Business Continuity Standards and Laws

We've all seen it happen... a disaster occurs and some businesses make it through but some don't. If your business continuity and disaster recovery plans are aligned with a standard, you're more likely to be among the survivors. This week, we're looking at some existing standards and the legal issues of which you should be aware.

Many laws define minimum requirements for business continuity; here are some you should know about. (Item #1)   The legal issues involved in corporate contingency planning are some of the most misunderstood and confusing aspects of the entire process of creating a disaster recovery plan. (Item #2)   Here's an overview of US regulations pertaining to business continuity. (Item #3)  

Pages 52-61 of this comprehensive document provide information on US business continuity legislation, regulations, standards and good practices. (Item #4)   ISO 22301 is a management systems standard for BCM which can be used by organizations of all sizes and types. (Item #5)   As a guidance standard, organizations cannot be certified in ISO 27031 like ISO 22301, but the management system follows many of the same steps that experienced preparedness professionals are used to implementing with business continuity planning. (Item #6)  

As always, we look forward to hearing your comments & insights regarding business continuity. If you have a topic you'd like us to cover, email me at [email protected].

Bob Mellinger, President
Attainium Corp

1. Laws & Authorities

Federal, state and local laws and regulations define minimum requirements for emergency management and business continuity. Requirements may apply to industries that are part of our nation's "critical infrastructure." These industries range from financial services to energy. Regulations may require emergency planning, business continuity plans, information technology disaster recovery plans, cyber/information security, physical and operational security and other issues.
http://www.ready.gov/laws-authorities

2. The Legal Issues of Business Continuity Planning

Despite the widespread reporting of disasters and their effects, many companies, corporate directors, and officers remain apathetic toward implementing a business continuity/disaster recovery plan. Many companies are generally unwilling to commit the finances and resources to implement a plan unless forced to do so. However, implementing a business continuity/disaster recovery plan is a strategic, moral, and legal obligation to one's company. If the billions of dollars spent on technology annually to maintain a competitive edge is an indication of how reliant our society is on technology, then failing to implement a disaster recovery plan is an indication of corporate negligence. Standards of care and due diligence are required of all corporations, public or private. Not having a disaster recovery plan violates that fiduciary standard of care.
http://www.rsi-llc.com/leadership/documents/THELEGALISSUESOFBUSINESSCONTINUITYPLANNING.pdf

3. An Overview of U.S. Regulations Pertaining to Business Continuity

Regulatory compliance is a significant factor influencing the development of your business continuity strategy. Moreover, while Business Continuity or Disaster Recovery regulations may not apply in every business situation, a general understanding of legislation governing data integrity, availability and compliance is helpful for any organization developing a Business Continuity strategy.
http://www.geminare.com/pdf/U.S._Regulatory_Compliance_Overview.pdf

4. BCM Legislation, Regulations & Standards

and standards that exist nationally and internationally for Business Continuity Management. It is difficult to provide a definitive list because there are regular changes and amendments at a country level and often inconsistent terminology between countries, sectors and legislators. The document that follows is the most comprehensive that it was possible to produce based upon information provided to us by our members around the world. Where we have country input we have included it alphabetically. At the end of the document we have a page summarizing current and projected international initiatives particularly those supported by the International Standards Organization (ISO) and the Basel Committee on Banking Supervision.
http://www.dcsplanning.com/wp-content/uploads/2012/03/Legislations-Regulations-Standards-Comparison_BCI.pdf

5. Business continuity - ISO 22301 when things go seriously wrong

Contingency planning and disaster recovery were largely information technology-led responses to natural disasters and terrorism that affected businesses during the 1980s and early 1990s. There was a growing recognition, however, that this needed to become a business-led process and encompass preparing for many forms of disruption. In light of this, the discipline became known as business continuity management (BCM).
http://www.iso.org/iso/home/news_index/news_archive/news.htm?refid=Ref1602

6. Using ISO 27031 to Guide IT Disaster Recovery Alignment with ISO 22301

Many organizations struggle to define the best method to meet business expectations regarding information technology (IT) recovery. ISO 27031 provides guidance to business continuity and IT disaster recovery professionals on how to plan for IT continuity and recovery as part of a more comprehensive business continuity management system (BCMS). The standard helps IT personnel identify the requirements for Information and Communication Technology (ICT) and implement strategies to reduce the risk of disruption, as well as recognize, respond to and recover from a disruption to ICT.
http://perspectives.avalution.com/2012/using-iso-27031-to-guide-it-disaster-recovery-alignment-with-iso-22301/