Societal security — Business continuity management systems ...

1 THIS DOCUMENT IS A DRAFT CIRCULATED FOR COMMENT AND APPROVAL. IT IS THEREFORE SUBJECT TO CHANGE AND MAY NOT BE REFERRED TO AS AN INTERNATIONAL STANDARD UNTIL PUBLISHED AS SUCH. IN ADDITION TO THEIR EVALUATION AS BEING ACCEPTABLE FOR INDUSTRIAL, TECHNOLOGICAL, COMMERCIAL AND USER PURPOSES, DRAFT INTERNATIONAL STANDARDS MAY ON OCCASION HAVE TO BE CONSIDERED IN THE LIGHT OF THEIR POTENTIAL TO BECOME STANDARDS TO WHICH REFERENCE MAY BE MADE IN NATIONAL REGULATIONS. RECIPIENTS OF THIS DRAFT ARE INVITED TO SUBMIT, WITH THEIR COMMENTS, NOTIFICATION OF ANY RELEVANT PATENT RIGHTS OF WHICH THEY ARE AWARE AND TO PROVIDE SUPPORTING DOCUMENTATION. International Organization for Standardization, 2011 DRAFT INTERNATIONAL STANDARD ISO/DIS 22313 ISO/TC 223 Secretariat: SIS Voting begins on Voting terminates on 2011-12-13 2012-05-13 INTERNATIONAL ORGANIZATION FOR STANDARDIZATION МЕЖДУНАРОДНАЯ ОРГАНИЗАЦИЯ ПО СТАНДАРТИЗАЦИИ ORGANISATION INTERNATIONALE DE NORMALISATION Societal security Business continuity management systems Guidance S curit soci tale Gestion de la continuit des affaires Lignes directrices ICS 0 In accordance with the provisions of Council Resolution 15/1993 this document is circulated in the English language only.

2 Conform ment aux dispositions de la R solution du Conseil 15/1993, ce document est distribu en version anglaise seulement. To expedite distribution, this document is circulated as received from the committee secretariat. ISO Central Secretariat work of editing and text composition will be undertaken at publication stage. Pour acc l rer la distribution, le pr sent document est distribu tel qu'il est parvenu du secr tariat du comit . Le travail de r daction et de composition de texte sera effectu au Secr tariat central de l'ISO au stade de publication. ISO/DIS 22313 Copyright notice This ISO document is a Draft International Standard and is copyright-protected by ISO.

3 Except as permitted under the applicable laws of the user s country, neither this ISO draft nor any extract from it may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, photocopying, recording or otherwise, without prior written permission being secured. Requests for permission to reproduce should be addressed to either ISO at the address below or ISO s member body in the country of the requester. ISO copyright office Case postale 56 CH-1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E- mail Web Reproduction may be subject to royalty payments or a licensing agreement.

4 Violators may be prosecuted. ii ISO 2011 All rights reserved ISO/DIS 22313 ISO 2011 All rights reserved iii Contents Page Foreword .. v vi 0 vi The Plan-Do-Check-Act cycle .. vii Business continuity management .. vii 1 Scope .. 1 2 Normative 1 3 Terms and definitions .. 2 4 Context of the organization .. 8 Understanding of the organization and its context ..8 Understanding the needs and expectations of interested parties .. 9 General .. 9 Legal and regulatory requirements ..10 Determining the scope of the management system.

5 11 General .. 11 Scope of the BCMS ..11 Business continuity management 5 Leadership .. 12 General .. 12 management commitment ..12 Policy .. 12 Organizational roles, responsibilities and authorities .. 13 6 Planning .. 14 Actions to address risks and opportunities ..14 Business continuity objectives and plans to achieve them ..14 7 Support .. 15 Resources .. 15 General .. 15 BCMS 16 Incident response personnel ..16 Competence .. 17 18 Communication ..20 Documented information.

6 20 General .. 20 Create and update .. 22 Control of documented information ..22 8 23 Operational planning and control ..23 Elements of the Business continuity programme ..23 Managing the BCM environment ..25 Managing the Business continuity Measuring Outcomes .. 26 Business impact analysis and risk assessment .. 26 General .. 26 Business impact ISO/DIS 22313 iv ISO 2011 All rights reserved Risk 29 Business continuity 30 Determination and 30 Establishing resource requirements .. 32 Protection and mitigation.

7 37 Establish and implement Business continuity 37 37 Incident response structure .. 38 Warning and communication .. 38 Business continuity plans .. 40 47 Exercising and testing .. 48 Exercise programme .. 48 Exercising Business continuity plans .. 48 9 Performance evaluation .. 50 Monitoring, measurement, analysis and evaluation .. 50 50 Evaluation of continuity procedures .. 51 Internal audit .. 52 management 53 10 Improvement .. 54 Nonconformity and corrective action .. 54 Continual 55 Bibliography.

8 57 ISO/DIS 22313 ISO 2011 All rights reserved v Foreword ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

9 International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of technical committees is to prepare International Standards. Draft International Standards adopted by the technical committees are circulated to the member bodies for voting. Publication as an International Standard requires approval by at least 75 % of the member bodies casting a vote. ISO 22313 was prepared by Technical Committee ISO/TC 223, Societal security . ISO/DIS 22313 vi ISO 2011 All rights reserved Introduction 0 Introduction General This International Standard provides guidance to ISO 22301 for setting up and managing an effective Business continuity management system (BCMS) A BCMS emphasizes the importance of: understanding the organization s needs and the necessity for establishing Business continuity management policy and objectives; implementing and operating controls and measures for managing an organization s overall Business continuity risks; monitoring and reviewing the performance and effectiveness of the BCMS.

10 And continual improvement based on objective measurement. A BCMS, like any other management system, includes the following key components: a) a policy; b) people with defined responsibilities; c) management processes relating to: 1) policy; 2) planning; 3) implementation and operation; 4) performance assessment; 5) management review; 6) improvement. d) a set of documentation providing auditable evidence; and e) any Business continuity management processes relevant to the organization. Business continuity contributes to a more resilient society. The wider community and the organization s environment impact on the organization and therefore other organizations may need to be involved in the recovery process.