Standards for Business Continuity Planning

The development of standards/regulation/regulatory guidance for business continuity management is a relatively new concept. Below we present information on some emerging and existing standards that may help you in the formulation of your business continuity plan.

ASIS Online has begun work to produce a Business Continuity Management (BCM) standard, for approval by ANSI. (Item #1)   This case study focusing on BS 25999 shows how standards can help your business. (Item #2)   BC program to meet the requirements of either the BS 25999 or the NFPA 1600 standards is an effective way to ensure that your program will have world class potential. (Item #3)  

How long the U.S. and other countries with non-mandatory business continuity management standards will be able to voluntarily comply is up to market forces. (Item #4)   Not exactly a standard, OSHA says, but guidance on planning for a pandemic. (Item #5)   GLBA applies specifically to financial institutions, but its provisions already have been adopted by many types of companies in the private sector. (Item #6)  

As always, we look forward to hearing your comments & insights regarding business continuity. If you have a topic you'd like us to cover, email me at bmellinger@attainium.net.

Bob Mellinger, President
Attainium Corp

1. Business Continuity Management Standard (200X)

The standard will include auditable criteria for preparedness, crisis management, business and operational continuity and disaster management. Standard will utilize a management systems process approach using the Plan-Do-Check-Act (PDCA) model and will be based on the BS 25999 standard (Part 1 - Code of Practice; Part 2 - Specification).
http://www.asisonline.org/guidelines/committees/bcm_std.htm
Download a copy of the ASIS Organizational Resilience Standard 2009 here:
http://www.asisonline.org/guidelines/ASIS_SPC.1-2009_Item_No._1842.pdf

2. Can Business Continuity Standards Help Your Business?

This case study on Repligen, a pharmaceutical company, takes a close look at the benefits and costs of applying business continuity and disaster recovery standards through a certified program. When the company heard about the business continuity certification standard from the British Standards Institute (BSI) Management Group called BS 25999 standard that not only offered a framework of practices to hang its policies on, but also a certification to provide customers with external validation, Repligen jumped to action.
http://www.baselinemag.com/c/a/Infrastructure/Can-Business-Continuity-Standards-Help-Your-Business/

3. Business Continuity Standards… a comparison of the National Fire Protection Association's NFPA 1600 and the British Standards Institution's BS 25999-1

The National Fire Protection Association (NFPA) and the British Standards Institution (BSI) have both published standards on BC planning. The BSI's, Business Continuity Management - Part 1: Code of Practice (BS 25999-1:2006) and the NFPA's Standard on Disaster/Emergency Management and Business Continuity Programs (NFPA 1600: 2007 Edition) both establish basic elements of business continuity planning and were developed in conjunction with many representatives within the BC community.
http://www.riskinternational.com/Articles/Business%20Continuity%20Standards.pdf

4. Are mandatory business continuity management standards good business?

While the issue of disaster recovery and business continuity management (BCM) standards is in a state of flux in the U.S., in other countries it's a fact of life. For example, countries such as the United Kingdom and Singapore have national standards and even legislation that supports BC. Many other nations have standards, and in this article we'll examine some of the well-established ones. The International Organization for Standardization (ISO) also is addressing business continuity, and could forge the basis for a global standard.
http://searchcompliance.techtarget.com/tip/0,289483,sid195_gci1366924,00.html

5. Guidance on Preparing Workplaces for an Influenza Pandemic

The Occupational Safety and Health Administration (OSHA) developed this pandemic influenza planning guidance based upon traditional infection control and industrial hygiene practices. It is important to note that there is currently no pandemic; thus, this guidance is intended for planning purposes and is not specific to a particular viral strain.
http://www.osha.gov/Publications/OSHA3327pandemic.pdf

6. Gramm-Leach-Bliley Act

The GLBA provisions are intended to protect consumers' personal financial information held by financial institutions. The Act also dictates that institutions should take measures to protect against destruction, loss, or damage of customer information due to potential environmental hazards, such as fire and water damage or technological failures. Applies to all US financial institutions (banks, securities firms, and insurance companies, also companies providing many other types of financial products and services to consumers).
http://en.wikipedia.org/wiki/Gramm%E2%80%93Leach%E2%80%93Bliley_Act