Manager's Guide to BS25999: A Practical Guide to Developing and Implementing a Business Continuity Management System

Business continuity is something of a mystery to a great many people involved in running organisations today. The majority are not actually required either by law or by anybody else to demonstrate any form of business continuity arrangements and so business continuity management (BCM) has not, until recently, been seen as a priority for these organisations. But the world is changing. The seemingly greater number of threats to organisations' ability to continue doing what they do and the increasingly sophisticated approaches to corporate governance, risk management and corporate and social responsibility are all helping to fuel the growing need for organisations to demonstrate and provide assurance that should some interruptive incident occur, they have done everything reasonable to minimise disruption to the continued supply of products or services, in which they are engaged.The increasing levels of competition not only in the UK and Europe, but from around the world mean that in the commercial world letting customers down as a result of what would have previously been seen as 'not your fault', carries increasingly higher penalties as business can often be lost for good. Before the introduction of BS 25999 it was arguably not worth while for organisations to invest in a BCM programme. Although we have yet to see an international standard (ISO) for business continuity management, there is every reason to believe that the principles of BS 25999 will be largely reflected in the eventual ISO, whenever it emerges. It is likely to take at least 12 months for most organisations to develop and implement a worthwhile BCM system and with today's competitive pressures the only really sensible path is to have implemented such a system before it is formally demanded by customers, regulators or even the law.As with British and international standards in many other management disciplines, BS 25999 is the only benchmark by which others can judge that an organisation's BCM arrangements are fit for purpose.

Table of Contents:
Introduction Chapter 1: Introducing business continuity management What is business continuity management? BCM policy Chapter 2: Overview of the BCM process BCM life cycle and importance of all its elements Programme management Chapter 3: Understanding the organisation Business impact analysis Risk identification, assessment and management Chapter 4: Determining BC strategyIT Disaster Recovery People The rest of the resource spectrum Chapter 5: Developing the BCM response The incident response structure Triggering the BCM response - activation Business continuity planning Chapter 6: Exercising, maintenance and review Exercises Maintenance and review The BCMS Continuous improvement Chapter 7: Embedding BCM in the organisation's culture Making business continuity effective Chapter 8: Document management and control Reliability Usability Version control Document history Security Chapter 9: Reporting and assurance Corporate governance Supplier assurance Due diligence Chapter 10: Certification System compliance BCMS implementation Certification Certification bodies Chapter 11: Standards and codes of practice The Combined Code on Corporate Governance (UK) Turnbull Sarbanes-Oxley Basel II BS25777 ISO27001 Bibliography Appendix 1: A BCM policy Appendix 2: BCM competencies Appendix 3: A risk register Appendix 4: A crisis management team Appendix 5: A communication cascade Appendix 6: Document templates Appendix 7: A document register Appendix 8: Acronyms & abbreviations ITG resources

About the Author :
Tony Drewitt is a business continuity practitioner and a professional member of the Business Continuity Institute (BCI). He has been a practising consultant in the field of operational risk management and business continuity management (BCM) since 2001, working with a wide range of small, medium and large organisations to develop BCM policies, strategies and plans.Tony started his career as a mechanical engineer in industry and has held a range of posts in sales and marketing, general management and management consulting. He was a guest lecturer on BCM on Cranfield University's international security management course at the UK Defence Academy in Shrivenham, Wiltshire in 2003, and is currently working with a number of clients in achieving certification under BS25999.Tony is the author of the already successful ITG publication BS25999: A Pocket Guide.