BS 25999

From Wikipedia, the free encyclopedia

BS 25999 is BSI's standard in the field of Business Continuity Management (BCM). This standard replaces PAS 56, a Publicly Available Specification, published in 2003 on the same subject.

1 Structure
2 Contents
3 Timelines
4 Development
5 See also
6 External links

[edit] Structure

BS 25999 is a Business Continuity Management (BCM) standard in two parts.

The first, "BS 25999-1:2006 Business Continuity Management. Code of Practice", takes the form of general guidance and seeks to establish processes, principles and terminology for Business Continuity Management.

The second, "BS 25999-2:2007 Specification for Business Continuity Management", specifies requirements for implementing, operating and improving a documented Business Continuity Management System (BCMS), describing only requirements that can be objectively and independently audited.

A useful means of understanding the difference between the two is Part 1 is a guidance document and uses the term 'should', Part 2 is an independently verifiable specification that uses the word 'shall'

Certification (independent verification) is available from accredited certification bodies, for example KPMG or BSI amongst others and is a multi stage process usually involving a number of initial assessment visits. The assessor will then make a recommendation that the organisation receive certification or not. After initial certification a number of surveillance visits are made to ensure that the organisation is still in compliance.

[edit] Contents

The contents of the code of practice (BS 25999-1) are as follows:

Section 1 - Scope and Applicability. This section defines the scope of the standard, making clear that is describes generic best practice that should be tailored to the organisation implementing it

Section 2 - Terms and Definitions. This section describes the terminology and definitions used within the body of the standard

Section 3 - Overview of Business Continuity Management. A short overview is the subject of the standard. It is not meant to be a beginners guide but describes the overal processes, its relationship with risk management and reasons for an organisation to implement along with the benefits

Section 4 - The Business Continuity Management Policy. Central to the implementation of business continuity is having a clear, unambiguous and appropriately resourced policy

Section 5 - BCM Programme Management. Programme management is at the heart of the whole BCM process and the standard defines an approach

Section 6 - Understanding the organization. In order to apply appropriate business continuity strategies and tactics the organisation has to be fully understood, its critical activities, resources, duties, obligations, threats, risks and overall risk appetite.

Section 7 - Determining BCM Strategies. Once the organisation is understand the overall business continuity strategies can be defined that are appropriate.

Section 8 - Developing and implementing a BCM response. The tactical means by which business continuity is delivered. These include incident management structures, incident management and business continuity plans.

Section 9 - Exercising, maintenance, audit and self-assessment of the BCM culture. Without testing the BCM response an organisation cannot be certain that they will meet their requirements. Exercise, maintenance and review processes will enable the business continuity capability to continue to meet the organisations goals.

Section 10 - Embedding BCM into the organizations culture. Business continuity should not exist in a vacuum but become part of the way that the organisation is managed.

The contents of the specification (BS 25999-2) are as follows:

Section 1 - Scope. Defines the scope of the standard, the requirements for implementing and operating a documented business continuity management system.

Section 2 - Terms and Definitions. This section describes the terminology and definitions used within the body of the standard

Section 3 - Planning the Business Continuity Management System (PLAN). Part 2 of the standard is predicated on the well established Plan-Do-Check-Act model of continuous improvement. The first step is to plan the BCMS, establishing and embedding it within the organisation.

Section 4 - Implementing and Operating the BCMS (DO) Actually implement ones plans. This section encompasses 4 sections of Part 1, that is understand the organisation, determine BC strategy, develop & implement a BCM response and finally exercise/maintenance/review.

Section 5 - Monitoring and Reviewing the BCMS (CHECK) To ensure that the BCMS is continually monitored the Check stage covers internal audit and management review of the BCMS

Section 6 Maintaining and Improving the BCMS (ACT) To ensure that the BCMS is both maintained and improved on an ongoing basis this section looks at preventative and corrective action

[edit] Timelines

The first part of BS 25999 (BS 25999-1:2006) was published by the British Standards Institution in December 2006. The second part of BS 25999 (BS 25999-2:2007) was published in November 2007.

[edit] Development

As always if the standard becomes effective enough it will be taken over by ISO much like ISO:9001. and become an international standard

[edit] See also

There are a number of similar worldwide standards:

North America - Published by the National Fire Protection Association NFPA 1600: Standard on Disaster/Emergency Management and Business Continuity Programs.

Worldwide - Published by the International Organisation for Standardisation (ISO) ISO/PAS 22399:2007 Guideline for incident preparedness and operational continuity management

Australia - Published by Standards Australia HB 292-2006 : A practitioners guide to business continuity management HB 293-2006 : Executive guide to business continuity management