
Equipment and supplies
Human welfare
BS 25999-1
1
8.2 Product and service strategy options
2 3 4
There are a number of strategic options that should be considered for each product and service. Both time and acceptable operating levels will determine the most appropriate strategy or strategies.
5
Strategic options may include:
6 7 8 9 10 11
a) Do nothing COMMENTARY ON 8.2a) To do nothing might be acceptable if senior management deems the risk to be acceptable and within the organization’s risk appetite. However, this has to be done explicitly and documented. In some circumstances the impact of a risk might be outside the organization’s normal risk appetite, but, due to the low likelihood of the risk occurring and/or the uneconomic cost of control, senior management may accept the risk.
12
b) Loss mitigation/ risk treatment
13 14
If this option is to be pursued, reference should be made to the British Standard on Risk Management, BS-2xxxx.
15 16 17 18 19 20 21 22 23
COMMENTARY ON 8.2b)
24 25 26 27 28 29
c) Change, suspension or termination
30
d) Business continuity
31 32 33 34 35 36
If business continuity is the chosen strategy for a product or service, a recovery time objective should be agreed and the continuity options given in 8.3 should be evaluated against this objective.
37
8.3 Continuity options
38
8.3.1 General
39 40 41
8.3.1.1 Each critical product and service within an organization is supported by one or more activities. These activities may each have different tactical solutions which recognize the relative urgency of continuing that activity.
Loss mitigation/ risk treatment can prevent or reduce the likelihood of an incident and/or minimize or reduce the potential impact. Loss mitigation strategies can be used in conjunction with other options, as not all risks can be prevented or reduced to an acceptable level. The purchase of insurance may form part of a risk treatment strategy and will provide some financial recompense for some losses, but will not meet all costs (e.g. uninsured events, brand, reputation, stakeholder value, market share and human consequences). A financial settlement alone is unlikely to fully protect the organization and satisfy stakeholder expectations. Insurance cover is more likely to be used in conjunction with one or more other strategies.
COMMENTARY ON 8.2c) In some circumstances it might be appropriate to change, suspend or end the service, product, function or process. This option can only be considered where there is no conflict with the organization’s objectives, statutory compliance and stakeholder expectation. This approach is most likely to be considered where a product or service has a limited lifespan.
COMMENTARY ON 8.2d) Continuity strategies seek to improve the organization’s resilience to an interruption by ensuring critical activities continue at an acceptable minimum level and to timeframes stipulated within the BIA.
0630139869
23
BS 25999-1 1 2 3
8.3.1.2 The organization should determine and select appropriate, scalable and cost effective BCM solutions to maintain continuity for the activities that support products and services. The essential resources required for these activities are identified through impact analysis.
4 5 6 7
8.3.1.3 The organization should identify tactical solutions that will support the restoration of the required activities within the recovery time objective. In each case, the organization should evaluate alternatives in order to minimize the likelihood of the business continuity solution being affected by the same incident. These may include:
8
•
workforce, skills and knowledge (see 8.3.2);
9
•
work site facilities (see 8.3.3);
10
•
supporting technologies (see 8.3.4);
11
•
data (see 8.3.5);
12
•
equipment and supplies (see 8.3.6);
13
•
human welfare (see 8.3.7);
14
•
stakeholders, partners and contractors.
15 16 17
It is likely that a combination of solutions will provide the most robust and economic solution to deliver these products and services according to the timeframes identified in the impact analysis.
18
8.3.2 Workforce, skills and knowledge
19 20 21 22
The organization should identify appropriate strategies for maintaining essential skills and knowledge. This analysis should extend beyond employees to contractors and other stakeholders who possess extensive specialist skills and knowledge. Strategies to protect or provide those skills might include:
23
a) process mapping of activities;
24
b) multi-skill training of staff and contractors;
25
c) separation of key skills to reduce concentrated risk;
26
d) use of third parties to provide key skills;
27
e) succession planning; and
28
f) knowledge retention and management.
29 30
The organization should also consider the interests of those whose welfare might be put at risk as a result of an incident [see 9.3.2c)].
31 32 33 34 35 36 37 38
8.3.3 Work site facilities
39 40
The organization should devise a strategy for reducing the impact of the unavailability of its normal work site(s). This may include one or all of the following:
COMMENTARY ON 8.3.3 Worksite strategies can vary significantly and a range of options might be available. Different types of incident or threat might require the implementation of different or multiple worksite options. The correct strategies will in part be determined by the organization’s size, sector and spread of activities, stakeholders and geographical base. For example, public authorities will need to maintain a frontline service delivery in their communities. In all circumstances, it is important for the organization to apply health and safety and adequate provision of facilities deemed essential, such as transport, ergonomic arrangements and security.
0630139869
24
BS 25999-1 1
a) alternative locations within the organization;
2
b) alternative locations provided by related organizations;
3
c) alternative locations provided by third party specialists; and
4
d) working from home or at remote sites.
5 6 7
NOTE If staff are to be moved to an alternative location, the alternative location ought to be close enough that staff are willing and able to travel to it, taking into account any possible difficulties caused by the incident. However, the alternative location ought not to be so close that it is likely to be affected by the same incident.
8
8.3.4 Supporting technologies
9 10
8.3.4.1 The organization should identify all relevant technology assets that directly enable and support the activities undertaken by the organization.
11 12 13
NOTE Technology implies the use of assets in the broadest sense and as relative to the organization. Technology might include IT hardware, telecommunications equipment, lathes, food preparation machines or vacuum sealing machinery.
14 15
8.3.4.2 Technology strategies will depend on the nature of the technology employed and its relationship to critical products and services, but will typically be one or a combination of:
16
•
provision made within the organization;
17
•
services delivered to the organization; and
18 19 20 21 22 23
•
services provided externally by a third party.
24
8.3.5 Information
25 26
Information security strategies should be such as to ensure that information vital to the organization’s operation is appropriately protected and recoverable.
27
NOTE Further information is given in BS ISO/IEC 17799.
28
Any remote copy of information required to reinstate lost records should have appropriate:
29
•
confidentiality;
30
•
integrity (between different data sources); and
31
•
availability to be used for reinstatement.
32 33
Information strategies should be documented for the recovery of work-in-progress information, i.e. data that are not present on the remote copy.
34
Information strategies should extend to include:
35
•
physical (hardcopy) formats,
36
•
virtual (electronic) formats, etc.
COMMENTARY ON 8.3.4.2 Supporting technologies will vary significantly between organizations according to the size, nature and complexity of business. Strategies may be developed to safeguard specialized or custom built technologies (for example, plant or machinery essential to manufacturing and production capabilities). The organization may need to make provision for manual operations before full IT services are recovered.
37
0630139869
25
BS 25999-1 1 2 3 4 5
8.3.6 Equipment and supplies COMMENTARY ON 8.3.6 In office-based environments, equipment and supplies might constitute forms, headed paper, stationary, etc. Other industries might identify retail stock or just-in-time supplies. The provision of bulk storage, such as vehicle fuels, might also be considered in light of the potential for disruption to fuel supplies.
6 7 8
8.3.6.1 The organization should identify, and maintain an inventory of, the equipment and supplies that support its critical products and services. Strategies to provide these may include one or all of the following:
9
•
storage of additional supplies at another location;
10
•
arrangements with third parties for delivery of stock at short notice;
11
•
diversion of just-in-time deliveries to other locations;
12
•
holding of materials at warehouses or shipping sites;
13
•
transfer of sub-assembly operations to an alternate location;
14
•
holding of older equipment as emergency replacement or spares;
15
•
additional risk mitigation for unique or long lead time equipment; and
16
•
geographic diversity of critical processes.
17 18
8.3.6.2 Where activities are dependent upon key suppliers, these should be identified. Strategies to manage these may include:
19
•
multiple suppliers;
20
•
encouraging or requiring suppliers to have a business continuity capability;
21
•
contractual agreements with key suppliers; and
22
•
identified alternate suppliers.
23
8.3.7 Human welfare activities
24 25
When determining appropriate BCM options, the organization should satisfy the interests of those whose welfare might be put at risk as a result of an incident.
26
The organization should:
27 28
•
assess the requirements of the business continuity programmes in respect of welfare issues,
29
•
develop plans and programmes based on that assessment, and
30 31 32 33 34 35 36
•
provide support for the implementation and maintenance of the human welfare plans, taking into account relevant social and cultural considerations.
37 38
The organization should identify the person or persons who will assume responsibility for welfare issues following an incident, including:
39
a) site evacuation (inclusive of internal evacuations) and accounting for staff;
COMMENTARY ON 8.3.7 Organizations have a direct responsibility to safeguard the welfare of employees, contractors, visitors and customers where an incident poses a direct risk to life, livelihood and welfare. Special attention will need to be paid to any groups with disabilities or other specific needs (e.g. pregnancy, temporary disability due to injury, etc). Planning in advance to meet these requirements can reduce risk and reassure those affected.
0630139869
26
BS 25999-1 1
b) ongoing employee/customer communications and safety briefings;
2
c) contact with a chosen emergency contact or next-of-kin;
3
d) locating displaced workforce or contractors;
4
e) rehabilitation services (physical and emotional);
5
f) family support;
6
g) translation services;
7
h) transport assistance;
8
i) telephone helpline for informing employees and relatives;
9
j) assisting displaced staff or visitors to obtain temporary accommodation, e.g. hotel rooms.
10 11 12 13 14 15 16
The organization should deploy staff with appropriate levels of authority to liaise with the emergency services. NOTE 1 Emergency services play a significant part in protecting life and relieving suffering during emergencies. Therefore, early liaison, pre-planning and real-time incident coordination between the organization and its first responders and the emergency services can improve the efficiency of an incident response. Instructions from the emergency services will take precedence over the actions described in the IMP and BCP.
17 18 19 20 21 22
The organization may retain a means to provide services to debrief and counsel affected staff after an incident. Services may be sourced externally or may be provided as a pre-planned extension to existing occupational health and employee assistance programmes.
23
8.4 Sign-off
24 25 26 27 28
Senior management should sign off the documented solutions to confirm that these activities have properly mitigated or catered for the likely causes and effects of a business interruption. COMMENTARY ON 8.4
29
9 Developing and implementing a BCM response
30
9.1 Introduction
31 32
A major incident can result in serious disruptions in the organization’s ability to meet its obligations.
33 34 35
It is vital that the organization is able to respond to such incidents and the resulting disruptions at a speed that meets the expectations of its stakeholders as identified in the business impact analysis.
36 37 38
Clause 8 described the various means by which business activities can be protected from intolerable disruption. This Clause gives recommendations for harnessing and coordinating these resources to create an effective response.
39
The successful management of an incident has two main components:
NOTE 2 The long-term impacts of incidents and the value of human welfare cannot be underestimated. Developing appropriate strategies in support of human welfare can directly support and speed financial, physical and emotional recovery within the organization.
Implementation of a particular alternative has to support the overall organizational objectives and thus needs to have acceptance and support at the highest level.
0630139869
27
BS 25999-1 1 2 3
•
a coordinated organization-wide response to the incident, including communication with the stakeholders, such as staff, customers, shareholders and the media (incident management plan – see 9.3);
4
•
restoration of the organization’s activities [the business continuity plan(s) – see 9.4].
5
9.2 Content of plans
6 7
All plans, whether incident management plans, business continuity plans, or detailed recovery plans, should contain the following.
8 9 10 11
COMMENTARY ON 9.2
12
a) Purpose and scope
13
The purpose and scope of each specific plan should be defined, agreed and understood.
14 15 16
Each incident and continuity plan should set out its objectives in terms of the products and services to be recovered over a particular timescale, the situation in which each plan can be utilized, and the activities to be undertaken.
17
Each plan should also state what it does not intend to achieve and why.
18
b) Roles and responsibilities
19 20 21
The roles and responsibility of the people and teams having authority (both in terms of decision-making and authority to spend), during and following an incident should be clearly documented. Deputies should be nominated for persons in key roles.
22
The following may also be included where appropriate:
23 24
•
the interface with external organizations or agencies, and between any internal business continuity, response teams or support teams;
25
•
responsibilities and procedures to be used in the event of an escalation or second incident;
26 27
•
the process for ensuring a smooth transition from the acute phase of the incident to the more controlled project phase including the retention of records;
28
•
procedures/ checklists for the post-incident review process.
29
The persons or groups covered by a BCP should be clearly defined.
30
c) Invocation/ mobilization procedures
31 32
The method by which an incident management or business continuity plan is invoked should be clearly documented.
33 34
The organization should have a clearly defined process for invoking the relevant plan in the shortest possible time following the occurrence of a disruptive incident.
35 36
There should be guidelines as to who is responsible for activating the plan and under what circumstances.
37 38 39 40
The invocation process may require the immediate mobilization of organizational resources. The plan should include a description of exactly how to mobilize the team(s), where they are to meet and details of an alternate meeting location (in larger organizations, these meeting places may be referred to as command centres).
Small organizations may have only a single plan that encompasses all requirements for the business, whereas larger organizations may have a number of scenario specific plans with separate documentation for incident management, continuity and recovery.
0630139869
28
BS 25999-1 1 2
The organization should document a clear process for standing down the team(s) once the incident is over, and returning to business as usual.
3 4 5
COMMENTARY ON 9.2c)
6
d) Document owner and maintainer
7 8
The organization should nominate the primary owner of the plan, and identify and document who is responsible for reviewing, amending and updating the plan at regular intervals.
Time lost during a response can never be regained. It is almost always better to mobilize the response team and subsequently stand it down than to miss an opportunity to contain an incident early and prevent escalation.
9 10
A system of version control should be employed, and changes formally notified to all interested parties.
11
9.3 Incident management plans
12
9.3.1 Introduction
13 14 15 16 17
The purpose of an incident management plan (IMP) is to allow the organization to manage the acute phase of an incident. The IMP addresses the stakeholder and external issues facing an organization during an incident. The IMP should be flexible, feasible, relevant and easy to read and understand, and provide the basis for managing all possible issues arising from any threat to the business. The primary aims of the IMP should be:
18
•
to ensure the safety of all affected individuals; and
19
•
to contain the incident to minimize further loss.
20
The IMP should:
21
•
have senior management support, including a board sponsor where applicable; and
22
•
be supported by an appropriate budget for development, maintenance and training.
23
9.3.2 Contents of the IMP
24
In addition to the content recommended in 9.2, an IMP should include the following:
25
a) Action plans
26 27 28
The IMP should include initial response strategies, in the form of prompts for actions, to be followed for each of the consequences of disruptions identified during the business impact analysis.
29
b) Personnel response
30 31 32 33 34 35
A description of how the organization will communicate with staff and their relatives, friends and “emergency contacts” should be included. In some cases, it may be appropriate to include detail in a separate document. COMMENTARY ON 9.3.2b) Depending upon the scale of the organization and the size of the incident, a number of competent, trained people may be required to respond to telephone enquiries about the incident.
36 37
Next-of-kin and emergency contact information for all personnel should be kept up to date and available for prompt use.
38
c) Media response
39
The organization should document in the IMP its media response, including:
0630139869
29
BS 25999-1 1 2
•
the incident communications strategy and description of the organization’s preferred interface with the media;
3 4
•
a guideline or template for the drafting of a statement to be provided to the media at the earliest practicable opportunity following the incident;
5
NOTE Consideration may be given to pre-preparing media statements for reasonably foreseeable events.
6 7
•
8
In some cases, it may be appropriate to:
9
•
provide supporting detail in a separate document;
10
•
establish a number of competent, trained people to answer enquiries from the press;
11 12
•
prepare background material about the organization and its operations (this information should be pre-agreed for release);
13 14 15 16 17
•
ensure that all media information is made available via the organization’s web-site without undue delay.
COMMENTARY ON 9.3.2c)
18
d) Stakeholder management
19 20 21 22
A process for identifying and prioritizing communications with other key stakeholders should be included. It may be necessary to develop a separate stakeholder management plan to provide criteria for setting priorities and allocating a manager to each stakeholder or group of stakeholders.
23
e) Meeting location (command centre)
24 25 26 27 28 29
The organization should define a predetermined location, room or space from which an incident will be managed. Once established, this location should be the focal point for the organization’s response. An alternate meeting point should also be nominated in case access to the primary location is denied.
30
Command centre facilities should be fit for purpose and include:
31
•
effective primary and secondary means of communication;
32 33 34 35 36 37 38
•
a process for accessing and sharing information, including the monitoring of electronic, broadcast media.
39
f) Annexes
40 41 42
Where appropriate, the IMP should also include up-to-date contact and mobilization details for relevant agencies, organizations and resources that might be required to support the selected response strategies.
appropriate numbers of trained, competent, spokespeople nominated and authorized to release information to the media.
Pre-prepared information can be especially useful in the early stages of an incident. It enables an organization to provide details about the organization and its business while details of the incident are still being established.
NOTE Initially, it may be necessary to hold a virtual meeting, for example by telephone, teleconference or videoconference, so that key decisions can be made promptly.
COMMENTARY ON 9.3.2e) A command centre provides a known focal point from which the incident can be managed. Use of displays and other tools assist in capturing and sharing key information, setting objectives, tasks, managing resources, identifying issues, tracking actions and making informed decisions. Good communications are essential. The use of a meeting point overcomes the situations where telephone networks are overloaded.
0630139869
30
BS 25999-1 1 2 3
The IMP should include an incident log or forms for the recording of vital information in respect of event details, decisions made, details of casualties, damage assessments, communications issued, etc.
4
The IMP may also include:
5 6
•
maps/ charts/ plans/ photographs and other information that might be relevant in the event of an incident;
7 8
•
documented response strategies agreed with third parties as appropriate (joint venture partners, contractors, suppliers, etc.);
9
•
details of equipment staging areas;
10
•
site access plans; and
11 12
•
a claims management procedure that ensures all insurance and legal claims for or against the organization meet regulatory and contractual requirements.
13
9.4 Business continuity plans
14
9.4.1 Introduction
15 16 17
The purpose of a business continuity plan (BCP) is to enable an organization to recover or maintain its activities in the event of a major interruption affecting normal business operations.
18 19 20 21 22 23 24 25
Business continuity plans are activated based on the strategy selected to manage the incident. They may be invoked in whole or part and at any stage of the response to an incident.
26
9.4.2 Contents of the BCP
27
In addition to the items recommended in 9.2, a BCP should contain the following.
28
a) Action plans/ task lists
29 30
The action plan should include a structured checklist of actions and tasks in a chronological order, highlighting:
31
•
how the action plan is invoked;
32 33
•
the person who should determine the requirement for invocation of the business continuity plan;
34
•
the procedure that person should adopt in taking that decision;
35
•
the persons who should be consulted before such a decision is taken;
36
•
the persons who should be informed once a decision has been taken;
37
•
who goes where, and when;
38 39
•
what services are available where, and when; including how external and third-party resources are mobilized;
COMMENTARY ON 9.4.1 The components and contents of BCPs vary from organization to organization and have a different level of detail based on the scale, environment, culture and technical complexity of the industries and associated solutions, risk profile and environment in which they operate. Large organizations might require separate documents for each of their critical business areas/functions, whereas smaller organizations might be able to cover what is critical to them within a single document.
0630139869
31
BS 25999-1 1
•
how this information is communicated, and when; and
2
•
if relevant, detailed procedures for manual workarounds, system recovery, etc.
3 4 5 6 7 8 9
COMMENTARY ON 9.4.2a) These points are consistent with the requirements of the UK Civil Contingencies Act Guidelines, Emergency Preparedness, Section 6.20. Plans will reference the resources, facilities, tools and procedures identified in the strategies phase. Clear assumptions and details of any resources required to implement plans ought to be included. In the event that the lack of a service or resource makes the plan’s goals unachievable, a clear procedure for escalating the issue has to be defined.
10
b) Resource requirements
11 12
The resources required for business recovery should be identified at different points in time. These may include:
13
•
personnel;
14
•
facilities and supplies;
15
•
technology, communications and data;
16
•
security;
17
•
transportation logistics;
18
•
welfare needs; and
19
•
emergency expenses.
20
c) Vital information
21 22
The BCP should define vital information sources and how they should be accessed. Examples of vital information might include:
23
•
financial (e.g. payroll) details;
24
•
customer account records;
25
•
supplier and stakeholder details;
26
•
legal documents (e.g. contracts, insurance policies, title deeds, etc.);
27
•
other service documents (e.g. service level agreements).
28
d) Responsible person(s)
29 30
The organization should identify a nominated person(s) who will assume responsibility for human welfare issues following an incident, such as:
31
•
site evacuation (inclusive of internal evacuations);
32
•
ongoing employee/customer communications and safety briefings;
33
•
emergency contact with a chosen next of kin contact;
34
•
locating displaced workforce or contractors;
35
•
rehabilitation services (physical and emotional);
36
•
family support;
37
•
translation services;
38
•
transport assistance.
0630139869
32
BS 25999-1 1 2 3 4 5
The organization should deploy staff to liaise with the emergency services. COMMENTARY ON 9.4.2d) Emergency services play a significant part in protecting life and relieving suffering during emergencies. Therefore, early liaison, pre-planning and real-time incident coordination between the organization and its first responders can improve the efficiency of an incident response.
6
e) Forms and annexes
7 8 9
Where appropriate, the business continuity plan should list up-to-date contact details for relevant internal and external agencies, organizations and providers that might be required to support the organization.
10 11
The business continuity plan should include an incident log or forms for the recording of vital information, especially in respect of decisions made.
12
The plan may also include:
13
•
forms for recording administrative data, e.g. resources used, expenses etc.;
14 15
•
maps, drawings, and site and office plans, especially those relating to any alternate facilities such as work site recovery areas and storage locations.
16
10 Exercising, maintenance, auditing and self-assessment of BCM arrangements
17
10.1 Introduction
18 19
An organization’s business continuity arrangements are preserved as fit-for-purpose and continually challenged through exercising and assurance processes.
20 21 22
An organization’s business continuity management arrangements cannot be considered reliable until exercised. Exercising is essential to developing teamwork, competence, confidence and knowledge which is vital at the time of an incident.
23 24
Arrangements should be verified through exercising, audit and self assurance processes to ensure that they are fit-for-purpose.
25
10.2 Exercise programme
26 27 28 29 30 31 32 33
An exercise programme should be consistent with the scope of the business continuity plan(s), giving due regard to any relevant regulation. Exercises may include tests which anticipate a predetermined outcome.
34 35 36
An exercise program should be devised that, over a period of time, leads to objective assurance that the BCP will work as anticipated when required. In addition, it might lead to the improvement of BCM capability by:
37
•
practising the organization’s ability to recover from an incident;
38 39
•
verifying that the BCP incorporates all organizational critical activities and their dependencies and priorities;
COMMENTARY ON 10.2 Exercises provide demonstrable evidence of a business continuity and incident management competence and capability. Time and resources spent proving BCM strategies by exercising BC plans will lead to a fit-forpurpose capability. No matter how well designed and thought-out a BCM strategy or BCP appears, a series of robust and realistic exercises that test their implementation will identify areas that could require amendment.
0630139869
33
BS 25999-1 1 2
•
exercising the technical, logistical, administrative, procedural and other operational systems of the BCP;
3 4
•
exercising the BCM organization and infrastructure (including roles, responsibilities, and any command centres and work areas, etc.);
5 6
•
validating the technology and telecommunications resource recovery, availability and relocation of staff;
7
•
highlighting assumptions which need to be questioned;
8
•
providing information and instilling confidence in exercise participants;
9 10
•
raising awareness of business continuity throughout the organization by publicizing the exercise; and
11 12
•
validating the effectiveness and timeliness of restoration of business as usual at the end of the exercise.
13
10.3 Exercises
14 15 16
If exercises use scenarios, these should be realistic and carefully planned and agreed with stakeholders, so that there is minimum risk of disruption to business processes. An exercise should never be allowed to become an incident.
17 18 19
Every exercise should have clearly defined aims and objectives and a post-exercise report that contains recommendations. This report should be used to improve business continuity arrangements in a timely manner.
20 21 22 23 24
The scale and complexity of exercises should reflect the organization’s recovery objectives. Exercises should prove, through their success, that the organization’s business continuity and incident management plans are able to be executed, and contain the appropriate detail and instructions. NOTE A range of approaches to exercising BCM strategies is shown in Table 1.
25
0630139869
34
BS 25999-1 1
Table 1 —Types and methods of exercising BCM strategies Complexity
Exercise
Process
Variants
Simple
Desk check
Review/ amendment of content Challenge content of BC plan Challenge content of BC plan
Update/ validation
Walk-through of plan More complex
Simulation
Exercise critical activities
Most complex
Use “artificial” situation to validate that the BC plan(s) contain both necessary and sufficient information to facilitate successful recovery Invocation in a controlled situation that does not jeopardize business as usual operation Building-/ campus-/ exclusion zone-wide exercise
Good practice frequency A) At least annually
Audit/ verification Include interaction and validate participants’ roles Incorporate associated plans
Annually Annually
Single-day defined operations from recovery site for a fixed time
Annually or less
Annually or biannually
Exercise full BC Annually or less plan, including incident management A) The frequency of exercises should depend upon both the organization’s need and the environment in which it operates. However, the exercising programme should be flexible, taking into account the rate of change within the organization and the outcome of previous exercises.
2 3 4 5
The exercise programme should consider the roles of all parties, including key third party providers, outsource and other partners who would be expected to participate in recovery activities. A debriefing that captures learning points should be held following each exercise.
6
10.4 Outsourced activities
7 8 9 10
If a product, service or activity has been outsourced, the risk accountability for that product, service or activity remains vested within the organization. Consequently, an organization should assure itself that its material suppliers or outsource partners demonstrate readiness to cope with disruption by exercising their own BC plans.
11 12
An organization should obtain evidence of the viability of their material suppliers’ contingency plans and their exercising and maintenance programmes.
13 14 15 16 17 18
10.5 BCM maintenance
19 20 21 22
A clearly defined and documented BCM maintenance programme should be established. This programme should ensure that any changes (internal or external) that impact the organization are reviewed in relation to BCM. It should also identify any new critical activities that need to be included in the BCM maintenance programme.
23
As a result of the BCM maintenance programme, the organization should:
24 25
•
COMMENTARY ON 10.5 The purpose of the BCM maintenance process is to ensure that the organization’s BCM competence and capability remains effective, fit-for purpose and up-to-date. Maintenance activities ought to modify existing exercise schedules when they indicate that there has been a significant change in the strategy, solution or business process.
review and challenge any assumptions made in any components of BCM throughout the organization; and
0630139869
35
BS 25999-1 1 2
•
distribute updated, amended or changed BCM policy, strategies, solutions, processes and plans to key personnel under a formal change (version) control process.
3 4
NOTE If there are major business changes then a revision of the BIA might be indicated. The other components of the BCM programme may be amended to take account of these changes.
5
The outcomes from the BCM maintenance process should include:
6 7
•
documented evidence of the proactive management and governance of the organization’s business continuity programme;
8 9
•
verification that key people who are to implement the BCM strategy and plans are trained and competent;
10 11
•
verification of the monitoring and control of the BCM risks faced by the organization; and
12 13 14
•
documented evidence that material changes to the organization’s structure, activities, purpose, staff and objectives have been incorporated into the BCM and incident management plans.
15 16 17 18 19 20 21 22 23
10.6 Audit
24 25 26
The organization should provide for the independent audit of its BCM to identify actual and potential shortcomings. It should establish, implement and maintain procedures for dealing with these.
27 28 29 30 31
10.7 Self-assessment
32 33
Actions taken should be appropriate to the magnitude of the problems and the organizational impacts encountered.
34
The audit or self-assessment of the organization’s BCM programme should verify that:
35 36
•
all critical products and services, their dependent activities and their supporting resources have been identified and included in the organization’s BCM strategy;
37 38
•
the organization’s BCM policy, strategies, framework and plans continue to accurately reflect its priorities and requirements;
39 40 41
•
the organization’s BCM competence and its BCM capability are effective and fit-forpurpose and will permit management, command, control and coordination of a BCM incident;
COMMENTARY ON 10.6 The purpose of a BCM audit is to review an organization’s existing BCM competence and capability, and verify these against predefined standards and criteria. It has two key functions: — to verify that compliance with the organization’s BCM policy ensures compliance with applicable laws, standards, strategies, framework and good practice guidelines; and — to highlight key material deficiencies and issues and ensure their resolution. The frequency and timing of audit activity can be influenced by laws and regulations, depending on the size, nature and legal status of the organization. They might also be influenced by the requirements of stakeholders.
COMMENTARY ON 10.7 BCM self-assessment process plays a role in ensuring that an organization has a robust, effective and fit-forpurpose BCM competence and capability. It provides the qualitative verification of an organization’s ability to recover from an incident. Self-assessment is regarded as good practice.
0630139869
36
BS 25999-1 1 2
•
the organization’s BCM solutions are effective, up-to-date and fit-for-purpose, and appropriate to the level of risk faced by the organization;
3 4
•
the organization’s BCM maintenance and exercising programmes have been effectively implemented;
5 6
•
BCM strategies and plans incorporate lessons learned from exercises, as contained in a post-exercise report, and amendments arising from the maintenance programme;
7
•
the organization has an ongoing programme for BCM training and awareness; and
8
•
change control processes are in place and operate effectively.
9 10
Self-assessment should be conducted against the organization’s objectives. It should also take into account relevant industry standards and good practice.
11
11 Embedding BCM in the organization’s culture
12
11.1 General
13 14
Building, promoting and embedding a BCM culture within an organization ensures that it becomes part of the organization’s core values and effective management.
15
A BCM culture will ensure that an organization can:
16
•
develop a BCM programme more efficiently;
17 18
•
instil confidence in its stakeholders (especially staff and customers) in its ability to handle disruptions;
19 20
•
increase its resilience over time by ensuring BCM implications are considered in decisions at all levels; and
21 22 23 24 25 26 27 28
•
minimize the impact and likelihood of disruptions.
COMMENTARY ON 11.1 Creating and embedding a BCM culture within an organization can be a lengthy and difficult process which might encounter a level of resistance that was not anticipated. An understanding of the existing culture within the organization will assist in the development of an appropriate BCM culture programme. All staff have to understand that business continuity management is a serious issue for the organization and that they have an important role to play in maintaining the delivery of products and services to their clients and customers.
29
Development of a BCM culture is achieved by:
30
•
assignment of responsibilities (see 6.2);
31
•
skills training; and
32
•
awareness training.
33
11.2 Training
34 35
The organization should have a process for identifying and delivering the BCM training requirements of relevant participants and evaluate the effectiveness of its delivery.
36
The organization should undertake training of:
37
a) BCM staff for such tasks as:
38
•
programme management,
0630139869
37
BS 25999-1 1
•
conducting a business impact analysis,
2
•
developing and implementing BC plans,
3
•
running an exercise programme;
4 5
b) non-BCM staff requiring skills to undertake their nominated roles in incident response or business recovery.
6 7
Response skills throughout the organization should be developed by practical training, including active participation in exercises.
8
11.3 Awareness
9 10 11 12 13
The organization should have a process for identifying and delivering the BCM awareness requirements of the organization and evaluating the effectiveness of its delivery. NOTE Raising and maintaining awareness of BCM with all the organization’s staff is important to ensure that they are aware of why BCM is important to the organization. They will need to be convinced that this is a lasting initiative that has the ongoing support of the executive.
14 15
The organization should raise, enhance and maintain awareness by maintaining an ongoing BCM education and information programme for existing and new staff.
16
Such a programme may include:
17 18
•
a consultation process with staff throughout the organization, concerning the implementation of the BCM programme;
19
•
discussion of BCM in the organization’s newsletters, briefings or journals;
20
•
inclusion of BCM on relevant web pages or intranets;
21
•
learning from internal and external incidents;
22
•
BCM as an item at team meetings;
23
•
exercising continuity plans at an alternate location (e.g. a recovery site);
24
•
visits to any designated alternate location (e.g. a recovery site).
25 26
The organization may extend its BCM awareness programme to its suppliers and other stakeholders.
0630139869
38
BS 25999-1
1
Bibliography
2 3
BS ISO/IEC 17799, Information technology ― Security techniques — Code of practice for information security management.
4
0630139869
39
