ISO/TS 22331:2018 セキュリティと回復力—事業継続管理システム—事業継続戦略のガイドライン | ページ 2

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, 1. In particular, the different approval criteria needed for the different types of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, 2 (see www.iso.org/directives ).

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents ).

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO’s adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www.iso.org/iso/foreword.html .

This document was prepared by Technical Committee ISO/TC 292, Security and resilience.

Introduction

This document provides detailed guidelines for business continuity strategy determination and selection. It is consistent with the requirements of ISO 22301. It is applicable to the performance of any business continuity strategy determination and selection effort, whether part of a business continuity management system (BCMS) or a business continuity programme. Hereafter, the term “business continuity programme” means either a BCMS or a business continuity programme.

The organization’s business continuity strategy determination and selection should include strategy options for:

• protecting prioritized activities;
• stabilizing, continuing, resuming and recovering prioritized activities;
• mitigating, responding to and managing impacts (see ISO 22301:2012, 8.3).

Figure 1 notes the relationship of the business continuity strategy determination and selection process to the business continuity programme as a whole. The business impact analysis and risk assessment provide the requirements for a range of business continuity strategies. The determination and selection of a business continuity strategy is the basis for the development of effective business continuity procedures.

Business impact analysis identifies the product/service delivery requirements and the prioritized timeframes for activity and resource recovery. The business impact analysis enables the organization to determine the resources needed to perform priority activities (e.g. facilities, people, equipment, information, communication and technology assets, supplies and financing). The business impact analysis also identifies interdependencies between activities and dependencies on supply chains, partners and other interested parties.

The risk assessment identifies, analyses and evaluates the risk of disruption and identifies risk treatment options.

Business continuity strategy addresses the outcomes of the business impact analysis and risk assessment and determines how the organization can become more resilient and capable of dealing with a wide range of disruptive incidents.

The purpose of this document is to provide guidance that will enable organizations to:

• identify a range of business continuity strategy options;
• select appropriate capabilities based on business continuity requirements;
• ensure the ongoing suitability of business continuity strategies;
• coordinate business continuity strategy determination and selection effectively within the overarching business continuity programme.

Business continuity strategy determination and selection outcomes include:

• measures to attempt to decrease the frequency of disruptive incidents and the impact associated with these disruptive incidents;
• identification of the financial resources needed to respond to a disruptive incident;
• effective internal and external communications capabilities;
• alternate workspace capabilities to address the loss or inaccessibility of premises;
• arrangements to address the unavailability of personnel;
• alternative methods of maintaining, fixing and replacing resources for performing activities in the event of loss;
• capabilities to recover lost information and communications technology (ICT) assets, including data;
• alternate means to deliver products and services when faced with a supply chain disruption.

Figure 2 displays the business continuity strategy determination and selection process, together with prerequisites and its relationship to the creation of business continuity procedures.

1 Scope

This document gives guidance for business continuity strategy determination and selection. It is applicable to all organizations regardless of type, size and nature, whether in the private, public or not-for-profit sectors.

It is intended for use by those responsible for, or participating in, strategy determination and selection.

2 Normative references

The following documents are referred to in the text in such a way that some or all of their content constitutes requirements of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

3 Terms and definitions

For the purposes of this document, the terms and definitions given in ISO 22300 and ISO Guide 73 apply.

ISO and IEC maintain terminological databases for use in standardization at the following addresses:

Bibliography