BS 25999-2 specifies requirements for establishing, implementing, operating, monitoring, reviewing, exercising, maintaining and improving a documented Business Continuity Management System (BCMS) within the context of managing an organization’s overall business risks.
The requirements specified in BS 25999-2 are be generic and intended to be applicable to all organizations (or parts there of), regardless of type, size and nature of business. The extent of application of these requirements depends on the organization's operating environment and complexity.
Therefore the design and implementation of a BCMS to meet the requirements of this standard will be influenced by regulatory, customer and business requirements, the products and services, the processes employed and the size and structure of the organization. It will not be the intent of this British Standard to imply uniformity in the structure of a BCMS but for an organization to design a BCMS to be appropriate to its needs and that meets its stakeholder’s requirements.
BS 25999-2 can be used by internal and external parties, including certification bodies, to assess an organization’s ability to meet its own business continuity needs, as well as any customer, legal or regulatory needs.