BS 25999
Business Continuity Management
According to BS 25999, BCM is a ‘business-owned, business-driven’ process that establishes a fit-for-purpose strategic and operational framework’ which in terms:
“Proactively improves an organization’s resilience against the disruption of its ability to achieve key objectives”
“Provides a rehearsed method of restoring an organization’s ability to supply its key products and services to an agreed level within an agreed time after a disruption”
“Delivers a proven capability to manage a business disruption and protect the organization’s reputation, brand, revenues and customer base.”
The significance of BS 25999 is that it is the first national Standard for BCM to which organisations can be certified. It has been developed by a wide group of world class experts representing a cross section of industry sectors and provides a unified approach to defining processes, principles and terminology surrounding BCM.
BS 25999 provides a basis for understanding, developing and implementing a risk based BCM approach within an organisation and so providing reassurance to both internal and external stakeholders. It contains a comprehensive set of BCM best practice and covers the whole BCM lifecycle. It is not merely about ensuring organisations to have a contingency plan in case of a disaster, but rather about understanding the business imperatives of an organisation, recognising where its critical activities are and designing availability in to them to avoid damaging disruptions in the first place.
The BS 25999 Standard advocates a 6 stage lifecycle incorporating:
BCM programme management
Understanding the organisation
Determining the BCM strategy
Developing and implementing BCM response
Exercising, maintaining and reviewing
Embedding BCM in the organisational culture.
BS 25999 recommends that in order to deliver effective and efficient BCM every organisation wraps its activities into a Programme Management function to ensure focus, management and maintenance. BCM Programme Management facilitates the establishment of the business continuity capability and its maintenance in a manner appropriate to the size and complexity of the organisation.
Understanding the organisation activities (including the compulsory risk assessment) provide information to enable an organisation to prioritise its products and services, and identify the criticalness of the activities that are required to deliver them. Outputs from these activities will determine the selection of appropriate BCM strategies. Since BCM requirements should be based upon actual business requirements “understanding the organisation” are arguably the most important activity to get right. Should the identification of the actual critical activities of an organization fail, it can mean that the rest of the BCM Programme is based on inaccurate information, so in case of a disruption, key processes will fail to receive the required priority. This can also result in incurrence of unnecessary costs by focusing on non-critical activities.
Activities and documents which should be prepared are the following:
Scope Determination
Mission Critical Activities
Business Impact Analysis
Risk Assessment
Strategy Roadmap
Design and Development of BC Plan
Crisis Management
Internal Audit
Testing and Maintenance
Roadmap Formulation
Gap Analysis/Benchmarking
Milestone Review
BCM Review
BCM Metrics
Risk Assessment and Risk Management training
|
