ISO/TS 22318:2015 社会的セキュリティ—事業継続管理システム—サプライチェーン継続のためのガイドライン | ページ 6

3.1.1

事業継続性

破壊的なインシデントの後、許容可能な事前定義されたレベルで製品またはサービスの提供を継続する組織の能力

[出典: ISO 22300:2012, 2.1.10]

3.1.2

ビジネスインパクト分析

活動を分析するプロセスと、ビジネスの混乱が活動に与える可能性のある影響

[出典: ISO 22300:2012, 2.2.6]

3.1.3

イベント

特定の一連の状況の発生または変化

注記 1事象は 1 回以上の発生であり、いくつかの原因が考えられる。

注記2:出来事は、起こっていないことから成り立つことがある。

注記 3:出来事は、「事件」または「事故」と呼ばれることがある。

注記4結果のない事象は、「ニアミス」、「インシデント」、「ニアヒット」または「ヒヤリハット」と呼ばれることもあります。

[出典: ISO 22300:2012, 2.1.8]

3.1.4

エクササイズ

組織内のパフォーマンスをトレーニング、評価、実践、および改善するためのプロセス

注記1:演習は、ポリシー、計画、手順、トレーニング、設備、および組織間の協定の検証、役割と責任における担当者の明確化とトレーニング、組織間の調整とコミュニケーションの改善、リソースのギャップの特定、個人のパフォーマンスの改善、および特定のために使用できます。改善の機会、および即興を練習する管理された機会。

注記2：テストは、計画されている演習の目標または目的の中に合格または不合格の要素の期待を組み込んだ、ユニークで特定の種類の演習です。

[出典: ISO 22300:2012, 2.4.8]

3.1.5

インシデント

混乱、損失、緊急事態または危機である可能性がある、またはそれらにつながる可能性のある状況

[出典: ISO 22300:2012, 2.1.15]

3.1.6

相互扶助協定

相互に支援を提供するために、2 つ以上のエンティティ間で事前に取り決められた理解

[出典: ISO 22300:2012, 2.2.13]

3.1.7

優先活動

影響を軽減するためにインシデント後に優先する必要がある活動

注記 1:このグループ内の活動を表すために一般的に使用される用語には、クリティカル、エッセンシャル、バイタル、緊急、および鍵が含まれます。

[出典: ISO 22300:2012, 2.3.5]

3.1.8

危険

目標に対する不確実性の影響

注記 1効果とは、期待値からの逸脱である: ポジティブおよび/またはネガティブ。

注記 2:目標は、さまざまな側面 (財務、健康と安全、および環境の目標など) を持つことができ、さまざまなレベル (戦略、組織全体、プロジェクト、製品、およびプロセスなど) で適用できます。

注記 3:リスクは、多くの場合、潜在的な事象、結果、またはこれらの組み合わせへの言及によって特徴付けられます。

注記 4:リスクは、多くの場合、事象 (状況の変化を含む) の結果と関連する発生可能性の組み合わせで表現されます。

注記 5不確実性とは，事象，その結果又は可能性に関連する情報，理解又は知識が部分的にでも不足している状態である。

[出典: ISO 22300:2012, 2.1.5]

3.1.9

トップマネジメント

組織を最高レベルで指揮し、管理する人または人々のグループ

注記1:トップマネジメントは、組織内で権限を委譲し、リソースを提供する権限を持っています。

注記2組織は，この目的のために，マネジメントシステムの実施の範囲を参照することによって識別することができる。

[出典: ISO 22300:2012, 2.2.4]

3.2.1

activity

process or set of processes undertaken by an organization (or on its behalf) that produces or supports one or more products and services

[SOURCE: ISO 22301:2012, 3.1]

3.2.2

business continuity management

holistic management process that identifies potential threats to an organization and the impacts to business operations those threats, if realized, might cause, and which provides a framework for building organizational resilience with the capability of an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities

[SOURCE: ISO 22301:2012, 3.4]

3.2.3

business continuity management system

BCMS

part of the overall management system that establishes, implements, operates, monitors, reviews, maintains and improves business continuity

Note 1 to entry: The management system includes organizational structure, policies, planning activities, responsibilities, procedures, processes and resources.

[SOURCE: ISO 22301:2012, 3.5]

3.2.4

business continuity plan

documented procedures that guide organizations to respond, recover, resume, and restore to a pre-defined level of operation following disruption

Note 1 to entry: Typically, this covers resources, services and activities required to ensure the continuity of critical business functions.

[SOURCE: ISO 22301:2012, 3.6]

3.2.5

business continuity programme

ongoing management and governance process supported by top management and appropriately resourced to implement and maintain business continuity management

[SOURCE: ISO 22301:2012, 3.7]

3.2.6

interested party

stakeholder

person or organization that can affect, be affected by, or perceive themselves to be affected by a decision or activity

Note 1 to entry: This can be an individual or group that has an interest in any decision or activity of an organization.

[SOURCE: ISO 22301:2012, 3.21]

3.2.7

minimum business continuity objective

MBCO

minimum level of services and/or products that is acceptable to the organization to achieve its business objectives during a disruption

[SOURCE: ISO 22301:2012, 3.28]

3.2.8

organization

person or group of people that has its own functions with responsibilities, authorities and relationships to achieve its objectives

Note 1 to entry: The concept of organization includes, but is not limited to, sole-trader, company, corporation, firm, enterprise, authority, partnership, charity or institution, or part or combination thereof, whether incorporated or not, public or private.

Note 2 to entry: For organizations with more than one operating unit, a single operating unit can be defined as an organization.

[SOURCE: ISO 22301:2012, 3.33]

3.2.9

outsource

make an arrangement where an external organization performs part of an organization’s function or process

Note 1 to entry: An external organization is outside the scope of the management system, although the outsourced function or process is within the scope.

[SOURCE: ISO 22301:2012, 3.34]

3.2.10

products and services

beneficial outcomes provided by an organization to its customers, recipients and interested parties, e.g. manufactured items, car insurance and community nursing

[SOURCE: ISO 22301:2012, 3.41]

3.2.11

recovery time objective

RTO

Note 1 to entry: For products, services and activities, the recovery time objective must be less than the time it would take for the adverse impacts that would arise as a result of not providing a product/service or performing an activity to become unacceptable.

[SOURCE: ISO 22301:2012, 3.45]

3.2.12

resources

all assets, people, skills, information, technology (including plant and equipment), premises, and supplies and information (whether electronic or not) that an organization has to have available to use, when needed, in order to operate and meet its objective

[SOURCE: ISO 22301:2012, 3.47]

3.3.1

critical customer

individual or entity, the loss of whose business would threaten the survival of the organization

3.3.2

critical supplier

provider of critical products or services

Note 1 to entry: This includes an “internal supplier”, who is part of the same organization as its customer.

3.3.3

critical products or services

resources obtained from a supplier which, if unavailable, would disrupt the organization’s critical activities and threaten the survival of the organization

Note 1 to entry: Critical products or services are essential resources to support an organization’s high priority activities and processes identified in its BIA.

3.3.4

disruption

event, whether anticipated (e.g. a labour strike or hurricane) or unanticipated (e.g. a blackout or earthquake), which causes an unplanned, negative deviation from the expected delivery of products or services according to the organization’s objectives

3.3.5

supply chain

network of organizations that are involved, through upstream and downstream linkages, in the processes and activities that produce value in the form of products and services in the hands of the ultimate consumer

3.3.6

supply chain continuity management

SCCM

application of business continuity management to a supply chain

Note 1 to entry: BCM should be applied to all the tiers of an organization’s supply chain.

Note 2 to entry: In practice, an organization usually would only apply it to the first tier of their suppliers and influence critical suppliers to apply SCCM to their suppliers.

3.3.7

Tier 1 supplier

directly supplies products or services to the organization usually through a contractual arrangement

3.3.8

Tier 2 supplier

provides products or services to an organization indirectly and through a Tier 1 supplier