A manager's guide to ISO22301 : a practical guide to developing and implementing a business continuity management system

About the Author......Page 5
Contents......Page 6
Introduction......Page 9
What is business continuity management?......Page 11
Evolution......Page 12
The business continuity management system (BCMS)......Page 15
The relationship between business continuity and disaster recovery......Page 17
Cause and effect......Page 18
What is policy?......Page 19
The policy statement......Page 21
Use of the policy......Page 23
Chapter 2: Overview of the BCM Process......Page 25
Understanding of the organisation and its context......Page 29
Determining the scope of the business continuity management system......Page 30
Business continuity management system......Page 31
Policy......Page 33
Planning......Page 34
Support......Page 35
Competency of BCM personnel......Page 36
Awareness and communication......Page 37
Documentation......Page 38
Business impact analysis......Page 39
BCM strategy......Page 40
BCM response......Page 41
Performance evaluation and improvement......Page 42
The PDCA cycle......Page 43
Practical programme management......Page 44
Set-up phase......Page 45
Ongoing/maintenance phase......Page 47
End products......Page 48
Resources......Page 49
Governance and assurance processes......Page 50
What is BIA?......Page 52
Non-financial impacts......Page 55
Impact treatment......Page 58
Identifying the activities......Page 59
Suppliers......Page 63
Collecting the data......Page 64
Impact data analysis......Page 65
Partial and full recovery......Page 69
Tools......Page 70
The role of insurance......Page 71
Disaster recovery resources......Page 72
Mapping and analysis......Page 74
Identifying resources......Page 76
Conflicts......Page 77
Tools......Page 78
What is risk?......Page 79
Practical operational risk management......Page 81
Risk identification......Page 82
Scope......Page 84
Custom and practice......Page 85
Threats......Page 86
Multiple threats......Page 87
Risk assessment......Page 89
The risk matrix......Page 90
Risk appetite......Page 93
Risk analysis......Page 94
Risk control and treatment......Page 96
Preventative and curative measures......Page 97
The risk management process......Page 99
IT disaster recovery......Page 100
Availability......Page 103
Reciprocal and co-operative arrangements......Page 105
Go out and buy it......Page 106
People......Page 107
The rest of the resource spectrum......Page 108
BCM objectives......Page 109
Deliverables......Page 111
The incident response structure......Page 113
Command structure – teams and roles......Page 114
Teams and structure......Page 115
Collecting information......Page 118
Team resilience – deputies......Page 119
Triggering the BCM response – activation......Page 120
Business continuity planning......Page 121
Summary......Page 122
Command location......Page 123
Command structure......Page 124
Priorities and objectives......Page 125
Scenario plans......Page 126
Recovery plans......Page 128
Procedures......Page 129
Incident log......Page 130
Internal communication......Page 131
Contact data......Page 133
How the plan works......Page 134
Ending the business continuity phase......Page 138
Recovery......Page 139
Exercises......Page 141
Planning the exercise......Page 142
Execution......Page 144
Reporting......Page 145
Monitoring and measurement......Page 146
Criteria......Page 147
Internal audit......Page 148
Management review......Page 149
Documentation......Page 152
Continual improvement......Page 153
Making business continuity effective......Page 154
Raising awareness......Page 155
Awareness techniques......Page 156
Ownership......Page 157
Competitive advantage......Page 158
Chapter 10: Document Management and Control......Page 159
Usability......Page 161
Templates......Page 162
Version control......Page 163
Document history......Page 164
Security......Page 165
Corporate governance......Page 166
Supplier assurance......Page 167
Due diligence......Page 168
Chapter 12: Certification......Page 169
Terms and definitions......Page 170
Risk factors......Page 171
Scope and objectives......Page 172
Resources......Page 173
BCM culture......Page 174
Section 4 – Implementation and operation......Page 175
Risk assessment......Page 176
The BCM response......Page 177
BCMS implementation......Page 178
Section 4 – Implementation and operation......Page 179
Certification bodies......Page 180
Rogue traders......Page 181
The Combined Code on Corporate Governance (UK)......Page 182
Sarbanes-Oxley......Page 183
ISO27031......Page 184
ISO27001......Page 185
Bibliography......Page 186
Policy statement......Page 188
Scope......Page 189
Business continuity management principles......Page 191
Business impact analysis......Page 192
Maximum tolerable period of disruption......Page 193
Contingencies......Page 194
Response organisation......Page 195
Testing and maintenance......Page 196
Reporting......Page 197
Appendix 2: BCM Competencies......Page 198
Appendix 3: A Risk Register......Page 201
Appendix 4: A Crisis Management Team......Page 205
Appendix 5: A Communication Cascade......Page 208
Appendix 6: Document Templates......Page 211
Minimum acceptable level of activity......Page 212
1.0 Loss of premises......Page 213
2.1 No denial of access to normal workspace......Page 214
4.1 Outline arrangements for:......Page 215
Appendix 7: A Document Register......Page 217
Appendix 8: Acronyms and Abbreviations......Page 219
Other Websites......Page 221
Training Services......Page 222
Professional Services and Consultancy......Page 223
Newsletter......Page 224