Table Of ContentB
U
S
I
N BUSINESS
A business continuity management system (BCMS) is a management framework that prepares
E
the organization by developing business continuity strategies to meet its business and statutory S
S
obligations during an incident. It is about optimizing service availability and preserving business
C
performance to secure future growth in the market. O
N CONTINUITY
T
Business Continuity Management System offers a complete guide to establishing a fit- IN
for-purpose business continuity capability in your organization. Structured in line with the U
I
T
principles of ISO 22301 (the International Standard for business continuity management) and
Y
with current best practice, this user-friendly book covers the whole lifecycle of developing, M MANAGEMENT
establishing, operating and evaluating a BCMS initiative. It is aimed at new and seasoned A
N
business continuity practitioners involved in business continuity activities in their organizations, A
G
whatever the size and sector. It includes proven techniques and easy-to-use methodologies
E
that specifically support the implementation of those requirements specified in ISO 22301. M SYSTEM
E
Pragmatic approaches supported by in-depth explanations guide you to assess and improve
N
your organization’s BCMS performance. This is the first book to offer an end-to-end solution T
S
that addresses all aspects of implementing an effective BCMS.
Y
S
T
Wei Ning Zechariah Wong PhD MBCI CBCP is one of the leading experts at the British E
M A COMPLETE GUIDE TO
Standards Institution (UK) and the ASIS (US), where he contributes to the development of
BCMS standards, notably BS 25999, ASIS/BSI BCM.01-2010, ISO 22301 and ISO 22313. IMPLEMENTING ISO 22301
He has extensive experience in designing and implementing business continuity management W
E
systems (BCMS) for organizations across a range of sectors. He is a qualified BCMS lead I
N
auditor and an author for several journals in the areas of business continuity, risk, emergency IN
G
and disaster recovery.
Z
E
C
H
Jianping Shi PhD is a highly experienced business and investment consultant with over A
R
20 years’ experience. She has worked in various sectors, including financial services and IA
H
management consultancies, with a strong background in corporate strategic planning, asset W
O
management, risk and business continuity management. Jianping is a partner of Instramax, N
G
which is an international provider of business continuity services.
&
J
IA
N
P
IN
G
S
H
KoganPage ISBN: 978-0-7494-6911-5 I
London WEI NING ZECHARIAH WONG
Philadelphia
New Delhi
www.koganpage.com & JIANPING SHI
Business and management skills
Business
Continuity
Management
System
Business Continuity
Management
System
A Complete Guide to
Implementing ISO 22301
Wei Ning Zechariah Wong
Jianping Shi
Publisher’s note
Every possible effort has been made to ensure that the information contained in this
book is accurate at the time of going to press, and the publishers and authors cannot
accept responsibility for any errors or omissions, however caused. No responsibility for
loss or damage occasioned to any person acting, or refraining from action, as a result of
the material in this publication can be accepted by the editor, the publisher or any of the
authors.
First published in Great Britain and the United States in 2015 by Kogan Page Limited
Apart from any fair dealing for the purposes of research or private study, or criticism or review,
as permitted under the Copyright, Designs and Patents Act 1988, this publication may only be
reproduced, stored or transmitted, in any form or by any means, with the prior permission in
writing of the publishers, or in the case of reprographic reproduction in accordance with the terms
and licences issued by the CLA. Enquiries concerning reproduction outside these terms should be
sent to the publishers at the undermentioned addresses:
2nd Floor, 45 Gee Street 1518 Walnut Street, Suite 1100 4737/23 Ansari Road
London EC1V 3RS Philadelphia PA 19102 Daryaganj
United Kingdom USA New Delhi 110002
www.koganpage.com India
© Wei Ning Zechariah Wong and Jianping Shi, 2015
The right of Wei Ning Zechariah Wong and Jianping Shi to be identified as the authors of this work
has been asserted by them in accordance with the Copyright, Designs and Patents Act 1988.
ISBN 978 0 7494 6911 5
E-ISBN 978 0 7494 6912 2
British Library Cataloguing-in-Publication Data
A CIP record for this book is available from the British Library.
Library of Congress Cataloging-in-Publication Data
Wong, Wei Ning Zechariah.
Business continuity management system : a complete guide to implementing iso 22301 / Wei
Ning Zechariah Wong, Jianping Shi.
pages cm
ISBN 978-0-7494-6911-5 (paperback) – ISBN 978-0-7494-6912-2 (ebk) 1. Crisis management.
2. Emergency management–Planning. 3. Data protection. 4. Computer networks–Security
measures. I. Shi, Jianping. II. Title.
HD49.W667 2014
658.4’70218--dc23
2014027017
Typeset by Amnet
Print production managed by Jellyfish
Printed and bound by CPI Group (UK) Ltd, Croydon, CR0 4YY
In memory of my beloved father
— JS
CONTENTS
Abbreviations xi
List of tables xiii
List of figures xv
Introduction 1
01 Fundamentals of business continuity management 5
Background 5
What is business continuity management? 6
The principles of business continuity management 7
Application of business continuity management in
corporate setting 9
Business continuity management lifecycle 12
Summary 24
References 25
Further reading 26
02 Business continuity management system 27
Background 27
What is a management system? 28
Levels of application 29
ISO 22301 – business continuity management system 30
Key components of business continuity management
system 32
The Plan-Do-Check-Act (PDCA) paradigm 36
Business continuity management system lifecycle 38
Summary 44
Further reading 45
viii Contents
03 Context of the organization 47
Background 47
Understanding the organizational context 48
Basic concepts: The organization and its environment 48
Organizational context analysis 49
Corporate analysis 50
Threat and resilience assessment 52
Stakeholder and regulatory analysis 53
Organizational BCMS scoping 59
Outsourced functions and services 66
Summary 67
Further reading 68
04 Leadership 69
Background 69
Management commitment 70
Business continuity champion 73
Business continuity policy 75
Summary 84
References 85
Further reading 86
05 Planning 87
Background 87
Approaches to corporate resilience 88
Management approach 88
Process-centric approach 90
Business continuity objectives 93
Business continuity objective development 94
BCMS project management 99
Summary 105
Further reading 105
06 Support 107
Background 107
Resource allocation 108
Contents ix
Practices of BCM professionals 109
The professional practices 109
Skills of BCM professionals 110
Performance appraisal 112
Business continuity awareness and training programme 116
Principles of communication 128
BCMS documentation management 131
Principles of documentation management 133
Summary 137
References 139
Further reading 139
07 Operation 141
Background 141
Understanding the organization 142
Characteristics of business impact analysis 143
Characteristics of risk assessment 164
Strategy selection and development 174
Establish business continuity capability 183
Incident management structure 184
Exercise business continuity capability 196
Summary 215
Further reading 218
08 Performance evaluation 219
Background 219
BCMS performance assessment 220
BCMS evaluation criteria 220
Approaches to performance evaluation 222
Management review 242
Summary 244
Further reading 246
09 Improvement 247
Background 247
BCMS control system 248
