Business continuity management

Transcription

1 BRITISH STANDARD Busess cotuty maagemet Part 1: Code of practce ICS NO COPYING WITHOUT BSI PERMISSION EXCEPT AS PERMITTED BY COPYRIGHT LAW

2 Publshg ad copyrght formato The BSI copyrght otce dsplayed ths documet dcates whe the documet was last ssued. BSI 2006 ISBN The followg BSI refereces relate to the work o ths stadard: Commttee referece BCM/1 Draft for commet 06/ DC Publcato hstory Frst publshed November 2006 Amedmets ssued sce publcato Amd. o. Date Text affected

3 Cotets Foreword 1 Scope ad applcablty 1 2 Terms ad deftos 1 3 Overvew of busess cotuty maagemet (BCM) 6 4 The busess cotuty maagemet polcy 10 5 BCM programme maagemet 13 6 Uderstadg the orgazato 16 7 Determg busess cotuty strategy 21 8 Developg ad mplemetg a BCM respose 26 9 Exercsg, matag ad revewg BCM arragemets Embeddg BCM the orgazato s culture 40 Refereces 42 Lst of fgures Fgure 1 The busess cotuty maagemet lfecycle 9 Fgure 2 Icdet tmele 27 Lst of tables Table 1 Types ad methods of exercsg BCM strateges 37 Summary of pages Ths documet comprses a frot cover, a sde frot cover, pages to, a blak page, pages 1 to 42, a sde back cover ad a back cover. BSI 2006

4 Foreword Publshg formato Ths Brtsh Stadard was publshed by BSI ad came to effect o 30 November It was prepared by Techcal Commttee BCM/1, Busess cotuty maagemet. Orgazatos represeted o ths commttee clude: Assocato of Brtsh Certfcato Bodes Assocato of Brtsh Isurers Assocato of Chef Polce Offcers Assocato of Isurace Rsk Maagers Busess Cotuty Isttute Cabet Offce Chef Fre Offcers Assocato (CFOA) Cotuty Forum Covetry Uversty Departmet of Trade ad Idustry Emergecy Plag Socety Federato of Small Busesses Facal Servces Authorty Idepedet Iteratoal Orgazato for Certfcato Isttute of Drectors Isttute of Emergecy Maagemet Isttute of Iteral Audtors Isttute of Rsk Maagemet Itellect Metropolta Polce Securtes Idustry Busess Cotuty Maagemet Group (SIBCMG) Socety of Idustral Emergecy Servces Offcers (SIESO) Survve Ths Brtsh Stadard has bee developed by practtoers throughout the busess cotuty commuty, drawg upo ther academc, techcal ad practcal expereces of busess cotuty maagemet (BCM). It has bee produced to provde a system based o good practce for busess cotuty maagemet. It s teded to serve as a sgle referece pot for most stuatos where busess cotuty maagemet s practsed, ad to be used by large, medum ad small orgazatos dustral, commercal, publc ad volutary sectors. Ths documet costtutes Part 1 of BS At the tme of publcato, Part 2 was preparato whch wll specfy requremets for busess cotuty maagemet. BSI 2006

5 Use of ths documet As a code of practce, ths Brtsh Stadard takes the form of gudace ad recommedatos. It should ot be quoted as f t were a specfcato ad partcular care should be take to esure that clams of complace are ot msleadg. Ay user clamg complace wth ths Brtsh Stadard s expected to be able to justfy ay course of acto that devates from ts recommedatos. Presetatoal covetos The provsos of ths Stadard are recommedatos, whch are expressed seteces whch the prcpal auxlary verb s should. Clause 3 does ot cota ay recommedatos; rather, t gves useful backgroud formato o busess cotuty maagemet (though the Stadard s ot teded as a beger s gude to busess cotuty maagemet). The word may s used the text to express permssblty, e.g. as a alteratve to the prmary recommedato of the clause. The word ca s used to express possblty, e.g. a cosequece of a acto or a evet. Supplemetary commetary, explaato ad geeral formatve materal s preseted smaller talc type, ad does ot costtute a ormatve elemet. Cotractual ad legal cosderatos Ths publcato does ot purport to clude all the ecessary provsos of a cotract. Users are resposble for ts correct applcato. Complace wth a Brtsh Stadard caot cofer mmuty from legal oblgatos. BSI 2006

6 v BSI 2006 Ths page delberately left blak

7 1 Scope ad applcablty Ths Brtsh Stadard establshes the process, prcples ad termology of busess cotuty maagemet (BCM). The purpose of ths Stadard s to provde a bass for uderstadg, developg ad mplemetg busess cotuty wth a orgazato ad to provde cofdece the orgazato's dealgs wth customers ad other orgazatos. It also eables the orgazato to measure ts BCM capablty a cosstet ad recogzed maer. Ths Stadard provdes a system based o BCM good practce. Ths Stadard s teded for use by ayoe wth resposblty for busess operatos or the provso of servces, from top maagemet through all levels of the orgazato; from those wth a sgle ste to those wth a global presece; from sole traders ad small-to-medum eterprses (SMEs) to orgazatos employg thousads of people. It s therefore applcable to aybody who holds resposblty for ay operato, ad thus the cotuty of that operato. Ths Stadard does ot cover the actvtes of emergecy plag asmuch as that topc relates to cvl emergeces. NOTE Ultmately, o matter how much effort or resource s vested busess cotuty maagemet, a orgazato could stll be faced wth a cdet or combato of cdets t dd ot forsee. 2 Terms ad deftos For the purposes of ths part of BS 25999, the followg deftos apply. 2.1 actvty process or set of processes udertake by a orgazato (or o ts behalf) that produces or supports oe or more products or servces NOTE Examples of such processes clude accouts, call cetre, IT, maufacture, dstrbuto. 2.2 busess cotuty strategc ad tactcal capablty of the orgazato to pla for ad respod to cdets ad busess dsruptos order to cotue busess operatos at a acceptable pre-defed level 2.3 busess cotuty maagemet (BCM) holstc maagemet process that detfes potetal threats to a orgazato ad the mpacts to busess operatos that those threats, f realzed, mght cause, ad whch provdes a framework for buldg orgazatoal reslece wth the capablty for a effectve respose that safeguards the terests of ts key stakeholders, reputato, brad ad value-creatg actvtes NOTE Busess cotuty maagemet volves maagg the recovery or cotuato of busess actvtes the evet of a busess dsrupto, ad maagemet of the overall programme through trag, exercses ad revews, to esure the busess cotuty pla(s) stays curret ad up-to-date. BSI

8 2.4 busess cotuty maagemet lfecycle seres of busess cotuty actvtes whch collectvely cover all aspects ad phases of the busess cotuty maagemet programme NOTE The busess cotuty maagemet lfecycle s llustrated Fgure busess cotuty maagemet programme ogog maagemet ad goverace process supported by top maagemet ad approprately resourced to esure that the ecessary steps are take to detfy the mpact of potetal losses, mata vable recovery strateges ad plas, ad esure cotuty of products ad servces through trag, exercsg, mateace ad revew 2.6 busess cotuty pla (BCP) documeted collecto of procedures ad formato that s developed, compled ad mataed readess for use a cdet to eable a orgazato to cotue to delver ts crtcal actvtes at a acceptable pre-defed level 2.7 busess cotuty strategy approach by a orgazato that wll esure ts recovery ad cotuty the face of a dsaster or other major cdet or busess dsrupto 2.8 busess mpact aalyss process of aalysg busess fuctos ad the effect that a busess dsrupto mght have upo them 2.9 cvl emergecy evet or stuato whch threates serous damage to huma welfare a place the UK, the evromet of a place the UK, or the securty of the UK or of a place the UK [UK Cvl Cotgeces Act 2004 (1)] 2.10 cosequece outcome of a cdet that wll have a mpact o a orgazato's objectves NOTE 1 There ca be a rage of cosequeces from oe cdet. NOTE 2 A cosequece ca be certa or ucerta ad ca have postve or egatve mpact o objectves cost-beeft aalyss facal techque that measures the cost of mplemetg a partcular soluto ad compares ths wth the beeft delvered by that soluto NOTE The beeft may be defed facal, reputatoal, servce delvery, regulatory or other terms approprate to the orgazato. 2 BSI 2006

9 2.12 crtcal actvtes those actvtes whch have to be performed order to delver the key products ad servces whch eable a orgazato to meet ts most mportat ad tme-sestve objectves 2.13 dsrupto evet, whether atcpated (e.g. a labour strke or hurrcae) or uatcpated (e.g. a blackout or earthquake), whch causes a uplaed, egatve devato from the expected delvery of products or servces accordg to the orgazato s objectves 2.14 emergecy plag developmet ad mateace of agreed procedures to prevet, reduce, cotrol, mtgate ad take other actos the evet of a cvl emergecy 2.15 exercse 2.16 ga actvty whch the busess cotuty pla(s) s rehearsed part or whole to esure that the pla(s) cotas the approprate formato ad produces the desred result whe put to effect NOTE A exercse ca volve vokg busess cotuty procedures, but s more lkely to volve the smulato of a busess cotuty cdet, aouced or uaouced, whch partcpats role-play order to assess what ssues mght arse, pror to a real vocato. postve cosequece 2.17 mpact evaluated cosequece of a partcular outcome 2.18 cdet stuato that mght be, or could lead to, a busess dsrupto, loss, emergecy or crss 2.19 cdet maagemet pla clearly defed ad documeted pla of acto for use at the tme of a cdet, typcally coverg the key persoel, resources, servces ad actos eeded to mplemet the cdet maagemet process 2.20 vocato act of declarg that a orgazato s busess cotuty pla eeds to be put to effect order to cotue delvery of key products or servces BSI

10 2.21 lkelhood 2.22 loss chace of somethg happeg, whether defed, measured or estmated objectvely or subjectvely, or terms of geeral descrptors (such as rare, ulkely, lkely, almost certa), frequeces or mathematcal probabltes NOTE 1 Lkelhood ca be expressed qualtatvely or quattatvely. NOTE 2 The word probablty ca be used stead of lkelhood some o-eglsh laguages that have o drect equvalet. Because probablty s ofte terpreted more formally Eglsh as a mathematcal term, lkelhood s used throughout ths Stadard wth the teto that t s gve the same broad terpretato as probablty. egatve cosequece 2.23 maxmum tolerable perod of dsrupto durato after whch a orgazato s vablty wll be rrevocably threateed f product ad servce delvery caot be resumed 2.24 orgazato group of people ad facltes wth a arragemet of resposbltes, authortes ad relatoshps EXAMPLE Compay, corporato, frm, eterprse, sttuto, charty, sole trader or assocato, or parts or combatos thereof. NOTE 1 The arragemet s geerally orderly. NOTE 2 A orgazato ca be publc or prvate. [BS EN ISO 9000:2005] 2.25 products ad servces beefcal outcomes provded by a orgazato to ts customers, recpets ad stakeholders, e.g. maufactured tems, car surace, regulatory complace ad commuty ursg 2.26 recovery tme objectve target tme set for: resumpto of product or servce delvery after a cdet; or resumpto of performace of a actvty after a cdet; or recovery of a IT system or applcato after a cdet. NOTE The recovery tme objectve has to be less tha the maxmum tolerable perod of dsrupto reslece ablty of a orgazato to resst beg affected by a cdet 4 BSI 2006

11 2.28 rsk somethg that mght happe ad ts effect(s) o the achevemet of objectves NOTE 1 The word rsk s used colloqually varous ways, as a ou ( a rsk or, the plural, rsks ), a verb (to rsk [somethg], or to put at rsk), or as a adjectve ( rsky ). Used as a ou the term a rsk could relate to ether a potetal evet, ts causes, the chace (lkelhood) of somethg happeg, or the effects of such evets. I rsk maagemet (see 6.5) t s mportat to make a clear dstcto betwee these varous usages of the word rsk. NOTE 2 Rsk s defed relatve to a partcular objectve; therefore, cocer for several objectves mples the possblty of more tha oe measure of rsk wth respect to ay source of rsk. NOTE 3 Rsk s ofte quatfed as a average effect by summg the combed effect of each possble cosequece weghted by the assocated lkelhood of each cosequece, to obta a expected value. However, probablty dstrbutos are eeded to quatfy perceptos about the rage of possble cosequeces. Alteratvely, summary statstcs, such as stadard devato, may be used addto to expected value rsk appette total amout of rsk that a orgazato s prepared to accept, tolerate or be exposed to at ay pot tme 2.30 rsk assessmet overall process of rsk detfcato, aalyss ad evaluato 2.31 rsk maagemet structured developmet ad applcato of maagemet culture, polcy, procedures ad practces to the tasks of detfyg, aalysg, evaluatg, ad cotrollg respodg to rsk 2.32 stakeholders those wth a vested terest a orgazato s achevemets NOTE Ths s a wde-ragg term that cludes, but s ot lmted to, teral ad outsourced employees, customers, supplers, parters, employees, dstrbutors, vestors, surers, shareholders, owers, govermet ad regulators top maagemet perso or group of people who drect ad cotrol a orgazato at the hghest level [BS EN ISO 9000:2005] NOTE Top maagemet, especally a large multatoal orgazato, mght ot be drectly volved; however, top maagemet accoutablty through the cha of commad s mafest. I a small orgazato, top maagemet mght be the ower or sole propretor. BSI

12 3 Overvew of busess cotuty maagemet (BCM) 3.1 What s BCM? Busess cotuty maagemet (BCM) s a busess-owed, busess-drve process that establshes a ft-for-purpose strategc ad operatoal framework that: proactvely mproves a orgazato s reslece agast the dsrupto of ts ablty to acheve ts key objectves; provdes a rehearsed method of restorg a orgazato s ablty to supply ts key products ad servces to a agreed level wth a agreed tme after a dsrupto; ad delvers a prove capablty to maage a busess dsrupto ad protect the orgazato s reputato ad brad. Whle the dvdual processes of busess cotuty ca chage wth a orgazato s sze, structures ad resposbltes, the basc prcples rema exactly the same for volutary, prvate or publc sector orgazatos, regardless of ther sze, scope or complexty. 3.2 BCM ad orgazatoal strategy All orgazatos, whether large or small, have ams ad objectves, such as to grow, to provde servces ad to acqure other busesses. These ams ad objectves are geerally met va strategc plas to acheve a orgazato s short, medum ad log term goals. BCM uderstadg at a orgazato s hghest level wll esure that these ams ad objectves are ot compromsed by uexpected dsruptos. The cosequeces of a cdet vary ad ca be far-reachg. These cosequeces mght volve loss of lfe, loss of assets or come, or the ablty to delver products ad servces o whch the orgazato s strategy, reputato or eve survval mght deped. BCM eeds to recogze the strategc mportace of kow stakeholders. Furthermore, as the cosequeces of a dsrupto ufold, ew stakeholders emerge ad have a drect mpact o the evetual extet of the damage. For example, ssue groups may attempt to apply pressure o the orgazato facg a dsrupto. All these ssues are of strategc cocer to the orgazato. 3.3 BCM the relatoshp wth rsk maagemet BCM s complemetary to a rsk maagemet framework that sets out to uderstad the rsks to operatos or busess, ad the cosequeces of those rsks. Rsk maagemet seeks to maage rsk aroud the key products ad servces that a orgazato delvers. Product ad servce delvery ca be dsrupted by a wde varety of cdets, may of whch are dffcult to predct or aalyse by cause. 6 BSI 2006

13 By focusg o the mpact of dsrupto, BCM detfes those products ad servces o whch the orgazato depeds for ts survval, ad ca detfy what s requred for the orgazato to cotue to meet ts oblgatos. Through BCM, a orgazato ca recogze what eeds to be doe before a cdet occurs to protect ts people, premses, techology, formato, supply cha, stakeholders ad reputato. Wth that recogto, the orgazato ca the take a realstc vew o the resposes that are lkely to be eeded as ad whe a dsrupto occurs, so that t ca be cofdet that t wll maage through ay cosequeces wthout uacceptable delay delverg ts products or servces. A orgazato wth approprate BCM measures place mght be able to take advatage of opportutes whch have a hgh rsk. 3.4 Why a orgazato should udertake BCM BCM forms a mportat elemet of good busess maagemet, servce provso ad etrepreeural prudece. Maagers ad owers have the resposblty to mata the ablty of the orgazato to fucto wthout dsrupto. Orgazatos costatly make commtmets or have a duty to delver products ad servces,.e. they eter to cotracts ad otherwse rase expectatos. All orgazatos have moral ad socal resposbltes, partcularly where they provde a emergecy respose or a publc or volutary servce. I some cases, orgazatos have statutory or regulatory dutes to udertake BCM. All busess actvty s subject to dsruptos, such as techology falure, floodg, utlty dsrupto ad terrorsm. BCM provdes the capablty to adequately react to operatoal dsruptos whle protectg welfare ad safety. BCM ought ow to be regarded, ot as a costly plag process, but as oe that adds value to the orgazato. 3.5 The beefts of a effectve BCM programme The beefts of a effectve BCM programme are that the orgazato: s able to proactvely detfy the mpacts of a operatoal dsrupto; has place a effectve respose to dsruptos whch mmzes the mpact o the orgazato; matas a ablty to maage usurable rsks; ecourages cross-team workg; s able to demostrate a credble respose through a process of exercsg; could ehace ts reputato; ad mght ga a compettve advatage, coferred by the demostrated ablty to mata delvery. BSI

14 3.6 The outcomes of a effectve BCM programme The outcomes of a effectve BCM programme are that: key products ad servces are detfed ad protected, esurg ther cotuty; a cdet maagemet capablty s eabled to provde a effectve respose; the orgazato s uderstadg of tself ad ts relatoshps wth other orgazatos, relevat regulators or govermet departmets, local authortes ad the emergecy servces s properly developed, documeted ad uderstood; staff are traed to respod effectvely to a cdet or dsrupto through approprate exercsg; stakeholder requremets are uderstood ad able to be delvered; staff receve adequate support ad commucatos the evet of a dsrupto; the orgazato s supply cha s secured; the orgazato s reputato s protected; ad the orgazato remas complat wth ts legal ad regulatory oblgatos. 3.7 Elemets of the busess cotuty maagemet lfecycle The BCM lfecycle comprses sx elemets, as llustrated by Fgure 1. These ca be mplemeted by orgazatos of all szes, all sectors: publc, prvate, o-proft, educatoal, maufacturg, etc. The scope ad structure of a BCM programme ca vary, ad the effort expeded wll be talored to the eeds of the dvdual orgazato, but these essetal elemets stll have to be udertake. a) BCM programme maagemet (see Clause 5) Programme maagemet eables the busess cotuty capablty to be both establshed (f ecessary) ad mataed a maer approprate to the sze ad complexty of the orgazato. b) Uderstadg the orgazato (see Clause 6) The actvtes assocated wth Uderstadg the orgazato provde formato that eables prortzato of a orgazato s products ad servces ad the urgecy of the actvtes that are requred to delver them. Ths sets the requremets that wll determe the selecto of approprate BCM strateges. 8 BSI 2006

15 B l BS :2006 Fgure 1 The busess cotuty maagemet lfecycle M t h e o r g Uderstadg the orgazato a z a t C o g ' d Exercsg, matag ad revewg BCM programme maagemet Determg BCM strategy s c u d e t b m E Developg ad mplemetg BCM respose e r u c) Determg busess cotuty strategy (see Clause 7) Determg busess cotuty strategy eables a rage of strateges to be evaluated. Ths allows a approprate respose to be chose for each product or servce, such that the orgazato ca cotue to delver those products ad servces: at a acceptable level of operato; ad wth a acceptable tmeframe durg ad followg a dsrupto. The choce made wll take accout of the reslece ad coutermeasure optos already preset wth the orgazato. BSI

16 COMMENTARY ON 3.7d) The term cdet s used throughout ths Stadard to reflect the scalablty of evets, from small to large whch ca affect a orgazato. A sgle cdet or seres of cdets ca result serous dsruptos to the orgazato s ablty to meet ts oblgatos. If a cdet s maaged well t mght ot develop to a crss. However, some evets wll cause such a profoud dsrupto to the orgazato s objectves as to be cosdered a crss mmedately. A cdet mght exceed the preparedess of a orgazato, eve f t has carefully examed respose measures agast a atcpated level of damage. It s therefore mperatve that maagemet ad ts supportg structures do ot adhere stubborly to a exstg pla, but make judgmets accordg to the crcumstaces. A busess cotuty pla s ever a substtute for formed ad competet maagemet decso-makg. d) Developg ad mplemetg a BCM respose (see Clause 8) Developg ad mplemetg a BCM respose results the creato of a maagemet framework ad a structure of cdet maagemet, busess cotuty ad busess recovery plas that detal the steps to be take durg ad after a cdet to mata or restore operatos. e) BCM exercsg, matag ad revewg BCM arragemets (see Clause 9) BCM exercsg, mateace, revew ad audt leads to the orgazato beg able to: demostrate the extet to whch ts strateges ad plas are complete, curret ad accurate; ad detfy opportutes for mprovemet. f) Embeddg BCM the orgazato s culture (see Clause 10) Embeddg BCM the orgazato s culture eables BCM to become part of the orgazato s core values ad stls cofdece all stakeholders the ablty of the orgazato to cope wth dsruptos. 4 The busess cotuty maagemet polcy 4.1 Overvew COMMENTARY ON 4.1 The purposes of establshg a busess cotuty polcy are to: wesure that all BCM actvtes are coducted ad mplemeted a agreed ad cotrolled maer; w acheve a busess cotuty capablty that meets chagg busess eeds ad s approprate to the sze, complexty ad ature of the orgazato; ad w put place a clearly defed framework for the ogog BCM capablty The BCM polcy defes the followg processes: the set-up actvtes for establshg a busess cotuty capablty; ad the ogog maagemet ad mateace of the busess cotuty capablty The set-up actvtes corporate the specfcato, ed-to-ed desg, buld, mplemetato ad tal exercsg of the busess cotuty capablty The ogog mateace ad maagemet actvtes clude embeddg busess cotuty wth the orgazato, exercsg plas regularly, ad updatg ad commucatg them, partcularly whe there s sgfcat chage premses, persoel, process, market, techology or orgazatoal structure. 10 BSI 2006

17 4.2 Cotext The orgazato should esure that ts BCM polcy s approprate to the ature, scale, complexty, geography ad crtcalty of ts busess actvtes ad that t reflects ts culture, depedeces ad operatg evromet. The BCM polcy defes the process requremets to esure that busess cotuty arragemets cotue to meet the eeds of the orgazato the evet of a cdet. Ths polcy should esure that a busess cotuty capablty s promoted wth the orgazato s culture. The BCM capablty should be tegrated to the orgazato s chage maagemet actvty so that t s corporated to the growth ad developmet of the orgazato s products ad servces. 4.3 Developmet of the busess cotuty polcy The orgazato should develop ts busess cotuty polcy whch states the objectves of BCM wth the orgazato. Itally, ths may be a hgh level statemet of tet whch s refed ad ehaced as the capablty s developed. The busess cotuty polcy should provde the orgazato wth documeted prcples to whch t wll aspre ad agast whch ts busess cotuty capablty should be measured. The BCM polcy should be owed at a hgh level, e.g. a board drector or elected represetatve. The orgazato may cosder the followg whe developg ts BCM polcy: defg the scope of BCM wth the orgazato; BCM resourcg; defg the BCM prcples, gudeles ad mmum stadards for the orgazato; referecg ay relevat stadards, regulatos or polces that have to be cluded or ca be used as a bechmark. The orgazato should mata ad regularly revew ts BCM polcy, strateges, plas ad solutos o a regular bass le wth the orgazato's eeds. The scope of the BCM polcy should clearly defe ay lmtatos or exclusos that apply, e.g. geographcal or product exclusos. 4.4 Scope of the BCM programme Top maagemet may determe the scope of the BCM programme by detfyg the key products ad servces that support the orgazato s objectves, oblgatos ad statutory dutes. Determato of what s key should be cosstet wth the busess mpact aalyss descrbed 6.2, albet at a hgher level of cosderato. BSI

18 4.5 Outsourced actvtes If a product, servce or actvty has bee outsourced, the rsk accoutablty for that product, servce or actvty remas vested wth the orgazato. Cosequetly, a orgazato should assure tself that ts key supplers or outsource parters have effectve BCM arragemets place. Oe method of dog ths s to obta audted evdece of the vablty of key supplers cotuty plas ad ther exercsg ad mateace programmes. 12 BSI 2006

19 d d e b ' s l t BS : BCM programme maagemet g B C M t Exercsg, matag ad revewg h e o r g Uderstadg the orgazato BCM programme maagemet a z a Determg BCM strategy t o c Programme maagemet s at the heart of the BCM process. Effectve programme maagemet establshes the orgazato s approach to busess cotuty. The partcpato of top maagemet s key to esurg that the BCM process s correctly troduced, adequately supported ad establshed as part of the orgazato s culture. u m E Developg ad mplemetg BCM respose e r u 5.1 Overvew A BCM programme should be put place to acheve the objectves defed the busess cotuty polcy (see 4.3). BCM programme maagemet volves three steps: assgg resposbltes (see 5.2); mplemetg busess cotuty the orgazato (see 5.3); ad the ogog maagemet of busess cotuty (see 5.4). 5.2 Assgg resposbltes (goverace) The orgazato s maagemet should: appot or omate a perso wth approprate seorty ad authorty to be accoutable for BCM polcy ad mplemetato; ad appot or omate oe or more dvduals to mplemet ad mata the BCM programme. COMMENTARY ON Idvduals tasked wth mplemetg ad matag the busess cotuty programme may resde may areas of a orgazato depedg o ts sze, scale ad complexty. It s essetal, however, that a perso wth approprate authorty (e.g. ower, board drector or elected represetatve) has overall resposblty for BCM ad s drectly accoutable for esurg the cotued success of ths capablty. BSI

20 5.2.2 If the orgazato s structure so dcates, top maagemet may omate represetatves across the busess by fucto or locato to assst the mplemetato of the BCM programme. The roles, accoutabltes, resposbltes ad authortes should be tegrated to job descrptos ad skll sets. The orgazato s audt process should revew these resposbltes. These resposbltes may be reforced by cludg them the orgazato s apprasal, reward ad recogto polcy. COMMENTARY ON I large orgazatos there mght be a eed for a team of busess cotuty represetatves wth dfferg roles ad resposbltes. I smaller orgazatos, resposblty for busess cotuty may resde wth oe or more dvduals. 5.3 Implemetg busess cotuty the orgazato Actvtes to mplemet a busess cotuty programme should clude the desg, buld, ad mplemetato of the programme. The orgazato should: commucate the programme to stakeholders; arrage or provde approprate trag for staff; ad exercse the busess cotuty capablty (see Clause 9) The orgazato may adopt a recogzed project maagemet method to esure that the mplemetato s effectvely maaged 5.4 Ogog maagemet Overvew Ogog maagemet actvtes should esure that busess cotuty s embedded wth the orgazato. Each compoet of a orgazato s busess cotuty capablty should be regularly revewed, exercsed ad updated. I addto, busess cotuty arragemets ad plas should also be revewed ad updated wheever there s a sgfcat chage the orgazato s operatg evromet, persoel, processes or techology, ad whe a exercse or cdet hghlghts defceces Ogog mateace However BCM s resourced, there are actvtes that should be carred out both tally ad o a ogog bass. These may clude: defg the scope, roles ad resposbltes for BCM; appotg a approprate perso or team to maage the ogog BCM capablty; keepg the busess cotuty programme curret through good practce; promotg busess cotuty across the orgazato ad wder, where approprate; admsterg the exercse programme; 14 BSI 2006

21 coordatg the regular revew ad update of the busess cotuty capablty, cludg revewg or reworkg rsk assessmets ad busess mpact aalyses (BIAs); matag documetato approprate to the sze ad complexty of the orgazato (see 5.5); motorg performace of the busess cotuty capablty; maagg costs assocated wth the busess cotuty capablty; ad establshg ad motorg chage maagemet ad successo maagemet regmes. 5.5 BCM documetato Idvduals tasked wth matag busess cotuty should create ad mata the busess cotuty documetato. Ths may clude the followg: a) BCM polcy: BCM scope statemet, BCM terms of referece; b) busess mpact aalyss (BIA); c) rsk ad threat assessmet; d) BCM strategy/strateges; e) awareess programme; f) trag programme; g) cdet maagemet plas; h) busess cotuty plas; ) busess recovery plas; j) exercse schedule ad reports; k) servce level agreemets ad cotracts. BSI

22 d d e b ' s l t BS : Uderstadg the orgazato g B C M t h e o r g Uderstadg the orgazato a z a t o The am of ths elemet of the BCM lfecycle s to assst the uderstadg of the orgazato through the detfcato of ts key products ad servces ad the crtcal actvtes ad resources that support them. Ths elemet esures that the BCM programme s alged to the orgazato s objectves, oblgatos ad statutory dutes. Exercsg, matag ad revewg BCM programme maagemet Determg BCM strategy c u m E Developg ad mplemetg BCM respose e r u 6.1 Itroducto I a busess cotuty cotext, a uderstadg of the orgazato comes from: detfyg the orgazato s objectves, stakeholder oblgatos, statutory dutes ad the evromet whch the orgazato operates; detfyg the actvtes, assets ad resources, cludg those outsde the orgazato, that support the delvery of these products ad servces; assessg the mpact ad cosequeces over tme of the falure of these actvtes, assets ad resources (see 6.2); detfyg ad evaluatg the perceved threats that could dsrupt the orgazato s key products ad servces ad the crtcal actvtes, assets ad resources that support them (see 6.5) It s mportat that the orgazato uderstads: a) the terdepedeces of ts actvtes, ad b) ay relace t has o exteral orgazatos, ad ay relace placed upo t by others. 6.2 Busess mpact aalyss (BIA) The orgazato should determe ad documet the mpact of a dsrupto to the actvtes that support ts key products ad servces. Ths process s commoly referred to as a busess mpact aalyss (BIA). 16 BSI 2006

23 COMMENTARY ON 6.2.2b) Durg a dsrupto, mpacts geerally crease over tme ad affect each actvty dfferetly. Impacts mght also vary depedg o the day, moth or pot the busess lfecycle For each actvty supportg the delvery of key products ad servces wth the scope of ts BCM programme, the orgazato should: a) assess over tme the mpacts that would occur f the actvty was dsrupted; b) establsh the maxmum tolerable perod of dsrupto of each actvty by detfyg: the maxmum tme perod after the start of a dsrupto wth whch the actvty eeds to be resumed, the mmum level at whch the actvty eeds to be performed o ts resumpto, the legth of tme wth whch ormal levels of operato eed to be resumed; c) detfy ay ter-depedet actvtes, assets, supportg frastructure or resources that have also to be mataed cotuously or recovered over tme Whe assessg mpacts, the orgazato should cosder those that relate to ts busess ams ad objectves ad ts stakeholders. These may clude: the mpact o staff or publc wellbeg; the mpact of damage to, or loss of, premses, techology or formato; the mpact of breaches of statutory dutes or regulatory requremets; damage to reputato; damage to facal vablty; deterorato of product or servce qualty; evrometal damage. The orgazato should documet ts approach to assessg the mpact of dsrupto ad ts fdgs ad coclusos. 6.3 Idetfcato of crtcal actvtes COMMENTARY ON 6.3 The maxmum tme perod for resumg actvtes ca vary betwee secods ad several moths depedg o the ature of the actvty. Actvtes that are tme-sestve mght eed to be specfed wth a great degree of accuracy, e.g. to the mute or the hour. Less tme-sestve actvtes mght requre less accuracy. The orgazato may categorze ts actvtes accordg to ther prorty for recovery. Those actvtes whose loss, as detfed durg the BIA, would have the greatest mpact the shortest tme ad whch eed to be recovered most rapdly may be termed crtcal actvtes. Each crtcal actvty supports oe or more key products or servces. The orgazato may wsh to focus ts plag actvtes o crtcal actvtes, but should recogze that other actvtes wll also eed to be recovered wth ther maxmum tolerable perod of dsrupto ad mght also requre advace arragemets to be place. The maxmum tolerable perod of dsrupto wll fluece each actvty s recovery tme objectve whe determg BCM strateges (see Clause 7). BSI

24 COMMENTARY ON 6.4 Techology mples the use of equpmet the broadest sese ad as relevat to the orgazato. Techology mght clude, but s ot lmted to, IT software ad hardware, telecommucatos equpmet, lathes, food preparato maches, vacuum sealg machery or ay other plat ad machery essetal to maufacturg ad producto capablty. If records or work--progress formato are uavalable, accurate, or ot suffcetly up-to-date, ths could prevet or crtcally delay the resumpto of actvtes. The requremets for provdg such formato are used to formulate approprate back-up ad records maagemet strateges whe determg BCM strateges (see Clause 7). COMMENTARY ON 6.5 It mght be beefcal to cosult rsk regsters that have already bee establshed elsewhere the orgazato or by exteral bodes. 6.4 Determg cotuty requremets The orgazato should estmate the resources that each actvty wll requre o resumpto. These may clude: a) staff resources, cludg umbers, sklls ad kowledge (people); b) the works ste ad facltes requred (premses); c) supportg techology, plat ad equpmet (techology); d) provso of formato (whether electroc or paper-based) about prevous work or curret work--progress, all of whch s suffcetly up-to-date ad accurate to allow the actvty to cotue effectvely at the agreed level (formato); ad e) exteral servces ad supplers (supples). The orgazato should take to accout the eeds of stakeholders whe determg resource levels. 6.5 Evaluatg threats to crtcal actvtes (udertakg a rsk assessmet) I a BCM cotext, the level of rsk should be uderstood specfcally respect of the orgazato s crtcal actvtes ad the rsk of a dsrupto to these. Crtcal actvtes are uderped by resources such as people, premses, techology, formato, supples ad stakeholders. The orgazato should uderstad the threats to these resources, the vulerabltes of each resource, ad the mpact that would arse f a threat became a cdet ad caused a busess dsrupto It s etrely the decso of the orgazato whch rsk assessmet approach s chose, but t s mportat that the approach s sutable ad approprate to address all of the orgazato s requremets BS ISO/IEC sets the framework for the rsk assessmet approach to be chose by descrbg the madatory elemets that the rsk assessmet process should cota. Typcal elemets are as follows. Determato of the crtera for rsk acceptace. These descrbe the crcumstaces uder whch the orgazato s wllg to accept rsks. Idetfcato of acceptable levels of rsk. Whatever rsk assessmet approach s chose, the orgazato eeds to detfy the levels of rsk that t cosders acceptable. 18 BSI 2006

25 Aalyss of the rsks. It s ecessary that the orgazato's rsk assessmet approach addresses all the cocepts dscussed 6.5.4, ad Specfc threats may be descrbed as evets or actos whch could, at some pot, cause a mpact to the resources, e.g. threats such as fre, flood, power falure, staff loss, staff abseteesm, computer vruses ad hardware falure Vulerabltes mght occur as weakesses wth the resources ad ca, at some pot be exploted by the threats, e.g. sgle pots of falure, adequaces fre protecto, electrcal reslece, staffg levels, IT securty ad IT reslece Impacts (see 6.2.3) mght result from the explotato of vulerabltes by threats. 6.6 Determg choces Overvew As a result of the BIA ad the rsk assessmet, the orgazato should detfy measures that: reduce the lkelhood of a dsrupto; shorte the perod of dsrupto; ad lmt the mpact of a dsrupto o the orgazato s key products ad servces. These measures are kow as loss mtgato ad rsk treatmet. Loss mtgato strateges ca be used cojucto wth other optos, as ot all rsks ca be preveted or reduced to a acceptable level. The orgazato mght clude oe or more or all of the strateges to for each crtcal actvty Busess cotuty If busess cotuty s the chose strategy for a key product or servce, a recovery tme objectve (RTO) should be establshed ad the cotuty strateges Clause 7 should be evaluated agast ths objectve. Cotuty strateges seek to mprove the orgazato s reslece to a dsrupto by esurg crtcal actvtes cotue at, or are recovered to, a acceptable mmum level ad to tmeframes stpulated wth the BIA. BSI

26 6.6.3 Acceptace A rsk mght be acceptable wthout ay further acto beg take. Eve f t s ot acceptable, the ablty to do aythg about some rsks could be lmted, or the cost of takg ay acto dsproportoate to the potetal beeft gaed. I these cases the respose may be to tolerate the exstg level of rsk f top maagemet deems the rsk to be acceptable ad wth the orgazato s rsk appette. I some crcumstaces the mpact of a rsk mght be outsde the orgazato s ormal rsk appette, but, due to the low lkelhood of the rsk occurrg ad/or the uecoomc cost of cotrol, top maagemet may accept the rsk. Acceptace may be supplemeted by a pla for hadlg the mpacts that wll arse f the rsk s realzed Trasfer For some rsks the best respose may be to trasfer them. Ths mght be doe by covetoal surace or cotractual arragemets, or t mght be doe by payg a thrd party to take the rsk aother way. Ths opto s partcularly good for mtgatg facal rsks or rsks to assets. Rsks may be trasferred order to reduce the rsk exposure of the orgazato or because aother orgazato s more capable of effectvely maagg the rsk. It s mportat to ote that some rsks are ot (fully) trasferable; partcular, t s geerally ot possble to trasfer reputatoal rsk, eve f the delvery of a servce s cotracted out. The purchase of surace may form part of a rsk treatmet strategy ad wll provde some facal recompese for some losses. However, ot all losses are fully surable (e.g. usured cdets, damage to brad or reputato, loss of stakeholder value, reducto market share ad huma cosequeces). A facal settlemet aloe s ulkely to fully protect the orgazato a maer that satsfes stakeholder expectatos. Isurace cover s more lkely to be used cojucto wth oe or more other strateges Chage, susped or termate I some crcumstaces t mght be approprate to chage, susped or termate the servce, product, actvty, fucto or process. Ths opto ought oly to be cosdered where there s o coflct wth the orgazato s objectves, statutory complace ad stakeholder expectato. Ths approach s most lkely to be cosdered where a servce, product, actvty, fucto or process has a lmted lfespa. NOTE The four tems above are sometmes referred to as the 4 T model: Treat (busess cotuty), Tolerate (accept the rsk), Trasfer ad Termate. 6.7 Sg-off Top maagemet should sg off the documeted lst of key products ad servces, the busess mpact aalyss ad the rsk assessmet to esure that the work has bee approprate ad s a true reflecto of the orgazato. 20 BSI 2006

27 d g d e b ' s l t BS : Determg busess cotuty strategy B C M t h e o r g Uderstadg the orgazato a z a t o Ths elemet of the BCM lfecycle logcally follows uderstadg the orgazato. As a result of the prevous aalyss, a orgazato wll be a posto to choose the approprate cotuty strateges to eable t to meet ts objectves. Exercsg, matag ad revewg BCM programme maagemet Determg BCM strategy c u m E Developg ad mplemetg BCM respose e r u COMMENTARY ON 7.1 Clause 7 ad all followg clauses relate to those key products ad servces for whch busess cotuty s the chose opto. I all other cases (e.g. suspeso, termato, acceptace of rsk), the product or servce s ot covered by a BCM approach ad caot be cosdered complat wth ths Stadard. 7.1 Itroducto The orgazato s approach to determg BCM strateges should: a) mplemet approprate measures to reduce the lkelhood of cdets occurrg ad/or reduce the potetal effects of those cdets; b) take due accout of the reslece ad mtgato measures; c) provde cotuty for ts crtcal actvtes durg ad followg a cdet; ad d) take accout of those actvtes that have ot bee detfed as crtcal. 7.2 Strategy optos The orgazato should cosder strategc optos for ts crtcal actvtes ad the resources that each actvty wll requre o ts resumpto. The most approprate strategy or strateges wll deped o a rage of factors such as: the maxmum tolerable perod of dsrupto of the crtcal actvty; the costs of mplemetg a strategy or strateges; ad the cosequeces of acto Strateges mght be requred for the followg orgazatoal resources: people (see 7.3); premses (see 7.4); techology (see 7.5); formato (see 7.6); supples (see 7.7); ad stakeholders (see 7.8). BSI

28 COMMENTARY ON 7.4 Workste strateges ca vary sgfcatly ad a rage of optos mght be avalable. Dfferet types of cdet or threat mght requre the mplemetato of dfferet or multple workste optos. The correct strateges wll part be determed by the orgazato s sze, sector ad spread of actvtes, by stakeholders, ad by geographcal base. For example, publc authortes wll eed to mata a frotle servce delvery ther commutes. I each case, the orgazato should mmze the lkelhood of mplemetg a busess cotuty soluto that mght be affected by the same cdet that causes the busess dsrupto. 7.3 People The orgazato should detfy approprate strateges for matag core sklls ad kowledge. Ths aalyss should exted beyod employees to cotractors ad other stakeholders who possess extesve specalst sklls ad kowledge. Strateges to protect or provde those sklls mght clude: a) documetato of the way whch crtcal actvtes are performed; b) mult-skll trag of staff ad cotractors; c) separato of core sklls to reduce the cocetrato of rsk (ths mght etal physcal separato of staff wth core sklls or esurg that more tha oe perso has the requste core sklls); d) use of thrd partes; e) successo plag; ad f) kowledge reteto ad maagemet. 7.4 Premses The orgazato should devse a strategy for reducg the mpact of the uavalablty of ts ormal workste(s). Ths may clude oe or more of the followg: a) alteratve premses (locatos) wth the orgazato, cludg dsplacemet of other actvtes; b) alteratve premses provded by other orgazatos (whether or ot these are recprocal arragemets); c) alteratve premses provded by thrd-party specalsts; d) workg from home or at remote stes; e) other agreed sutable premses; ad f) use of a alteratve workforce a establshed ste. NOTE 1 If staff are to be moved to alteratve premses, these premses ought to be close eough that staff are wllg ad able to travel there, takg to accout ay possble dffcultes caused by the cdet. However, the alteratve premses ought ot to be so close that they are lkely to be affected by the same cdet. NOTE 2 The use of alteratve premses for cotuty purposes ought to be supported by a clear statemet as to whether the alteratve premses are for the sole use of the orgazato. If the alteratve premses are shared wth other orgazatos, a pla to mtgate the o-avalablty of these premses ought to be developed ad documeted. NOTE 3 It may be approprate to move the workload rather tha the staff, e.g. a maufacturg le or a call cetre s workload. 22 BSI 2006

29 COMMENTARY ON Techology strateges wll vary sgfcatly betwee orgazatos accordg to the sze, ature ad complexty of busess. Specfc strateges ought to be developed to safeguard, replace or restore specalzed or custom bult techologes wth log lead tmes. The orgazato may eed to make provso for maual operatos before full techology servces are recovered. 7.5 Techology Techology strateges wll deped o the ature of the techology employed ad ts relatoshp to crtcal actvtes, but wll typcally be oe or a combato of the followg: provso made wth the orgazato; servces delvered to the orgazato; ad servces provded exterally by a thrd party Techology strateges may clude: geographcal spread of techology,.e. matag the same techology at dfferet locatos that wll ot be affected by the same busess dsrupto; holdg older equpmet as emergecy replacemet or spares; ad addtoal rsk mtgato for uque or log lead tme equpmet Iformato techology (IT) servces frequetly eed complex cotuty strateges. Where such strateges are requred, cosderato should be gve to: recovery tme objectves (RTOs) for systems ad applcatos whch support the key actvtes detfed the BIA; locato ad dstace betwee techology stes; umber of techology stes; remote access; the use of u-staffed (dark) stes as opposed to staffed stes; telecoms coectvty ad redudat routg; the ature of falover (whether maual terveto s requred to actvate alteratve IT provso or whether ths eeds to occur automatcally); ad thrd-party coectvty ad exteral lks. NOTE 1 If a strategy of falg over from oe ste to aother s adopted, the etwork path dstace betwee the two stes has to be carefully cosdered as the dstace betwee the stes could have a egatve mpact o the way whch IT systems operate. NOTE 2 Where more tha oe ste hosts a orgazato s IT, there may be a mutual IT recovery strategy, so that the systems, etwork ad storage at each ste s szed to cope wth the combed traffc ad work of the other(s) addto to ts ow work. NOTE 3 Aother soluto to relocatg people to alteratve premses s to provde them wth remote access to IT va dal-up, or through the Iteret usg Vrtual Prvate Network (VPN) or smlar techology. NOTE 4 Further gudace o cotuty for IT ad telecommucatos hardware may be foud such documets as PAS 77, BS ISO/IEC ad BS ISO/IEC (both parts). BSI

30 COMMENTARY ON 7.7 I offce-based evromets, supples mght costtute cheques, etc. Other dustres mght detfy retal stock or just--tme supples, or vehcle fuels. 7.6 Iformato Iformato strateges should be such as to esure that formato vtal to the orgazato s operato s protected ad recoverable accordg to the tmeframes descrbed wth the BIA. NOTE 1 Further gudace s gve BS ISO/IEC The storage ad recovery of such formato has to be complat wth relevat legslato. Ay formato requred for eablg the delvery of the orgazato s crtcal actvtes should have approprate: cofdetalty; tegrty; avalablty; ad currecy. Iformato strateges should be documeted for the recovery of formato that has ot yet bee coped or backed-up to a safe locato. Iformato strateges should exted to clude: physcal (hardcopy) formats; ad vrtual (electroc) formats, etc. NOTE 2 I all cases, formato eeds to be recovered to a pot tme that s kow ad agreed by top maagemet. Varous methods of copyg may be used, such as electroc or tape backups, mcrofche, photocopes, creatg dual copes at the tme of producto ad so o. Ths kow recovery pot s ofte referred to as the recovery pot objectve. 7.7 Supples The orgazato should detfy ad mata a vetory of the core supples that support ts crtcal actvtes. Strateges to provde these may clude: storage of addtoal supples at aother locato; arragemets wth thrd partes for delvery of stock at short otce; dverso of just--tme delveres to other locatos; holdg of materals at warehouses or shppg stes; trasfer of sub-assembly operatos to a alteratve locato whch has supples; ad detfcato of alteratve/substtute supples Where crtcal actvtes are depedet upo specalst supples, the orgazato should detfy the key supplers ad sgle sources of supply. Strateges to maage cotuty of supply may clude: creasg the umber of supplers; ecouragg or requrg supplers to have a valdated busess cotuty capablty; cotractual ad/or servce level agreemets wth key supplers; or the detfcato of alteratve, capable supplers. 24 BSI 2006

31 7.8 Stakeholders Whe determg approprate BCM strateges, the orgazato should cosder ad protect the terests of ts key stakeholders. These strateges should take to accout relevat socal ad cultural cosderatos The orgazato should detfy approprate strateges to maage relatoshps wth key stakeholders, busess or servce parters ad cotractors. Each group mght eed partcular cosderatos. Strateges to protect the terests of key stakeholders may clude specal arragemets for esurg the welfare of stakeholders wth specfc eeds, such as dsablty, lless or pregacy The orgazato should detfy a perso or persos who wll dscharge resposblty for welfare ssues followg a cdet. 7.9 Cvl emergeces Orgazatos seekg to determe, mplemet or valdate strateges for cdet maagemet ad busess cotuty maagemet should become famlar wth offcal local respoder bodes at a early stage. These local respoders are tasked wth atcpato, assessmet, preveto, preparato, respose ad recovery actvtes relato to cvl emergeces occurrg wth ther commutes. NOTE I the UK, these respoder bodes may be kow as local reslece forums Key respoders wll be strumetal offcally declarg that a cvl emergecy has occurred ad provdg: pre- or post-cdet advce (e.g. rsk assessmets); warg ad formg procedures; ad commuty recovery arragemets followg a cvl emergecy. NOTE 1 Cvl emergeces ca result death ad physcal jury; they ca have a profoud ad log term mpact o the psychologcal, socal, ad ecoomc welfare of dvduals ad ther commutes. Emergeces ca quckly cur sgfcat dsrupto to publc trasport servces, commucato etworks, crtcal frastructures ad the smooth flow of goods, servces ad supples. I lght of ths potetal for dsrupto, orgazatos may wsh to famlarze themselves wth the plag arragemets of ther respectve local reslece forum. NOTE 2 Uder the UK Cvl Cotgeces Act (2004) [1], local authortes are lawfully requred to provde busess cotuty advce ad gudace to both commercal ad volutary orgazatos operatg wth ther jursdcto Sg-off Top maagemet should sg off the documeted strateges to cofrm that the determato of cotuty strateges has bee properly udertake ad caters for lkely causes ad effects of dsrupto, ad that the chose strateges are approprate to meet the orgazato s objectves wth the orgazato s rsk appette. BSI

32 d g d e B b o ' s l t BS : Developg ad mplemetg a BCM respose C M t h e o r g Uderstadg the orgazato a z a t Ths elemet of the BCM lfecycle s cocered wth the developmet ad mplemetato of approprate plas ad arragemets to esure cotuty of crtcal actvtes, ad the maagemet of a cdet. Exercsg, matag ad revewg BCM programme maagemet Determg BCM strategy c u m E Developg ad mplemetg BCM respose e r u 8.1 Itroducto Clause 6 ad Clause 7 set out how the orgazato should: detfy ts crtcal actvtes; evaluate threats to these crtcal actvtes; choose approprate strateges to reduce the lkelhood ad mpacts of cdets; ad choose approprate strateges that provde for the cotuty or recovery of ts crtcal actvtes. The rage of threats to be plaed for should be determed by the orgazato s rsk appette. COMMENTARY ON 8.2 I small orgazatos the resposblty for cdet ad busess cotuty maagemet may be vested a sgle dvdual. Larger orgazatos may use a tered approach ad may establsh dfferet teams to focus o cdet maagemet, busess cotuty ad busess recovery ssues. I some cases these teams may be supported by other teams wth resposblty for actvtes such as meda commucatos ad people ssues. 8.2 Icdet respose structure The orgazato should defe a cdet respose structure that wll eable a effectve respose ad recovery from dsruptos I ay cdet stuato there should be a smple ad quckly-formed structure that wll eable the orgazato to: cofrm the ature ad extet of the cdet, take cotrol of the stuato, cota the cdet, ad commucate wth stakeholders. The same structure should trgger a approprate busess cotuty respose. Ths structure may be referred to as the cdet maagemet team (IMT) or crss maagemet team (CMT). 26 BSI 2006

33 8.2.3 The team should have plas, processes ad procedures to maage the cdet ad these should be supported by busess cotuty tools to eable cotuty ad recovery of crtcal actvtes The team should have plas for the actvato, operato, coordato ad commucato of the cdet respose. Fgure 2 llustrates the three ma phases over tme of a cdet, ad the relatoshp betwee cdet maagemet ad busess cotuty. Fgure 2 Icdet tmele Overall recovery objectve: Back-to-ormal as quckly as possble Icdet! Tme Zero Tmele Icdet respose Busess cotuty Wth mutes to hours: staff ad vstors accouted for casualtes dealt wth damage cotamet / lmtato damage assessmet vocato of BCP Wth mutes to days: cotact staff, customers, supplers, etc. recovery of crtcal busess process rebuld lost work--progress Recovery / resumpto - back-to-ormal Wth weeks to moths: damage repar / replacemet relocato to permaet place of work recovery of costs from surers NOTE I some cases a orgazato s actvato of ts cdet maagemet, busess cotuty ad busess recovery plas may be eacted rapd successo or smultaeously Orgazatos may develop specfc plas to recover or resume operatos back to a ormal state (recovery plas). However, some cdets t mght ot be possble to defe what ormal looks lke utl some tme after the cdet, so that t mght ot be possble to mplemet recovery plas mmedately. Orgazatos mght therefore wsh to esure that busess cotuty plas are capable of exteded operato, gvg tme for the developmet of recovery ( back-to-ormal ) plas. BSI

34 COMMENTARY ON A small orgazato may have a sgle pla that ecompasses all requremets for the busess ad whch covers ts etre operatos. A very large orgazato may have may plas, each of whch specfes detal the recovery of: a partcular part of ts busess; partcular premses; or a partcular scearo, ad may clude separate documetato for the cdet, cotuty ad recovery phases. COMMENTARY ON Each pla may state clearly what t does ot ted to acheve ad why. COMMENTARY ON Plas may also cota, where approprate, procedures ad checklsts that support the postcdet revew process. 8.3 Cotet of plas Itroducto All plas, whether cdet maagemet plas, busess cotuty plas or busess recovery plas, should be cocse ad accessble to those wth resposbltes defed the plas. Plas should cota the elemets to Purpose ad scope The purpose ad scope of each specfc pla should be defed, agreed by top maagemet, ad uderstood by those who wll put the pla to effect. Ay relatoshp to other relevat plas or documets wth the orgazato should be clearly refereced ad the method of obtag ad accessg these plas descrbed. Each cdet maagemet, busess cotuty ad busess recovery pla should set out prortzed objectves terms of: the crtcal actvtes to be recovered; the tmescales whch they are to be recovered; the recovery levels eeded for each crtcal actvty; ad the stuato whch each pla ca be utlzed Roles ad resposbltes The roles ad resposblty of the people ad teams havg authorty (both terms of decso-makg ad authorty to sped) durg ad followg a cdet should be clearly documeted. The persos or groups covered by a pla should be clearly defed. 28 BSI 2006

35 COMMENTARY ON Tme lost durg a respose ca ever be regaed. It s almost always better to moblze the respose team ad subsequetly stad t dow tha to mss a opportuty to cota a cdet early ad prevet escalato. Orgazatos may factor defed ad teratoally agreed escalato stages le wth clear gudace from other expert sources, e.g. the World Health Orgazato for pademcs Pla vocato The method by whch a cdet maagemet, busess cotuty or busess recovery pla s voked should be clearly documeted. Ths process should allow for the relevat plas or parts thereof to be voked the shortest possble tme followg the occurrece of a busess dsrupto. The orgazato should establsh ad documet clear gudeles ad a set of crtera regardg whch dvdual(s) have the authorty to voke the pla(s) ad uder what crcumstaces. The vocato process may requre the mmedate moblzato of orgazatoal resources. The pla should clude a clear ad precse descrpto of: how to moblze the team(s); mmedate redezvous pots; ad subsequet team meetg locatos ad detals of ay alteratve meetg locatos ( larger orgazatos, these meetg places may be referred to as cdet maagemet or commad cetres). The orgazato should documet a clear process for stadg dow the team(s) oce the cdet s over, ad returg to busess as usual. COMMENTARY ON The cotact records may clude out of hours cotact detals. However, where plas referece such prvate detals, respect for data protecto has to be a paramout cosderato Documet ower ad mataer The orgazato should omate the prmary ower of the pla, ad detfy ad documet who s resposble for revewg, amedg ad updatg the pla at regular tervals. A system of verso cotrol should be employed, ad chages formally otfed to all terested partes wth a formal pla dstrbuto record mataed ad kept up-to-date Cotact detals Each pla should cota or provde a referece to the essetal cotact detals for all key stakeholders. 8.4 The cdet maagemet pla (IMP) The purpose of a IMP s to allow the orgazato to maage the tal (acute) phase of a cdet. The IMP should: a) be flexble, feasble, ad relevat; b) be easy to read ad uderstad; ad c) provde the bass for maagg all possble ssues, cludg the stakeholder ad exteral ssues, facg the orgazato durg a cdet. BSI

36 COMMENTARY ON Depedg upo the scale of the orgazato ad the sze of the cdet, a umber of competet, traed people may be requred to respod to telephoe equres about the cdet. COMMENTARY ON Orgazatos have a drect resposblty to safeguard the welfare of employees, cotractors, vstors ad customers where a cdet poses a drect rsk to lfe, lvelhood ad welfare. Specal atteto wll eed to be pad to ay groups wth dsabltes or other specfc eeds (e.g. pregacy, temporary dsablty due to jury, etc.). Plag advace to meet these requremets ca reduce rsk ad reassure those affected. The log-term mpacts of cdets caot be uderestmated. Developg approprate strateges support of huma welfare ca drectly promote physcal ad emotoal recovery wth the orgazato. The IMP should also: 1) have top maagemet support, cludg a board sposor where applcable; ad 2) be supported by a approprate budget for developmet, mateace ad trag. 8.5 Cotets of the IMP Geeral I addto to the cotet recommeded 8.3, a IMP should clude the formato to Task ad acto lsts The IMP should clude task lsts ad acto checklsts to maage the mmedate cosequeces of a busess dsrupto. These tasks should: esure that safety of dvduals s addressed frst; be based upo the results of the orgazato s BIA; be structured a way that delvers the strategc ad tactcal optos chose by the orgazato (as descrbed Clause 7); ad help prevet the further loss or uavalablty of crtcal actvtes, ad supportg resources as defed Clause Emergecy cotacts A descrpto of how, ad uder what crcumstaces, the orgazato wll commucate wth staff ad ther relatves, freds ad emergecy cotacts should be cluded. I some cases, t mght be approprate to clude detal a separate documet. Next-of-k ad emergecy cotact formato for all persoel should be kept up-to-date ad avalable for prompt use People actvtes The IMP should satsfy the terests of those whose welfare mght be put at rsk as a result of a cdet, takg to accout relevat socal ad cultural cosderatos (see 7.8.2). The IMP should detfy the perso(s), who wll dscharge resposblty for welfare ssues followg a cdet (see 7.8.3), cludg: a) ste evacuato (clusve of teral shelter-at-ste actvtes); b) the moblzato of safety, frst ad or evacuato-assstace teams; c) locatg ad accoutg for those who were o ste or the mmedate vcty; d) ogog employee/customer commucatos ad safety brefgs. The orgazato should deploy staff wth approprate levels of authorty to lase where approprate wth the emergecy servces. NOTE Emergecy servces play the prmary role protectg lfe ad relevg sufferg durg emergeces. Therefore, early laso, pre-plag ad real-tme cdet coordato betwee the orgazato ad ts frst respoders ad the emergecy servces ca mprove the effcecy of a cdet respose. 30 BSI 2006

37 COMMENTARY ON Pre-prepared formato ca be especally useful the early stages of a cdet. It eables a orgazato to provde detals about the orgazato ad ts busess whle detals of the cdet are stll beg establshed. A orgazato may use all applcable meas to share formato durg ad after a cdet. Such sources may clude webstes, spokespeople, ews sources, ad geerc compay brefg statemets. COMMENTARY ON Pressure or commuty acto groups who collectvely have power or fluece over the orgazato mght also eed to be cosdered. The orgazato may reta a meas to provde servces to debref ad cousel affected staff after a cdet. Servces may be sourced exterally or may be provded as a exteso to exstg occupatoal health ad employee assstace programmes Meda respose The orgazato s meda respose should be documeted the IMP, cludg: a) the cdet commucatos strategy; b) the orgazato s preferred terface wth the meda; c) a gudele or template for the draftg of a statemet to be provded to the meda at the earlest practcable opportuty followg the cdet; d) approprate umbers of traed, competet, spokespeople omated ad authorzed to release formato to the meda; e) establshmet, where practcable, of a sutable veue to support laso wth the meda, or other stakeholder groups. I some cases, t may be approprate to: provde supportg detal a separate documet; establsh a approprate umber of competet, traed people to aswer telephoe equres from the press; prepare backgroud materal about the orgazato ad ts operatos (ths formato should be pre-agreed for release); esure that all meda formato s made avalable wthout udue delay Stakeholder maagemet A process for detfyg ad prortzg commucatos wth other key stakeholders should be cluded. It may be ecessary to develop a separate stakeholder maagemet pla to provde crtera for settg prortes ad allocatg a perso to each stakeholder or group of stakeholders. BSI

38 COMMENTARY ON A cdet maagemet locato provdes a kow focal pot from whch the cdet ca be maaged. It s mportat to capture ad share key formato ad to set objectves, assg tasks, maage resources, detfy ad track ssues, ad make formed decsos. Good commucatos are essetal. The use of a meetg pot overcomes the stuatos where telephoe etworks are overloaded. The locato may be as smple as a hotel room or a staff member s house. It may be as complex as a dedcated commad cetre wth PCs, vdeo-coferecg ad multple telephoes. Itally, t mght be ecessary to hold a vrtual or off-ste meetg, e.g. va telephoe, telecoferece or vdeocoferece, so that key decsos ca be made promptly Icdet maagemet locato The orgazato should defe a robust ad predetermed locato, room or space from whch a cdet wll be maaged. Oce establshed, ths locato should be the focal pot for the orgazato s respose. A alteratve meetg pot at a dfferet locato should also be omated case access to the prmary locato s deed. Each locato should have access to approprate resources by whch the cdet team may tate effectve cdet maagemet actvtes wthout delay. The chose locato should be ft-for-purpose ad clude: a) effectve prmary ad secodary meas of commucato; b) facltes for accessg ad sharg formato, cludg the motorg of the ews meda Aexes The IMP should clude up-to-date cotact ad moblzato detals for ay relevat ageces, orgazatos ad resources that mght be requred to support the orgazato s respose strateges. The IMP should clude logs or forms for the recordg of vtal formato about the cdet, such as the cdet tmele, detals of casualtes, decsos made, moey spet, detals of casualtes, damage assessmets, commucatos ssued, ad all other formato deemed essetal by the orgazato to support post cdet revew. The IMP may also clude or referece: a) maps, charts, plas, photographs ad other formato that mght be relevat the evet of a cdet; b) documeted respose strateges agreed wth thrd partes as approprate (jot veture parters, cotractors, supplers, etc.); c) detals of equpmet storage ad stagg areas; d) ste access plas; ad e) a clams maagemet procedure that esures all surace ad legal clams for or agast the orgazato meet regulatory ad cotractual requremets. 32 BSI 2006

39 COMMENTARY ON 8.6 The compoets ad cotets of BCPs vary from orgazato to orgazato ad have a dfferet level of detal based o the scale, evromet, culture ad techcal complexty of the orgazato. Large orgazatos mght requre separate documets for each of ther crtcal actvtes, whereas smaller orgazatos mght be able to cover everythg that s crtcal to them wth a sgle documet. COMMENTARY ON These pots are cosstet wth the requremets of the Cvl Cotgeces Act [1], Secto Plas wll referece the people, premses, techology, formato, supples ad stakeholders detfed the strateges phase (see Clause 7). Clear assumptos ad detals of ay resources requred to mplemet plas ought to be cluded. I the evet that the lack of a servce or resource makes the pla s goals uachevable, a clear procedure for escalatg the ssue ought to be defed. 8.6 The busess cotuty pla(s) [BCP(s)] The purpose of a busess cotuty pla (BCP) s to eable a orgazato to recover or mata ts actvtes the evet of a dsrupto to ormal busess operatos. BCPs are actvated (voked) to support the crtcal actvtes requred to delver the orgazato's objectves. They may be voked whole or part ad at ay stage of the respose to a cdet. 8.7 Cotets of the BCP Geeral I addto to the tems recommeded 8.3, a BCP should cota the elemets to Acto plas/ task lsts The acto pla should clude a structured checklst of actos ad tasks a order of prorty, hghlghtg: a) how the BCP s voked; b) the perso(s) resposble for vokg the busess cotuty pla; c) the procedure that perso should adopt takg that decso; d) the perso(s) who should be cosulted before such a decso s take; e) the perso(s) who should be formed oce a decso has bee take; f) who goes where, ad whe; g) what servces are avalable where, ad whe; cludg how the orgazato moblzes exteral ad thrd-party resources; h) how ad whe ths formato s commucated; ad ) f relevat, detaled procedures for maual workarouds, system recovery, etc. BSI

40 COMMENTARY ON I may cases the orgazato may wsh to omate the same dvdual(s) detfed the cdet maagemet pla ad drect them to maage the loger-term ssues. COMMENTARY ON The pla may also clude forms for recordg admstratve data, e.g. resources used, expeses recordg materals; maps, drawgs, ad ste ad offce plas, especally those relatg to ay alteratve facltes such as workspace recovery areas ad storage locatos Resource requremets The resources requred for busess cotuty ad busess recovery should be detfed at dfferet pots tme. These may clude: a) people, whch may clude: securty, trasportato logstcs, welfare eeds, ad emergecy expeses; b) premses; c) techology, cludg commucatos; d) formato, whch may clude: facal (e.g. payroll) detals, customer accout records, suppler ad stakeholder detals, legal documets (e.g. cotracts, surace polces, ttle deeds, etc.), ad other servces documets (e.g. servce level agreemets); e) supples; ad f) maagemet of, ad commucato wth, stakeholders Resposble perso(s) The orgazato should detfy a omated perso(s) to maage the busess cotuty ad busess recovery phases of a dsrupto Forms ad aexes Where approprate, the BCP should cota up-to-date cotact detals for relevat teral ad exteral ageces, orgazatos ad provders that mght be requred to support the orgazato. The busess cotuty pla should clude a cdet log or forms for the recordg of vtal formato, especally respect of decsos made. 34 BSI 2006

41 d g d e B b o ' s l t BS : Exercsg, matag ad revewg BCM arragemets M t h e o r g Uderstadg the orgazato a z a t Ths elemet of the BCM lfecycle esures that a orgazato s BCM arragemets are valdated by exercse ad revew ad that they are kept up-to-date. C Exercsg, matag ad revewg BCM programme maagemet Determg BCM strategy c u m E Developg ad mplemetg BCM respose e r u 9.1 Itroducto A orgazato s busess cotuty ad cdet maagemet arragemets caot be cosdered relable utl exercsed ad uless ther currecy s mataed. Exercsg s essetal to developg teamwork, competece, cofdece ad kowledge whch s vtal at the tme of a cdet. Arragemets should be verfed through exercsg, audt ad self-assessmet processes to esure that they are ft-for-purpose. COMMENTARY ON 9.2 Exercses provde demostrable evdece of a busess cotuty ad cdet maagemet competece ad capablty. Tme ad resources spet provg BCM strateges by exercsg BCPs wll lead to a ft-for-purpose capablty. No matter how well desged ad thought-out a BCM strategy or BCP appears to be, a seres of robust ad realstc exercses wll detfy areas that requre amedmet. 9.2 Exercse programme A exercse programme should be cosstet wth the scope of the busess cotuty pla(s), gvg due regard to ay relevat legslato ad regulato. Exercses may: atcpate a predetermed outcome, e.g. are plaed ad scoped advace; or allow the orgazato to develop ovatve solutos. A exercse programme should be devsed that, over a perod of tme, leads to objectve assurace that the BCP wll work as atcpated whe requred. The programme should: exercse the techcal, logstcal, admstratve, procedural ad other operatoal systems of the BCP; exercse the BCM arragemets ad frastructure (cludg roles, resposbltes, ad ay cdet maagemet locatos ad work areas, etc.); valdate the techology ad telecommucatos recovery, cludg the avalablty ad relocato of staff. BSI

42 COMMENTARY ON Exercses that show serous defceces or accuraces the BCP ought to be reru after correctve actos have bee completed. A rage of approaches to exercsg BCM strateges s show Table 1. I addto, t mght lead to the mprovemet of BCM capablty by: practsg the orgazato s ablty to recover from a cdet; verfyg that the BCP corporates all orgazatoal crtcal actvtes ad ther depedeces ad prortes; hghlghtg assumptos whch eed to be questoed; stllg cofdece amogst exercse partcpats; rasg awareess of busess cotuty throughout the orgazato by publczg the exercse; valdatg the effectveess ad tmeless of restorato of crtcal actvtes; ad demostratg competece of the prmary respose teams ad ther alteratves. 9.3 Exercsg BCM arragemets Exercses should be realstc, carefully plaed, ad agreed wth stakeholders, so that there s mmum rsk of dsrupto to busess processes. A exercse should be plaed such that the rsk of a cdet occurrg as a drect result of the exercse s mmzed Every exercse should have clearly defed ams ad objectves. A post-exercse debrefg ad aalyss should be udertake whch cosders the achevemet of the ams ad objectves of the exercse. A post-exercse report should be produced that cotas recommedatos ad a tmetable for ther mplemetato The scale ad complexty of exercses should be approprate to the orgazato s recovery objectves Busess cotuty ad cdet maagemet plas should be exercsed to esure that they ca be executed correctly, ad cota approprate detal ad structos. 36 BSI 2006

43 Table 1 Types ad methods of exercsg BCM strateges Complexty Exercse Process Varats Good practce frequecy A) Smple Desk check Revew/amedmet of cotet Challege cotet of BCP COMMENTARY ON 9.4 The purpose of the BCM mateace process s to esure that the orgazato s BCM competece ad capablty remas effectve, ft-for purpose ad up-to-date. Mateace actvtes ought to modfy exstg exercse schedules whe they dcate that there has bee a sgfcat chage the strategy, soluto or busess process. Update/valdato Audt/verfcato Medum Walk-through of pla Challege cotet of BCP Iclude teracto ad valdate partcpats roles Complex Smulato Exercse crtcal actvtes Exercse full BCP, cludg cdet maagemet Use artfcal stuato to valdate that the BCP(s) cotas both ecessary ad suffcet formato to eable a successful recovery Ivocato a cotrolled stuato that does ot jeopardze busess as usual operato Buldg-/ campus-/ excluso zoe-wde exercse Icorporate assocated plas Defed operatos from alteratve ste for a fxed tme The exercse programme should cosder the roles of all partes, cludg key thrd party provders, outsource parters ad others who would be expected to partcpate recovery actvtes. A orgazato may clude such partes ts exercses. 9.4 Matag BCM arragemets At least aually Aually Aually Aually or twce yearly Aually or less Aually or less A) The frequecy of exercses should deped upo both the orgazato s eeds, the evromet whch t operates, ad stakeholder requremets. However, the exercsg programme should be flexble, takg to accout the rate of chage wth the orgazato ad the outcome of prevous exercses. The above exercse methods ca be employed for dvdual pla compoets, ad sgle ad multple plas. A clearly defed ad documeted BCM mateace programme should be establshed. Ths programme should esure that ay chages (teral or exteral) that mpact the orgazato are revewed relato to BCM. It should also detfy ay ew products ad servces ad ther depedet actvtes that eed to be cluded the BCM mateace programme. As a result of the BCM mateace programme, the orgazato should: revew ad challege ay assumptos made ay compoets of BCM throughout the orgazato; ad dstrbute updated, ameded or chaged BCM polcy, strateges, solutos, processes ad plas to key persoel uder a formal chage cotrol process. NOTE If there are major busess chages the a revso of the BIA ought to be udertake. The other compoets of the BCM programme may be ameded to take accout of these chages. The outcomes from the BCM mateace process should clude: documeted evdece of the proactve maagemet ad goverace of the orgazato s busess cotuty programme; verfcato that key people who are to mplemet the BCM strategy ad plas are traed ad competet; BSI

44 verfcato of the motorg ad cotrol of the BCM rsks faced by the orgazato; ad documeted evdece that materal chages to the orgazato s structure, products ad servces, actvtes, purpose, staff ad objectves have bee corporated to the orgazato s busess cotuty ad cdet maagemet plas. 9.5 Revewg BCM arragemets COMMENTARY ON I the cotext of cotual mprovemet, the orgazato may acqure kowledge o ew BCM-related techology ad practces, cludg ew tools ad techques, ad these have to be evaluated to establsh ther potetal beeft to the orgazato The orgazato s top maagemet should, at tervals that t deems approprate, revew the orgazato s BCM capablty, to esure ts cotug sutablty, adequacy ad effectveess. Ths revew should be documeted The revew should verfy that complace wth the orgazato s BCM polcy esures complace wth ay applcable laws, stadards, strateges, frameworks ad good practce gudeles The revew should address the possble eed for chages to polcy, strategy, objectves ad other elemets of the BCM maagemet system the lght of such thgs as exercse results, chagg crcumstaces ad the commtmet to cotual mprovemet The revew ca take the form of teral or exteral audts, or self-assessmets. The frequecy ad tmg of revews ca be flueced by laws ad regulatos, depedg o the sze, ature ad legal status of the orgazato. They mght also be flueced by the requremets of stakeholders. A audt or self-assessmet of the orgazato s BCM programme should verfy that: all key products ad servces ad ther supportg crtcal actvtes ad resources have bee detfed ad cluded the orgazato s BCM strategy; the orgazato s BCM polcy, strateges, framework ad plas accurately reflect ts prortes ad requremets (the orgazato s objectves); the orgazato s BCM competece ad ts BCM capablty are effectve ad ft-for-purpose ad wll permt maagemet, commad, cotrol ad coordato of a cdet; the orgazato s BCM solutos are effectve, up-to-date ad ft-for-purpose, ad approprate to the level of rsk faced by the orgazato; the orgazato s BCM mateace ad exercsg programmes have bee effectvely mplemeted; BCM strateges ad plas corporate mprovemets detfed durg cdets ad exercses ad the mateace programme; the orgazato has a ogog programme for BCM trag ad awareess; BCM procedures have bee effectvely commucated to relevat staff, ad that those staff uderstad ther roles ad resposbltes; ad chage cotrol processes are place ad operate effectvely. 38 BSI 2006

45 9.5.5 Audt The orgazato should provde for the depedet audt of ts BCM competece ad capablty to detfy actual ad potetal shortcomgs. It should establsh, mplemet ad mata procedures for dealg wth these. Idepedet audts should be coducted by competet persos, whether teral or exteral Self-assessmet A BCM self-assessmet process plays a role esurg that a orgazato has a robust, effectve ad ft-for-purpose BCM competece ad capablty. It provdes the qualtatve verfcato of a orgazato s ablty to recover from a cdet. Self-assessmet should be coducted agast the orgazato s objectves. It should also take to accout relevat dustry stadards ad good practce. BSI

46 d g d e B b o ' s l t BS : Embeddg BCM the orgazato s culture C M t h e o r g Uderstadg the orgazato a z a t To be successful, busess cotuty has to become part of the way that a orgazato s maaged, regardless of sze or sector. At each stage of the BCM process, opportutes exst to troduce ad ehace a orgazato s BCM culture. Exercsg, matag ad revewg BCM programme maagemet Determg BCM strategy c u m E Developg ad mplemetg BCM respose e r u COMMENTARY ON 10.1 Creatg ad embeddg a BCM culture wth a orgazato ca be a legthy ad dffcult process whch mght ecouter a level of resstace that was ot atcpated. A uderstadg of the exstg culture wth the orgazato wll assst the developmet of a approprate BCM culture programme. All staff have to uderstad that BCM s a serous ssue for the orgazato ad that they have a mportat role to play matag the delvery of products ad servces to ther clets ad customers. COMMENTARY ON 10.2 Rasg ad matag awareess of BCM wth all the orgazato s staff s mportat to esure that they are aware of why BCM s mportat to the orgazato. They wll eed to be show that ths s a lastg tatve that has the ogog support of top maagemet Geeral Buldg, promotg ad embeddg a BCM culture wth a orgazato esures that t becomes part of the orgazato s core values ad effectve maagemet. A orgazato wth a postve BCM culture wll: develop a BCM programme more effcetly; stl cofdece ts stakeholders (especally staff ad customers) ts ablty to hadle busess dsruptos; crease ts reslece over tme by esurg BCM mplcatos are cosdered decsos at all levels; ad mmze the lkelhood ad mpact of dsruptos. Developmet of a BCM culture s supported by: leadershp from seor persoel the orgazato; assgmet of resposbltes (see 5.2); awareess rasg; sklls trag; ad exercsg plas Awareess The orgazato should have a process for detfyg ad delverg the BCM awareess requremets of the orgazato ad evaluatg the effectveess of ts delvery. BCM staff should make themselves aware of exteral BCM formato. Ths may be doe cojucto wth seekg gudace from emergecy servces, local authortes ad regulators. 40 BSI 2006

47 The orgazato should rase, ehace ad mata awareess by matag a ogog BCM educato ad formato programme for all staff. Such a programme may clude: a cosultato process wth staff throughout the orgazato cocerg the mplemetato of the BCM programme; dscusso of BCM the orgazato s ewsletters, brefgs, ducto programme or jourals; cluso of BCM o relevat web pages or traets; learg from teral ad exteral cdets; BCM as a tem at team meetgs; exercsg cotuty plas at a alteratve locato (e.g. a recovery ste); ad vsts to ay desgated alteratve locato (e.g. a recovery ste). The orgazato may exted ts BCM awareess programme to ts supplers ad other stakeholders Sklls trag The orgazato should have a process for detfyg ad delverg the BCM trag requremets of relevat partcpats ad evaluatg the effectveess of ts delvery. The orgazato should udertake trag of: a) BCM staff for tasks such as: BCM programme maagemet, coductg a busess mpact aalyss, developg ad mplemetg BCPs, rug a BCP exercse programme, rsk ad threat assessmet, ad meda commucatos; b) o-bcm staff requrg sklls to udertake ther omated roles cdet respose or busess recovery. Respose sklls ad competece throughout the orgazato should be developed by practcal trag, cludg actve partcpato exercses. BSI

48 Refereces Stadards publcatos BS EN ISO 9000, Qualty maagemet systems Fudametals ad vocabulary BS ISO/IEC (both parts), Iformato techology Servce maagemet BS ISO/IEC 27001, Iformato techology Securty techques Iformato securty maagemet systems Requremets PAS77, IT Servce Cotuty Maagemet Other publcatos [1] The Cvl Cotgeces Act 2004, Lodo: TSO 42 BSI 2006

49 Ths page delberately left blak

50 BSI Brtsh Stadards Isttuto BSI s the depedet atoal body resposble for preparg Brtsh Stadards. It presets the UK vew o stadards Europe ad at the teratoal level. It s corporated by Royal Charter. Revsos Brtsh Stadards are updated by amedmet or revso. Users of Brtsh Stadards should make sure that they possess the latest amedmets or edtos. It s the costat am of BSI to mprove the qualty of our products ad servces. We would be grateful f ayoe fdg a accuracy or ambguty whle usg ths Brtsh Stadard would form the Secretary of the techcal commttee resposble, the detty of whch ca be foud o the sde frot cover. Tel: +44 (0) Fax: +44 (0) BSI offers members a dvdual updatg servce called PLUS whch esures that subscrbers automatcally receve the latest edtos of stadards. Buyg stadards Orders for all BSI, teratoal ad foreg stadards publcatos should be addressed to Customer Servces. Tel: +44 (0) Fax: +44 (0) Emal: [email protected]. Stadards are also avalable from the BSI webste at I respose to orders for teratoal stadards, t s BSI polcy to supply the BSI mplemetato of those that have bee publshed as Brtsh Stadards, uless otherwse requested. Iformato o stadards BSI provdes a wde rage of formato o atoal, Europea ad teratoal stadards through ts Lbrary ad ts Techcal Help to Exporters Servce. Varous BSI electroc formato servces are also avalable whch gve detals o all ts products ad servces. Cotact the Iformato Cetre. Tel: +44 (0) Fax: +44 (0) Emal: [email protected]. Subscrbg members of BSI are kept up to date wth stadards developmets ad receve substatal dscouts o the purchase prce of stadards. For detals of these ad other beefts cotact Membershp Admstrato. Tel: +44 (0) Fax: +44 (0) Emal: [email protected]. Iformato regardg ole access to Brtsh Stadards va Brtsh Stadards Ole ca be foud at Further formato about BSI s avalable o the BSI webste at Chswck Hgh Road Lodo W4 4AL Copyrght Copyrght subssts all BSI publcatos. BSI also holds the copyrght, the UK, of the publcatos of the teratoal stadardzato bodes. Except as permtted uder the Copyrght, Desgs ad Patets Act 1988 o extract may be reproduced, stored a retreval system or trasmtted ay form or by ay meas electroc, photocopyg, recordg or otherwse wthout pror wrtte permsso from BSI. Ths does ot preclude the free use, the course of mplemetg the stadard, of ecessary detals such as symbols, ad sze, type or grade desgatos. If these detals are to be used for ay other purpose tha mplemetato the the pror wrtte permsso of BSI must be obtaed. Detals ad advce ca be obtaed from the Copyrght & Lcesg Maager. Tel: +44 (0) Fax: +44 (0) Emal: [email protected].