Publishing and copyright information

The BSI copyright notice displayed in this document indicates when the document was last issued.

US Edition

The following BSI references relate to the work on this standard:

Committee reference BCM/1
Draft for comment 07/30145272 DC

Publication history

First published November 2007

Foreword

This British Standard was published by BSI and came into effect on so November 2007. It was prepared by Panel BCM/1/-/2, under the authority of Technical Committee BCM/1, Business continuity management. A list of organizations represented on this committee can be obtained on request to its secretary.

This British Standard has been developed by practitioners throughout the business continuity community, drawing upon their academic, technical and practical experiences of business continuity management (BCM). It has been produced to define requirements for a management systems approach to business continuity management based on good practice for use in large, medium and small organizations operating in industrial, commercial, public and voluntary sectors.

BS 25999, Business continuity management, is published in two parts:

Part 1: Code of practice;
Part 2: Specification.

The requirements specified in this British Standard have been developed with due regard for the principles and practices contained within BS25999-1.

This British Standard provides a specification for use by internal and external parties, including certification bodies, to assess the organization’s ability to meet regulatory, customer, and the organization’s own requirements.

This British Standard contains only those requirements that can be objectively audited. Those organizations requiring more general guidance on a broad range of business continuity management issues are referred to BS 25999‑1.

Demonstration of successful implementation of this British Standard can therefore be used by an organization to assure interested parties that an appropriate business continuity management system is in place.

In common with modern management system standards this standard utilizes the Plan-Do-Check-Act (PDCA) cycle for developing, implementing, and improving the effectiveness of an organization’s business continuity management system.

This publication does not purport to include all the necessary provisions of a contract.

Users are responsible for its correct application.

Compliance with a British Standard cannot confer immunity from legal obligations.

Introduction

General

This British Standard specifies requirements for setting up and managing an effective business continuity management system (BCMS).

This emphasizes the importance of:

understanding business continuity needs and the necessity for establishing policy and objectives for business continuity;
implementing and operating controls and measures for managing an organization’s overall business continuity risks;
monitoring and reviewing the performance and effectiveness of the BCMS; and
continual improvement based on objective measurement.

A BCMS, like any other management system, has the following key components:

a policy;
people with defined responsibilities;
management processes relating to:
1. policy;
2. planning;
3. implementation and operation;
4. performance assessment;
5. management review; and
6. improvement;
a set of documentation providing auditable evidence; and
topic specific processes relating to the subject, in this case business continuity, such as business impact analysis (BIA) and business continuity plan development.

1 Scope

This British Standard specifies requirements for planning, establishing, implementing, operating, monitoring, reviewing, exercising, maintaining and improving a documented BCMS within the context of managing an organization’s overall business risks.

The requirements specified in this British Standard are generic and intended to be applicable to all organizations (or parts thereof), regardless of type, size and nature of business. The extent of application of these requirements depends on the organization’s operating environment and complexity.

It is not the intent of this British Standard to imply uniformity in the structure of a BCMS but for an organization to design a BCMS that is appropriate to its needs and that meets its stakeholders’ requirements. These needs are shaped by regulatory, customer and business requirements, the products and services, the processes employed, the size and structure of the organization and the requirements of its stakeholders.

This British Standard can be used by internal and external parties, including certification bodies, to assess an organization’s ability to meet its own business continuity needs, as well as any customer, legal or regulatory needs.

2 Terms and definitions

3 Planning the business continuity management system

3.1 General

3.2 Establishing and managing the BCMS

3.2.1 Scope and objectives of the BCMS

3.2.1.1

The organization shall define the scope of the BCMS and set business continuity objectives, with due regard to the:

requirements for business continuity;
organizational objectives and obligations;
acceptable level of risk;
statutory, regulatory and contractual duties; and
interests of its key stakeholders.

3.2.1.2

The organization shall identify the key products and services within the scope of the BCMS.

3.2.2 BCM policy

3.2.3 Provision of resources

3.2.4 Competency of BCM personnel

3.3 Embedding BCM in the organization’s culture

3.4 BCMS documentation and records

3.4.1 General

3.4.2 Control of BCMS records

3.4.3 Control of BCMS documentation

4 Implementing and operating the BCMS

4.1 Understanding the organization

4.2 Determining business continuity strategy

4.3 Developing and implementing a BCM response

4.4 Exercising, maintaining and reviewing BCM arrangements

5 Monitoring and reviewing the BCMS

5.1 Internal audit

5.2 Management review of the BCMS

6 Maintaining and improving the BCMS

6.1 Preventive and corrective actions

6.2 Continual improvement

Bibliography

BS 25999-2:2007 (USA Edition)

Business continuity management - Specification

Current

Published:

20 Nov 2007