Business continuity management

Transcription

1 BRITISH STANDARD Busess cotuty maagemet Part 1: Code of practce ICS NO COPYING WITHOUT BSI PERMISSION EXCEPT AS PERMITTED BY COPYRIGHT LAW

2 Publshg ad copyrght formato The BSI copyrght otce dsplayed ths documet dcates whe the documet was last ssued. BSI 2006 ISBN The followg BSI refereces relate to the work o ths stadard: Commttee referece BCM/1 Draft for commet 06/ DC Publcato hstory Frst publshed November 2006 Amedmets ssued sce publcato Amd. o. Date Text affected

3 Cotets Foreword 1 Scope ad applcablty 1 2 Terms ad deftos 1 3 Overvew of busess cotuty maagemet (BCM) 6 4 The busess cotuty maagemet polcy 10 5 BCM programme maagemet 13 6 Uderstadg the orgazato 16 7 Determg busess cotuty strategy 21 8 Developg ad mplemetg a BCM respose 26 9 Exercsg, matag ad revewg BCM arragemets Embeddg BCM the orgazato s culture 40 Refereces 42 Lst of fgures Fgure 1 The busess cotuty maagemet lfecycle 9 Fgure 2 Icdet tmele 27 Lst of tables Table 1 Types ad methods of exercsg BCM strateges 37 Summary of pages Ths documet comprses a frot cover, a sde frot cover, pages to, a blak page, pages 1 to 42, a sde back cover ad a back cover. BSI 2006

4 Foreword Publshg formato Ths Brtsh Stadard was publshed by BSI ad came to effect o 30 November It was prepared by Techcal Commttee BCM/1, Busess cotuty maagemet. Orgazatos represeted o ths commttee clude: Assocato of Brtsh Certfcato Bodes Assocato of Brtsh Isurers Assocato of Chef Polce Offcers Assocato of Isurace Rsk Maagers Busess Cotuty Isttute Cabet Offce Chef Fre Offcers Assocato (CFOA) Cotuty Forum Covetry Uversty Departmet of Trade ad Idustry Emergecy Plag Socety Federato of Small Busesses Facal Servces Authorty Idepedet Iteratoal Orgazato for Certfcato Isttute of Drectors Isttute of Emergecy Maagemet Isttute of Iteral Audtors Isttute of Rsk Maagemet Itellect Metropolta Polce Securtes Idustry Busess Cotuty Maagemet Group (SIBCMG) Socety of Idustral Emergecy Servces Offcers (SIESO) Survve Ths Brtsh Stadard has bee developed by practtoers throughout the busess cotuty commuty, drawg upo ther academc, techcal ad practcal expereces of busess cotuty maagemet (BCM). It has bee produced to provde a system based o good practce for busess cotuty maagemet. It s teded to serve as a sgle referece pot for most stuatos where busess cotuty maagemet s practsed, ad to be used by large, medum ad small orgazatos dustral, commercal, publc ad volutary sectors. Ths documet costtutes Part 1 of BS At the tme of publcato, Part 2 was preparato whch wll specfy requremets for busess cotuty maagemet. BSI 2006

5 Use of ths documet As a code of practce, ths Brtsh Stadard takes the form of gudace ad recommedatos. It should ot be quoted as f t were a specfcato ad partcular care should be take to esure that clams of complace are ot msleadg. Ay user clamg complace wth ths Brtsh Stadard s expected to be able to justfy ay course of acto that devates from ts recommedatos. Presetatoal covetos The provsos of ths Stadard are recommedatos, whch are expressed seteces whch the prcpal auxlary verb s should. Clause 3 does ot cota ay recommedatos; rather, t gves useful backgroud formato o busess cotuty maagemet (though the Stadard s ot teded as a beger s gude to busess cotuty maagemet). The word may s used the text to express permssblty, e.g. as a alteratve to the prmary recommedato of the clause. The word ca s used to express possblty, e.g. a cosequece of a acto or a evet. Supplemetary commetary, explaato ad geeral formatve materal s preseted smaller talc type, ad does ot costtute a ormatve elemet. Cotractual ad legal cosderatos Ths publcato does ot purport to clude all the ecessary provsos of a cotract. Users are resposble for ts correct applcato. Complace wth a Brtsh Stadard caot cofer mmuty from legal oblgatos. BSI 2006

6 v BSI 2006 Ths page delberately left blak

7 1 Scope ad applcablty Ths Brtsh Stadard establshes the process, prcples ad termology of busess cotuty maagemet (BCM). The purpose of ths Stadard s to provde a bass for uderstadg, developg ad mplemetg busess cotuty wth a orgazato ad to provde cofdece the orgazato's dealgs wth customers ad other orgazatos. It also eables the orgazato to measure ts BCM capablty a cosstet ad recogzed maer. Ths Stadard provdes a system based o BCM good practce. Ths Stadard s teded for use by ayoe wth resposblty for busess operatos or the provso of servces, from top maagemet through all levels of the orgazato; from those wth a sgle ste to those wth a global presece; from sole traders ad small-to-medum eterprses (SMEs) to orgazatos employg thousads of people. It s therefore applcable to aybody who holds resposblty for ay operato, ad thus the cotuty of that operato. Ths Stadard does ot cover the actvtes of emergecy plag asmuch as that topc relates to cvl emergeces. NOTE Ultmately, o matter how much effort or resource s vested busess cotuty maagemet, a orgazato could stll be faced wth a cdet or combato of cdets t dd ot forsee. 2 Terms ad deftos For the purposes of ths part of BS 25999, the followg deftos apply. 2.1 actvty process or set of processes udertake by a orgazato (or o ts behalf) that produces or supports oe or more products or servces NOTE Examples of such processes clude accouts, call cetre, IT, maufacture, dstrbuto. 2.2 busess cotuty strategc ad tactcal capablty of the orgazato to pla for ad respod to cdets ad busess dsruptos order to cotue busess operatos at a acceptable pre-defed level 2.3 busess cotuty maagemet (BCM) holstc maagemet process that detfes potetal threats to a orgazato ad the mpacts to busess operatos that those threats, f realzed, mght cause, ad whch provdes a framework for buldg orgazatoal reslece wth the capablty for a effectve respose that safeguards the terests of ts key stakeholders, reputato, brad ad value-creatg actvtes NOTE Busess cotuty maagemet volves maagg the recovery or cotuato of busess actvtes the evet of a busess dsrupto, ad maagemet of the overall programme through trag, exercses ad revews, to esure the busess cotuty pla(s) stays curret ad up-to-date. BSI

8 2.4 busess cotuty maagemet lfecycle seres of busess cotuty actvtes whch collectvely cover all aspects ad phases of the busess cotuty maagemet programme NOTE The busess cotuty maagemet lfecycle s llustrated Fgure busess cotuty maagemet programme ogog maagemet ad goverace process supported by top maagemet ad approprately resourced to esure that the ecessary steps are take to detfy the mpact of potetal losses, mata vable recovery strateges ad plas, ad esure cotuty of products ad servces through trag, exercsg, mateace ad revew 2.6 busess cotuty pla (BCP) documeted collecto of procedures ad formato that s developed, compled ad mataed readess for use a cdet to eable a orgazato to cotue to delver ts crtcal actvtes at a acceptable pre-defed level 2.7 busess cotuty strategy approach by a orgazato that wll esure ts recovery ad cotuty the face of a dsaster or other major cdet or busess dsrupto 2.8 busess mpact aalyss process of aalysg busess fuctos ad the effect that a busess dsrupto mght have upo them 2.9 cvl emergecy evet or stuato whch threates serous damage to huma welfare a place the UK, the evromet of a place the UK, or the securty of the UK or of a place the UK [UK Cvl Cotgeces Act 2004 (1)] 2.10 cosequece outcome of a cdet that wll have a mpact o a orgazato's objectves NOTE 1 There ca be a rage of cosequeces from oe cdet. NOTE 2 A cosequece ca be certa or ucerta ad ca have postve or egatve mpact o objectves cost-beeft aalyss facal techque that measures the cost of mplemetg a partcular soluto ad compares ths wth the beeft delvered by that soluto NOTE The beeft may be defed facal, reputatoal, servce delvery, regulatory or other terms approprate to the orgazato. 2 BSI 2006

9 2.12 crtcal actvtes those actvtes whch have to be performed order to delver the key products ad servces whch eable a orgazato to meet ts most mportat ad tme-sestve objectves 2.13 dsrupto evet, whether atcpated (e.g. a labour strke or hurrcae) or uatcpated (e.g. a blackout or earthquake), whch causes a uplaed, egatve devato from the expected delvery of products or servces accordg to the orgazato s objectves 2.14 emergecy plag developmet ad mateace of agreed procedures to prevet, reduce, cotrol, mtgate ad take other actos the evet of a cvl emergecy 2.15 exercse 2.16 ga actvty whch the busess cotuty pla(s) s rehearsed part or whole to esure that the pla(s) cotas the approprate formato ad produces the desred result whe put to effect NOTE A exercse ca volve vokg busess cotuty procedures, but s more lkely to volve the smulato of a busess cotuty cdet, aouced or uaouced, whch partcpats role-play order to assess what ssues mght arse, pror to a real vocato. postve cosequece 2.17 mpact evaluated cosequece of a partcular outcome 2.18 cdet stuato that mght be, or could lead to, a busess dsrupto, loss, emergecy or crss 2.19 cdet maagemet pla clearly defed ad documeted pla of acto for use at the tme of a cdet, typcally coverg the key persoel, resources, servces ad actos eeded to mplemet the cdet maagemet process 2.20 vocato act of declarg that a orgazato s busess cotuty pla eeds to be put to effect order to cotue delvery of key products or servces BSI

10 2.21 lkelhood 2.22 loss chace of somethg happeg, whether defed, measured or estmated objectvely or subjectvely, or terms of geeral descrptors (such as rare, ulkely, lkely, almost certa), frequeces or mathematcal probabltes NOTE 1 Lkelhood ca be expressed qualtatvely or quattatvely. NOTE 2 The word probablty ca be used stead of lkelhood some o-eglsh laguages that have o drect equvalet. Because probablty s ofte terpreted more formally Eglsh as a mathematcal term, lkelhood s used throughout ths Stadard wth the teto that t s gve the same broad terpretato as probablty. egatve cosequece 2.23 maxmum tolerable perod of dsrupto durato after whch a orgazato s vablty wll be rrevocably threateed f product ad servce delvery caot be resumed 2.24 orgazato group of people ad facltes wth a arragemet of resposbltes, authortes ad relatoshps EXAMPLE Compay, corporato, frm, eterprse, sttuto, charty, sole trader or assocato, or parts or combatos thereof. NOTE 1 The arragemet s geerally orderly. NOTE 2 A orgazato ca be publc or prvate. [BS EN ISO 9000:2005] 2.25 products ad servces beefcal outcomes provded by a orgazato to ts customers, recpets ad stakeholders, e.g. maufactured tems, car surace, regulatory complace ad commuty ursg 2.26 recovery tme objectve target tme set for: resumpto of product or servce delvery after a cdet; or resumpto of performace of a actvty after a cdet; or recovery of a IT system or applcato after a cdet. NOTE The recovery tme objectve has to be less tha the maxmum tolerable perod of dsrupto reslece ablty of a orgazato to resst beg affected by a cdet 4 BSI 2006

11 2.28 rsk somethg that mght happe ad ts effect(s) o the achevemet of objectves NOTE 1 The word rsk s used colloqually varous ways, as a ou ( a rsk or, the plural, rsks ), a verb (to rsk [somethg], or to put at rsk), or as a adjectve ( rsky ). Used as a ou the term a rsk could relate to ether a potetal evet, ts causes, the chace (lkelhood) of somethg happeg, or the effects of such evets. I rsk maagemet (see 6.5) t s mportat to make a clear dstcto betwee these varous usages of the word rsk. NOTE 2 Rsk s defed relatve to a partcular objectve; therefore, cocer for several objectves mples the possblty of more tha oe measure of rsk wth respect to ay source of rsk. NOTE 3 Rsk s ofte quatfed as a average effect by summg the combed effect of each possble cosequece weghted by the assocated lkelhood of each cosequece, to obta a expected value. However, probablty dstrbutos are eeded to quatfy perceptos about the rage of possble cosequeces. Alteratvely, summary statstcs, such as stadard devato, may be used addto to expected value rsk appette total amout of rsk that a orgazato s prepared to accept, tolerate or be exposed to at ay pot tme 2.30 rsk assessmet overall process of rsk detfcato, aalyss ad evaluato 2.31 rsk maagemet structured developmet ad applcato of maagemet culture, polcy, procedures ad practces to the tasks of detfyg, aalysg, evaluatg, ad cotrollg respodg to rsk 2.32 stakeholders those wth a vested terest a orgazato s achevemets NOTE Ths s a wde-ragg term that cludes, but s ot lmted to, teral ad outsourced employees, customers, supplers, parters, employees, dstrbutors, vestors, surers, shareholders, owers, govermet ad regulators top maagemet perso or group of people who drect ad cotrol a orgazato at the hghest level [BS EN ISO 9000:2005] NOTE Top maagemet, especally a large multatoal orgazato, mght ot be drectly volved; however, top maagemet accoutablty through the cha of commad s mafest. I a small orgazato, top maagemet mght be the ower or sole propretor. BSI

12 3 Overvew of busess cotuty maagemet (BCM) 3.1 What s BCM? Busess cotuty maagemet (BCM) s a busess-owed, busess-drve process that establshes a ft-for-purpose strategc ad operatoal framework that: proactvely mproves a orgazato s reslece agast the dsrupto of ts ablty to acheve ts key objectves; provdes a rehearsed method of restorg a orgazato s ablty to supply ts key products ad servces to a agreed level wth a agreed tme after a dsrupto; ad delvers a prove capablty to maage a busess dsrupto ad protect the orgazato s reputato ad brad. Whle the dvdual processes of busess cotuty ca chage wth a orgazato s sze, structures ad resposbltes, the basc prcples rema exactly the same for volutary, prvate or publc sector orgazatos, regardless of ther sze, scope or complexty. 3.2 BCM ad orgazatoal strategy All orgazatos, whether large or small, have ams ad objectves, such as to grow, to provde servces ad to acqure other busesses. These ams ad objectves are geerally met va strategc plas to acheve a orgazato s short, medum ad log term goals. BCM uderstadg at a orgazato s hghest level wll esure that these ams ad objectves are ot compromsed by uexpected dsruptos. The cosequeces of a cdet vary ad ca be far-reachg. These cosequeces mght volve loss of lfe, loss of assets or come, or the ablty to delver products ad servces o whch the orgazato s strategy, reputato or eve survval mght deped. BCM eeds to recogze the strategc mportace of kow stakeholders. Furthermore, as the cosequeces of a dsrupto ufold, ew stakeholders emerge ad have a drect mpact o the evetual extet of the damage. For example, ssue groups may attempt to apply pressure o the orgazato facg a dsrupto. All these ssues are of strategc cocer to the orgazato. 3.3 BCM the relatoshp wth rsk maagemet BCM s complemetary to a rsk maagemet framework that sets out to uderstad the rsks to operatos or busess, ad the cosequeces of those rsks. Rsk maagemet seeks to maage rsk aroud the key products ad servces that a orgazato delvers. Product ad servce delvery ca be dsrupted by a wde varety of cdets, may of whch are dffcult to predct or aalyse by cause. 6 BSI 2006

13 By focusg o the mpact of dsrupto, BCM detfes those products ad servces o whch the orgazato depeds for ts survval, ad ca detfy what s requred for the orgazato to cotue to meet ts oblgatos. Through BCM, a orgazato ca recogze what eeds to be doe before a cdet occurs to protect ts people, premses, techology, formato, supply cha, stakeholders ad reputato. Wth that recogto, the orgazato ca the take a realstc vew o the resposes that are lkely to be eeded as ad whe a dsrupto occurs, so that t ca be cofdet that t wll maage through ay cosequeces wthout uacceptable delay delverg ts products or servces. A orgazato wth approprate BCM measures place mght be able to take advatage of opportutes whch have a hgh rsk. 3.4 Why a orgazato should udertake BCM BCM forms a mportat elemet of good busess maagemet, servce provso ad etrepreeural prudece. Maagers ad owers have the resposblty to mata the ablty of the orgazato to fucto wthout dsrupto. Orgazatos costatly make commtmets or have a duty to delver products ad servces,.e. they eter to cotracts ad otherwse rase expectatos. All orgazatos have moral ad socal resposbltes, partcularly where they provde a emergecy respose or a publc or volutary servce. I some cases, orgazatos have statutory or regulatory dutes to udertake BCM. All busess actvty s subject to dsruptos, such as techology falure, floodg, utlty dsrupto ad terrorsm. BCM provdes the capablty to adequately react to operatoal dsruptos whle protectg welfare ad safety. BCM ought ow to be regarded, ot as a costly plag process, but as oe that adds value to the orgazato. 3.5 The beefts of a effectve BCM programme The beefts of a effectve BCM programme are that the orgazato: s able to proactvely detfy the mpacts of a operatoal dsrupto; has place a effectve respose to dsruptos whch mmzes the mpact o the orgazato; matas a ablty to maage usurable rsks; ecourages cross-team workg; s able to demostrate a credble respose through a process of exercsg; could ehace ts reputato; ad mght ga a compettve advatage, coferred by the demostrated ablty to mata delvery. BSI

14 3.6 The outcomes of a effectve BCM programme The outcomes of a effectve BCM programme are that: key products ad servces are detfed ad protected, esurg ther cotuty; a cdet maagemet capablty s eabled to provde a effectve respose; the orgazato s uderstadg of tself ad ts relatoshps wth other orgazatos, relevat regulators or govermet departmets, local authortes ad the emergecy servces s properly developed, documeted ad uderstood; staff are traed to respod effectvely to a cdet or dsrupto through approprate exercsg; stakeholder requremets are uderstood ad able to be delvered; staff receve adequate support ad commucatos the evet of a dsrupto; the orgazato s supply cha s secured; the orgazato s reputato s protected; ad the orgazato remas complat wth ts legal ad regulatory oblgatos. 3.7 Elemets of the busess cotuty maagemet lfecycle The BCM lfecycle comprses sx elemets, as llustrated by Fgure 1. These ca be mplemeted by orgazatos of all szes, all sectors: publc, prvate, o-proft, educatoal, maufacturg, etc. The scope ad structure of a BCM programme ca vary, ad the effort expeded wll be talored to the eeds of the dvdual orgazato, but these essetal elemets stll have to be udertake. a) BCM programme maagemet (see Clause 5) Programme maagemet eables the busess cotuty capablty to be both establshed (f ecessary) ad mataed a maer approprate to the sze ad complexty of the orgazato. b) Uderstadg the orgazato (see Clause 6) The actvtes assocated wth Uderstadg the orgazato provde formato that eables prortzato of a orgazato s products ad servces ad the urgecy of the actvtes that are requred to delver them. Ths sets the requremets that wll determe the selecto of approprate BCM strateges. 8 BSI 2006

15 B l BS :2006 Fgure 1 The busess cotuty maagemet lfecycle M t h e o r g Uderstadg the orgazato a z a t C o g ' d Exercsg, matag ad revewg BCM programme maagemet Determg BCM strategy s c u d e t b m E Developg ad mplemetg BCM respose e r u c) Determg busess cotuty strategy (see Clause 7) Determg busess cotuty strategy eables a rage of strateges to be evaluated. Ths allows a approprate respose to be chose for each product or servce, such that the orgazato ca cotue to delver those products ad servces: at a acceptable level of operato; ad wth a acceptable tmeframe durg ad followg a dsrupto. The choce made wll take accout of the reslece ad coutermeasure optos already preset wth the orgazato. BSI

16 COMMENTARY ON 3.7d) The term cdet s used throughout ths Stadard to reflect the scalablty of evets, from small to large whch ca affect a orgazato. A sgle cdet or seres of cdets ca result serous dsruptos to the orgazato s ablty to meet ts oblgatos. If a cdet s maaged well t mght ot develop to a crss. However, some evets wll cause such a profoud dsrupto to the orgazato s objectves as to be cosdered a crss mmedately. A cdet mght exceed the preparedess of a orgazato, eve f t has carefully examed respose measures agast a atcpated level of damage. It s therefore mperatve that maagemet ad ts supportg structures do ot adhere stubborly to a exstg pla, but make judgmets accordg to the crcumstaces. A busess cotuty pla s ever a substtute for formed ad competet maagemet decso-makg. d) Developg ad mplemetg a BCM respose (see Clause 8) Developg ad mplemetg a BCM respose results the creato of a maagemet framework ad a structure of cdet maagemet, busess cotuty ad busess recovery plas that detal the steps to be take durg ad after a cdet to mata or restore operatos. e) BCM exercsg, matag ad revewg BCM arragemets (see Clause 9) BCM exercsg, mateace, revew ad audt leads to the orgazato beg able to: demostrate the extet to whch ts strateges ad plas are complete, curret ad accurate; ad detfy opportutes for mprovemet. f) Embeddg BCM the orgazato s culture (see Clause 10) Embeddg BCM the orgazato s culture eables BCM to become part of the orgazato s core values ad stls cofdece all stakeholders the ablty of the orgazato to cope wth dsruptos. 4 The busess cotuty maagemet polcy 4.1 Overvew COMMENTARY ON 4.1 The purposes of establshg a busess cotuty polcy are to: wesure that all BCM actvtes are coducted ad mplemeted a agreed ad cotrolled maer; w acheve a busess cotuty capablty that meets chagg busess eeds ad s approprate to the sze, complexty ad ature of the orgazato; ad w put place a clearly defed framework for the ogog BCM capablty The BCM polcy defes the followg processes: the set-up actvtes for establshg a busess cotuty capablty; ad the ogog maagemet ad mateace of the busess cotuty capablty The set-up actvtes corporate the specfcato, ed-to-ed desg, buld, mplemetato ad tal exercsg of the busess cotuty capablty The ogog mateace ad maagemet actvtes clude embeddg busess cotuty wth the orgazato, exercsg plas regularly, ad updatg ad commucatg them, partcularly whe there s sgfcat chage premses, persoel, process, market, techology or orgazatoal structure. 10 BSI 2006

17 4.2 Cotext The orgazato should esure that ts BCM polcy s approprate to the ature, scale, complexty, geography ad crtcalty of ts busess actvtes ad that t reflects ts culture, depedeces ad operatg evromet. The BCM polcy defes the process requremets to esure that busess cotuty arragemets cotue to meet the eeds of the orgazato the evet of a cdet. Ths polcy should esure that a busess cotuty capablty s promoted wth the orgazato s culture. The BCM capablty should be tegrated to the orgazato s chage maagemet actvty so that t s corporated to the growth ad developmet of the orgazato s products ad servces. 4.3 Developmet of the busess cotuty polcy The orgazato should develop ts busess cotuty polcy whch states the objectves of BCM wth the orgazato. Itally, ths may be a hgh level statemet of tet whch s refed ad ehaced as the capablty s developed. The busess cotuty polcy should provde the orgazato wth documeted prcples to whch t wll aspre ad agast whch ts busess cotuty capablty should be measured. The BCM polcy should be owed at a hgh level, e.g. a board drector or elected represetatve. The orgazato may cosder the followg whe developg ts BCM polcy: defg the scope of BCM wth the orgazato; BCM resourcg; defg the BCM prcples, gudeles ad mmum stadards for the orgazato; referecg ay relevat stadards, regulatos or polces that have to be cluded or ca be used as a bechmark. The orgazato should mata ad regularly revew ts BCM polcy, strateges, plas ad solutos o a regular bass le wth the orgazato's eeds. The scope of the BCM polcy should clearly defe ay lmtatos or exclusos that apply, e.g. geographcal or product exclusos. 4.4 Scope of the BCM programme Top maagemet may determe the scope of the BCM programme by detfyg the key products ad servces that support the orgazato s objectves, oblgatos ad statutory dutes. Determato of what s key should be cosstet wth the busess mpact aalyss descrbed 6.2, albet at a hgher level of cosderato. BSI

18 4.5 Outsourced actvtes If a product, servce or actvty has bee outsourced, the rsk accoutablty for that product, servce or actvty remas vested wth the orgazato. Cosequetly, a orgazato should assure tself that ts key supplers or outsource parters have effectve BCM arragemets place. Oe method of dog ths s to obta audted evdece of the vablty of key supplers cotuty plas ad ther exercsg ad mateace programmes. 12 BSI 2006

19 d d e b ' s l t BS : BCM programme maagemet g B C M t Exercsg, matag ad revewg h e o r g Uderstadg the orgazato BCM programme maagemet a z a Determg BCM strategy t o c Programme maagemet s at the heart of the BCM process. Effectve programme maagemet establshes the orgazato s approach to busess cotuty. The partcpato of top maagemet s key to esurg that the BCM process s correctly troduced, adequately supported ad establshed as part of the orgazato s culture. u m E Developg ad mplemetg BCM respose e r u 5.1 Overvew A BCM programme should be put place to acheve the objectves defed the busess cotuty polcy (see 4.3). BCM programme maagemet volves three steps: assgg resposbltes (see 5.2); mplemetg busess cotuty the orgazato (see 5.3); ad the ogog maagemet of busess cotuty (see 5.4). 5.2 Assgg resposbltes (goverace) The orgazato s maagemet should: appot or omate a perso wth approprate seorty ad authorty to be accoutable for BCM polcy ad mplemetato; ad appot or omate oe or more dvduals to mplemet ad mata the BCM programme. COMMENTARY ON Idvduals tasked wth mplemetg ad matag the busess cotuty programme may resde may areas of a orgazato depedg o ts sze, scale ad complexty. It s essetal, however, that a perso wth approprate authorty (e.g. ower, board drector or elected represetatve) has overall resposblty for BCM ad s drectly accoutable for esurg the cotued success of ths capablty. BSI

20 5.2.2 If the orgazato s structure so dcates, top maagemet may omate represetatves across the busess by fucto or locato to assst the mplemetato of the BCM programme. The roles, accoutabltes, resposbltes ad authortes should be tegrated to job descrptos ad skll sets. The orgazato s audt process should revew these resposbltes. These resposbltes may be reforced by cludg them the orgazato s apprasal, reward ad recogto polcy. COMMENTARY ON I large orgazatos there mght be a eed for a team of busess cotuty represetatves wth dfferg roles ad resposbltes. I smaller orgazatos, resposblty for busess cotuty may resde wth oe or more dvduals. 5.3 Implemetg busess cotuty the orgazato Actvtes to mplemet a busess cotuty programme should clude the desg, buld, ad mplemetato of the programme. The orgazato should: commucate the programme to stakeholders; arrage or provde approprate trag for staff; ad exercse the busess cotuty capablty (see Clause 9) The orgazato may adopt a recogzed project maagemet method to esure that the mplemetato s effectvely maaged 5.4 Ogog maagemet Overvew Ogog maagemet actvtes should esure that busess cotuty s embedded wth the orgazato. Each compoet of a orgazato s busess cotuty capablty should be regularly revewed, exercsed ad updated. I addto, busess cotuty arragemets ad plas should also be revewed ad updated wheever there s a sgfcat chage the orgazato s operatg evromet, persoel, processes or techology, ad whe a exercse or cdet hghlghts defceces Ogog mateace However BCM s resourced, there are actvtes that should be carred out both tally ad o a ogog bass. These may clude: defg the scope, roles ad resposbltes for BCM; appotg a approprate perso or team to maage the ogog BCM capablty; keepg the busess cotuty programme curret through good practce; promotg busess cotuty across the orgazato ad wder, where approprate; admsterg the exercse programme; 14 BSI 2006

21 coordatg the regular revew ad update of the busess cotuty capablty, cludg revewg or reworkg rsk assessmets ad busess mpact aalyses (BIAs); matag documetato approprate to the sze ad complexty of the orgazato (see 5.5); motorg performace of the busess cotuty capablty; maagg costs assocated wth the busess cotuty capablty; ad establshg ad motorg chage maagemet ad successo maagemet regmes. 5.5 BCM documetato Idvduals tasked wth matag busess cotuty should create ad mata the busess cotuty documetato. Ths may clude the followg: a) BCM polcy: BCM scope statemet, BCM terms of referece; b) busess mpact aalyss (BIA); c) rsk ad threat assessmet; d) BCM strategy/strateges; e) awareess programme; f) trag programme; g) cdet maagemet plas; h) busess cotuty plas; ) busess recovery plas; j) exercse schedule ad reports; k) servce level agreemets ad cotracts. BSI

22 d d e b ' s l t BS : Uderstadg the orgazato g B C M t h e o r g Uderstadg the orgazato a z a t o The am of ths elemet of the BCM lfecycle s to assst the uderstadg of the orgazato through the detfcato of ts key products ad servces ad the crtcal actvtes ad resources that support them. Ths elemet esures that the BCM programme s alged to the orgazato s objectves, oblgatos ad statutory dutes. Exercsg, matag ad revewg BCM programme maagemet Determg BCM strategy c u m E Developg ad mplemetg BCM respose e r u 6.1 Itroducto I a busess cotuty cotext, a uderstadg of the orgazato comes from: detfyg the orgazato s objectves, stakeholder oblgatos, statutory dutes ad the evromet whch the orgazato operates; detfyg the actvtes, assets ad resources, cludg those outsde the orgazato, that support the delvery of these products ad servces; assessg the mpact ad cosequeces over tme of the falure of these actvtes, assets ad resources (see 6.2); detfyg ad evaluatg the perceved threats that could dsrupt the orgazato s key products ad servces ad the crtcal actvtes, assets ad resources that support them (see 6.5) It s mportat that the orgazato uderstads: a) the terdepedeces of ts actvtes, ad b) ay relace t has o exteral orgazatos, ad ay relace placed upo t by others. 6.2 Busess mpact aalyss (BIA) The orgazato should determe ad documet the mpact of a dsrupto to the actvtes that support ts key products ad servces. Ths process s commoly referred to as a busess mpact aalyss (BIA). 16 BSI 2006

23 COMMENTARY ON 6.2.2b) Durg a dsrupto, mpacts geerally crease over tme ad affect each actvty dfferetly. Impacts mght also vary depedg o the day, moth or pot the busess lfecycle For each actvty supportg the delvery of key products ad servces wth the scope of ts BCM programme, the orgazato should: a) assess over tme the mpacts that would occur f the actvty was dsrupted; b) establsh the maxmum tolerable perod of dsrupto of each actvty by detfyg: the maxmum tme perod after the start of a dsrupto wth whch the actvty eeds to be resumed, the mmum level at whch the actvty eeds to be performed o ts resumpto, the legth of tme wth whch ormal levels of operato eed to be resumed; c) detfy ay ter-depedet actvtes, assets, supportg frastructure or resources that have also to be mataed cotuously or recovered over tme Whe assessg mpacts, the orgazato should cosder those that relate to ts busess ams ad objectves ad ts stakeholders. These may clude: the mpact o staff or publc wellbeg; the mpact of damage to, or loss of, premses, techology or formato; the mpact of breaches of statutory dutes or regulatory requremets; damage to reputato; damage to facal vablty; deterorato of product or servce qualty; evrometal damage. The orgazato should documet ts approach to assessg the mpact of dsrupto ad ts fdgs ad coclusos. 6.3 Idetfcato of crtcal actvtes COMMENTARY ON 6.3 The maxmum tme perod for resumg actvtes ca vary betwee secods ad several moths depedg o the ature of the actvty. Actvtes that are tme-sestve mght eed to be specfed wth a great degree of accuracy, e.g. to the mute or the hour. Less tme-sestve actvtes mght requre less accuracy. The orgazato may categorze ts actvtes accordg to ther prorty for recovery. Those actvtes whose loss, as detfed durg the BIA, would have the greatest mpact the shortest tme ad whch eed to be recovered most rapdly may be termed crtcal actvtes. Each crtcal actvty supports oe or more key products or servces. The orgazato may wsh to focus ts plag actvtes o crtcal actvtes, but should recogze that other actvtes wll also eed to be recovered wth ther maxmum tolerable perod of dsrupto ad mght also requre advace arragemets to be place. The maxmum tolerable perod of dsrupto wll fluece each actvty s recovery tme objectve whe determg BCM strateges (see Clause 7). BSI

24 COMMENTARY ON 6.4 Techology mples the use of equpmet the broadest sese ad as relevat to the orgazato. Techology mght clude, but s ot lmted to, IT software ad hardware, telecommucatos equpmet, lathes, food preparato maches, vacuum sealg machery or ay other plat ad machery essetal to maufacturg ad producto capablty. If records or work--progress formato are uavalable, accurate, or ot suffcetly up-to-date, ths could prevet or crtcally delay the resumpto of actvtes. The requremets for provdg such formato are used to formulate approprate back-up ad records maagemet strateges whe determg BCM strateges (see Clause 7). COMMENTARY ON 6.5 It mght be beefcal to cosult rsk regsters that have already bee establshed elsewhere the orgazato or by exteral bodes. 6.4 Determg cotuty requremets The orgazato should estmate the resources that each actvty wll requre o resumpto. These may clude: a) staff resources, cludg umbers, sklls ad kowledge (people); b) the works ste ad facltes requred (premses); c) supportg techology, plat ad equpmet (techology); d) provso of formato (whether electroc or paper-based) about prevous work or curret work--progress, all of whch s suffcetly up-to-date ad accurate to allow the actvty to cotue effectvely at the agreed level (formato); ad e) exteral servces ad supplers (supples). The orgazato should take to accout the eeds of stakeholders whe determg resource levels. 6.5 Evaluatg threats to crtcal actvtes (udertakg a rsk assessmet) I a BCM cotext, the level of rsk should be uderstood specfcally respect of the orgazato s crtcal actvtes ad the rsk of a dsrupto to these. Crtcal actvtes are uderped by resources such as people, premses, techology, formato, supples ad stakeholders. The orgazato should uderstad the threats to these resources, the vulerabltes of each resource, ad the mpact that would arse f a threat became a cdet ad caused a busess dsrupto It s etrely the decso of the orgazato whch rsk assessmet approach s chose, but t s mportat that the approach s sutable ad approprate to address all of the orgazato s requremets BS ISO/IEC sets the framework for the rsk assessmet approach to be chose by descrbg the madatory elemets that the rsk assessmet process should cota. Typcal elemets are as follows. Determato of the crtera for rsk acceptace. These descrbe the crcumstaces uder whch the orgazato s wllg to accept rsks. Idetfcato of acceptable levels of rsk. Whatever rsk assessmet approach s chose, the orgazato eeds to detfy the levels of rsk that t cosders acceptable. 18 BSI 2006

25 Aalyss of the rsks. It s ecessary that the orgazato's rsk assessmet approach addresses all the cocepts dscussed 6.5.4, ad Specfc threats may be descrbed as evets or actos whch could, at some pot, cause a mpact to the resources, e.g. threats such as fre, flood, power falure, staff loss, staff abseteesm, computer vruses ad hardware falure Vulerabltes mght occur as weakesses wth the resources ad ca, at some pot be exploted by the threats, e.g. sgle pots of falure, adequaces fre protecto, electrcal reslece, staffg levels, IT securty ad IT reslece Impacts (see 6.2.3) mght result from the explotato of vulerabltes by threats. 6.6 Determg choces Overvew As a result of the BIA ad the rsk assessmet, the orgazato should detfy measures that: reduce the lkelhood of a dsrupto; shorte the perod of dsrupto; ad lmt the mpact of a dsrupto o the orgazato s key products ad servces. These measures are kow as loss mtgato ad rsk treatmet. Loss mtgato strateges ca be used cojucto wth other optos, as ot all rsks ca be preveted or reduced to a acceptable level. The orgazato mght clude oe or more or all of the strateges to for each crtcal actvty Busess cotuty If busess cotuty s the chose strategy for a key product or servce, a recovery tme objectve (RTO) should be establshed ad the cotuty strateges Clause 7 should be evaluated agast ths objectve. Cotuty strateges seek to mprove the orgazato s reslece to a dsrupto by esurg crtcal actvtes cotue at, or are recovered to, a acceptable mmum level ad to tmeframes stpulated wth the BIA. BSI

26 6.6.3 Acceptace A rsk mght be acceptable wthout ay further acto beg take. Eve f t s ot acceptable, the ablty to do aythg about some rsks could be lmted, or the cost of takg ay acto dsproportoate to the potetal beeft gaed. I these cases the respose may be to tolerate the exstg level of rsk f top maagemet deems the rsk to be acceptable ad wth the orgazato s rsk appette. I some crcumstaces the mpact of a rsk mght be outsde the orgazato s ormal rsk appette, but, due to the low lkelhood of the rsk occurrg ad/or the uecoomc cost of cotrol, top maagemet may accept the rsk. Acceptace may be supplemeted by a pla for hadlg the mpacts that wll arse f the rsk s realzed Trasfer For some rsks the best respose may be to trasfer them. Ths mght be doe by covetoal surace or cotractual arragemets, or t mght be doe by payg a thrd party to take the rsk aother way. Ths opto s partcularly good for mtgatg facal rsks or rsks to assets. Rsks may be trasferred order to reduce the rsk exposure of the orgazato or because aother orgazato s more capable of effectvely maagg the rsk. It s mportat to ote that some rsks are ot (fully) trasferable; partcular, t s geerally ot possble to trasfer reputatoal rsk, eve f the delvery of a servce s cotracted out. The purchase of surace may form part of a rsk treatmet strategy ad wll provde some facal recompese for some losses. However, ot all losses are fully surable (e.g. usured cdets, damage to brad or reputato, loss of stakeholder value, reducto market share ad huma cosequeces). A facal settlemet aloe s ulkely to fully protect the orgazato a maer that satsfes stakeholder expectatos. Isurace cover s more lkely to be used cojucto wth oe or more other strateges Chage, susped or termate I some crcumstaces t mght be approprate to chage, susped or termate the servce, product, actvty, fucto or process. Ths opto ought oly to be cosdered where there s o coflct wth the orgazato s objectves, statutory complace ad stakeholder expectato. Ths approach s most lkely to be cosdered where a servce, product, actvty, fucto or process has a lmted lfespa. NOTE The four tems above are sometmes referred to as the 4 T model: Treat (busess cotuty), Tolerate (accept the rsk), Trasfer ad Termate. 6.7 Sg-off Top maagemet should sg off the documeted lst of key products ad servces, the busess mpact aalyss ad the rsk assessmet to esure that the work has bee approprate ad s a true reflecto of the orgazato. 20 BSI 2006

27 d g d e b ' s l t BS : Determg busess cotuty strategy B C M t h e o r g Uderstadg the orgazato a z a t o Ths elemet of the BCM lfecycle logcally follows uderstadg the orgazato. As a result of the prevous aalyss, a orgazato wll be a posto to choose the approprate cotuty strateges to eable t to meet ts objectves. Exercsg, matag ad revewg BCM programme maagemet Determg BCM strategy c u m E Developg ad mplemetg BCM respose e r u COMMENTARY ON 7.1 Clause 7 ad all followg clauses relate to those key products ad servces for whch busess cotuty s the chose opto. I all other cases (e.g. suspeso, termato, acceptace of rsk), the product or servce s ot covered by a BCM approach ad caot be cosdered complat wth ths Stadard. 7.1 Itroducto The orgazato s approach to determg BCM strateges should: a) mplemet approprate measures to reduce the lkelhood of cdets occurrg ad/or reduce the potetal effects of those cdets; b) take due accout of the reslece ad mtgato measures; c) provde cotuty for ts crtcal actvtes durg ad followg a cdet; ad d) take accout of those actvtes that have ot bee detfed as crtcal. 7.2 Strategy optos The orgazato should cosder strategc optos for ts crtcal actvtes ad the resources that each actvty wll requre o ts resumpto. The most approprate strategy or strateges wll deped o a rage of factors such as: the maxmum tolerable perod of dsrupto of the crtcal actvty; the costs of mplemetg a strategy or strateges; ad the cosequeces of acto Strateges mght be requred for the followg orgazatoal resources: people (see 7.3); premses (see 7.4); techology (see 7.5); formato (see 7.6); supples (see 7.7); ad stakeholders (see 7.8). BSI

28 COMMENTARY ON 7.4 Workste strateges ca vary sgfcatly ad a rage of optos mght be avalable. Dfferet types of cdet or threat mght requre the mplemetato of dfferet or multple workste optos. The correct strateges wll part be determed by the orgazato s sze, sector ad spread of actvtes, by stakeholders, ad by geographcal base. For example, publc authortes wll eed to mata a frotle servce delvery ther commutes. I each case, the orgazato should mmze the lkelhood of mplemetg a busess cotuty soluto that mght be affected by the same cdet that causes the busess dsrupto. 7.3 People The orgazato should detfy approprate strateges for matag core sklls ad kowledge. Ths aalyss should exted beyod employees to cotractors ad other stakeholders who possess extesve specalst sklls ad kowledge. Strateges to protect or provde those sklls mght clude: a) documetato of the way whch crtcal actvtes are performed; b) mult-skll trag of staff ad cotractors; c) separato of core sklls to reduce the cocetrato of rsk (ths mght etal physcal separato of staff wth core sklls or esurg that more tha oe perso has the requste core sklls); d) use of thrd partes; e) successo plag; ad f) kowledge reteto ad maagemet. 7.4 Premses The orgazato should devse a strategy for reducg the mpact of the uavalablty of ts ormal workste(s). Ths may clude oe or more of the followg: a) alteratve premses (locatos) wth the orgazato, cludg dsplacemet of other actvtes; b) alteratve premses provded by other orgazatos (whether or ot these are recprocal arragemets); c) alteratve premses provded by thrd-party specalsts; d) workg from home or at remote stes; e) other agreed sutable premses; ad f) use of a alteratve workforce a establshed ste. NOTE 1 If staff are to be moved to alteratve premses, these premses ought to be close eough that staff are wllg ad able to travel there, takg to accout ay possble dffcultes caused by the cdet. However, the alteratve premses ought ot to be so close that they are lkely to be affected by the same cdet. NOTE 2 The use of alteratve premses for cotuty purposes ought to be supported by a clear statemet as to whether the alteratve premses are for the sole use of the orgazato. If the alteratve premses are shared wth other orgazatos, a pla to mtgate the o-avalablty of these premses ought to be developed ad documeted. NOTE 3 It may be approprate to move the workload rather tha the staff, e.g. a maufacturg le or a call cetre s workload. 22 BSI 2006

29 COMMENTARY ON Techology strateges wll vary sgfcatly betwee orgazatos accordg to the sze, ature ad complexty of busess. Specfc strateges ought to be developed to safeguard, replace or restore specalzed or custom bult techologes wth log lead tmes. The orgazato may eed to make provso for maual operatos before full techology servces are recovered. 7.5 Techology Techology strateges wll deped o the ature of the techology employed ad ts relatoshp to crtcal actvtes, but wll typcally be oe or a combato of the followg: provso made wth the orgazato; servces delvered to the orgazato; ad servces provded exterally by a thrd party Techology strateges may clude: geographcal spread of techology,.e. matag the same techology at dfferet locatos that wll ot be affected by the same busess dsrupto; holdg older equpmet as emergecy replacemet or spares; ad addtoal rsk mtgato for uque or log lead tme equpmet Iformato techology (IT) servces frequetly eed complex cotuty strateges. Where such strateges are requred, cosderato should be gve to: recovery tme objectves (RTOs) for systems ad applcatos whch support the key actvtes detfed the BIA; locato ad dstace betwee techology stes; umber of techology stes; remote access; the use of u-staffed (dark) stes as opposed to staffed stes; telecoms coectvty ad redudat routg; the ature of falover (whether maual terveto s requred to actvate alteratve IT provso or whether ths eeds to occur automatcally); ad thrd-party coectvty ad exteral lks. NOTE 1 If a strategy of falg over from oe ste to aother s adopted, the etwork path dstace betwee the two stes has to be carefully cosdered as the dstace betwee the stes could have a egatve mpact o the way whch IT systems operate. NOTE 2 Where more tha oe ste hosts a orgazato s IT, there may be a mutual IT recovery strategy, so that the systems, etwork ad storage at each ste s szed to cope wth the combed traffc ad work of the other(s) addto to ts ow work. NOTE 3 Aother soluto to relocatg people to alteratve premses s to provde them wth remote access to IT va dal-up, or through the Iteret usg Vrtual Prvate Network (VPN) or smlar techology. NOTE 4 Further gudace o cotuty for IT ad telecommucatos hardware may be foud such documets as PAS 77, BS ISO/IEC ad BS ISO/IEC (both parts). BSI

30 COMMENTARY ON 7.7 I offce-based evromets, supples mght costtute cheques, etc. Other dustres mght detfy retal stock or just--tme supples, or vehcle fuels. 7.6 Iformato Iformato strateges should be such as to esure that formato vtal to the orgazato s operato s protected ad recoverable accordg to the tmeframes descrbed wth the BIA. NOTE 1 Further gudace s gve BS ISO/IEC The storage ad recovery of such formato has to be complat wth relevat legslato. Ay formato requred for eablg the delvery of the orgazato s crtcal actvtes should have approprate: cofdetalty; tegrty; avalablty; ad currecy. Iformato strateges should be documeted for the recovery of formato that has ot yet bee coped or backed-up to a safe locato. Iformato strateges should exted to clude: physcal (hardcopy) formats; ad vrtual (electroc) formats, etc. NOTE 2 I all cases, formato eeds to be recovered to a pot tme that s kow ad agreed by top maagemet. Varous methods of copyg may be used, such as electroc or tape backups, mcrofche, photocopes, creatg dual copes at the tme of producto ad so o. Ths kow recovery pot s ofte referred to as the recovery pot objectve. 7.7 Supples The orgazato should detfy ad mata a vetory of the core supples that support ts crtcal actvtes. Strateges to provde these may clude: storage of addtoal supples at aother locato; arragemets wth thrd partes for delvery of stock at short otce; dverso of just--tme delveres to other locatos; holdg of materals at warehouses or shppg stes; trasfer of sub-assembly operatos to a alteratve locato whch has supples; ad detfcato of alteratve/substtute supples Where crtcal actvtes are depedet upo specalst supples, the orgazato should detfy the key supplers ad sgle sources of supply. Strateges to maage cotuty of supply may clude: creasg the umber of supplers; ecouragg or requrg supplers to have a valdated busess cotuty capablty; cotractual ad/or servce level agreemets wth key supplers; or the detfcato of alteratve, capable supplers. 24 BSI 2006

31 7.8 Stakeholders Whe determg approprate BCM strateges, the orgazato should cosder ad protect the terests of ts key stakeholders. These strateges should take to accout relevat socal ad cultural cosderatos The orgazato should detfy approprate strateges to maage relatoshps wth key stakeholders, busess or servce parters ad cotractors. Each group mght eed partcular cosderatos. Strateges to protect the terests of key stakeholders may clude specal arragemets for esurg the welfare of stakeholders wth specfc eeds, such as dsablty, lless or pregacy The orgazato should detfy a perso or persos who wll dscharge resposblty for welfare ssues followg a cdet. 7.9 Cvl emergeces Orgazatos seekg to determe, mplemet or valdate strateges for cdet maagemet ad busess cotuty maagemet should become famlar wth offcal local respoder bodes at a early stage. These local respoders are tasked wth atcpato, assessmet, preveto, preparato, respose ad recovery actvtes relato to cvl emergeces occurrg wth ther commutes. NOTE I the UK, these respoder bodes may be kow as local reslece forums Key respoders wll be strumetal offcally declarg that a cvl emergecy has occurred ad provdg: pre- or post-cdet advce (e.g. rsk assessmets); warg ad formg procedures; ad commuty recovery arragemets followg a cvl emergecy. NOTE 1 Cvl emergeces ca result death ad physcal jury; they ca have a profoud ad log term mpact o the psychologcal, socal, ad ecoomc welfare of dvduals ad ther commutes. Emergeces ca quckly cur sgfcat dsrupto to publc trasport servces, commucato etworks, crtcal frastructures ad the smooth flow of goods, servces ad supples. I lght of ths potetal for dsrupto, orgazatos may wsh to famlarze themselves wth the plag arragemets of ther respectve local reslece forum. NOTE 2 Uder the UK Cvl Cotgeces Act (2004) [1], local authortes are lawfully requred to provde busess cotuty advce ad gudace to both commercal ad volutary orgazatos operatg wth ther jursdcto Sg-off Top maagemet should sg off the documeted strateges to cofrm that the determato of cotuty strateges has bee properly udertake ad caters for lkely causes ad effects of dsrupto, ad that the chose strateges are approprate to meet the orgazato s objectves wth the orgazato s rsk appette. BSI

32 d g d e B b o ' s l t BS : Developg ad mplemetg a BCM respose C M t h e o r g Uderstadg the orgazato a z a t Ths elemet of the BCM lfecycle s cocered wth the developmet ad mplemetato of approprate plas ad arragemets to esure cotuty of crtcal actvtes, ad the maagemet of a cdet. Exercsg, matag ad revewg BCM programme maagemet Determg BCM strategy c u m E Developg ad mplemetg BCM respose e r u 8.1 Itroducto Clause 6 ad Clause 7 set out how the orgazato should: detfy ts crtcal actvtes; evaluate threats to these crtcal actvtes; choose approprate strateges to reduce the lkelhood ad mpacts of cdets; ad choose approprate strateges that provde for the cotuty or recovery of ts crtcal actvtes. The rage of threats to be plaed for should be determed by the orgazato s rsk appette. COMMENTARY ON 8.2 I small orgazatos the resposblty for cdet ad busess cotuty maagemet may be vested a sgle dvdual. Larger orgazatos may use a tered approach ad may establsh dfferet teams to focus o cdet maagemet, busess cotuty ad busess recovery ssues. I some cases these teams may be supported by other teams wth resposblty for actvtes such as meda commucatos ad people ssues. 8.2 Icdet respose structure The orgazato should defe a cdet respose structure that wll eable a effectve respose ad recovery from dsruptos I ay cdet stuato there should be a smple ad quckly-formed structure that wll eable the orgazato to: cofrm the ature ad extet of the cdet, take cotrol of the stuato, cota the cdet, ad commucate wth stakeholders. The same structure should trgger a approprate busess cotuty respose. Ths structure may be referred to as the cdet maagemet team (IMT) or crss maagemet team (CMT). 26 BSI 2006