Business continuity management system

Presentation on Business continuity management system (BCMS)

2. Topics to be covered
Introduction
Benefits of BCMS
BCMS objectives and how to achieve them?
Business Impact Analysis
Risk Assessment
Business Continuity Strategies and Solutions
BCMS Performance Evaluation
Case Study

3. ISO22301:2019firstpublishedbytheInternationalOrganizationforStandardization(ISO)in2012
andsecondeditionin2019.
BCMSistheprocessofimplementingandmaintainingbusinesscontinuityplaninordertoprevent
lossandprepareorganizationformitigatingandmanagingdisruption.
EstablishingBCMSenablestheorganizationtocontrol,evaluateandcontinuallyimproveits
businesscontinuitycapabilitytoensurecontinuationofcriticalbusinessprocessintheeventof
disaster
Cyberattacks,databreachesandnatural/manmadedisastersetc.aresomeexamplewhichcan
interruptbusinesscontinuity.
BCMS Introduction

4. Benefits of BCMS
Business
Perspective
•Creating a
competitive
advantage;
•Supporting
Management
strategic
objectives
•Protecting &
enhancing
reputation &
credibility;
•Contributing to
organizational
resilience;
Financial
perspective
•Reducing legal
and financial
exposure;
•Reducing direct
and indirect costs
of disruptions;
Stakeholders
Perspective
•Protecting life,
property and the
environment;
•Considering the
expectations of
interested parties;
•Providing
confidence in the
organization’s
ability to succeed;
Internal processes
Perspective
•Improving its
capability to
remain effective
during
disruptions;
•Demonstrating
proactive control
of risks effectively
and efficiently;

5. BCMS objectives and how to achieve them?
•EstablishingbusinesscontinuityObjectives-Itshallbeconsistentwithbusinessobjectives;itcanbe
measurable;monitored;communicatedtostakeholder
•DetermineBusinesscontinuityobjectives-likewhatwillbedone;resourcesrequired;whowillbe
responsible;actionforviolationtopolicy;howtheresultswillbeevaluated.
•ChangestoBCMS–anychangesshallbecarriedoutinaplannedmanner;thepurposeofsuch
changecommunicatedtoimpactedstakeholder;availabilityofresourcesforchange;allocationand
reallocationofresponsibilitiesandauthorities;Documentationofthesechanges.
•Otherimportantaspectsare–Awareness;Communication;Identificationofcompetentresoruces

6. Business Impact Analysis
•Criticalactivitiesareidentifiedinanorganizationthatsupportsthekeyproductsandservices
•Understandingtheriskofdisruptiononkeyactivities
•Impactsareidentifiedfromdisruptionofthesecriticalactivities;
•Recoveryobjectivesoftheseactivitiesaredefined(priorities,timeframes,capacities,andstrategies
forresumingtheactivity)–alsoreferredasRTO(Recoverytimeobjective)
•Determinewhichresourcesareneededtosupportprioritizedactivities;
•Determineactivitiesthathavedependencyonpartnersorsupplier
•Organizationsneedstoimplement,maintainandkeeprefining/updatingtheirbusinesscontinuity
managementsystem(BCMS)sothattheywillbeeffectiveinallcircumstances.

7. •TheprocessforriskassessmentisaddressedinISO31000
•The organization shall:
a) Identify the risks of disruption to the organization’s
b) Prioritized activities and to their required resources;
c) Analyseand evaluate the identified risks;
d) Determine which risks require treatment.
•Increasethelikelihoodofachievingobjectives,improvetheidentificationofopportunitiesandthreats
andeffectivelyallocateanduseresourcesforrisktreatment.
Risk assessment

8. List the AssetsIdentify the Risk
Natural DisasterSystem FailureAccidental Error
Malicious
Activities
Assess Potential
Consequences
Priorities the
Risk
Document the
Risk
Steps to Risk Assessment Process

9. IMPACT
/
RISK
Reputational
Loss
Business
Downtime
Lost sales or
opportunity
costs
Regulatory
non
compliance
Loss of stake
holder or
investor
confidence
Work
stoppage
& idle
work force
Customer
service
Financial
loss
Employee
Morale/
Retention
Impact/ Risk to an Organisation

10. Actions Planning –Risk Handling Strategy
•Preventivemeasuresreducetheprobabilityoftheevent
•Correctivemeasuresreducetheconsequenceofthe
event
Alter the risk
•Disclaim responsibility in contract; outsourcing etc.
•Insurance coverage
Risk Transfer
•Eliminate by stopping the activityRisk Avoidance
•Continue as before; the activity remains unchanged
(Inherent Risk) –No action requiredRisk Acceptance

11. Probability of Risk -Examples
ScoreOccurrence rate Illustrated examples
1 Once in 10 year or moreMajor earthquake, Tsunami etc
2 Every 5 –10 years Major office closure for longer period due to flooding; Strike
3 Every 1-5 years Major change in Government Policy affecting the
organisation, sudden decline or change in an important
economic sector
4 Almost certainly happen
within next 12 months
Major travel dislocation, permanent loss of key staff, key
company failure, has happened once
5 Probably happen several
times inayear
IT Network failure, theft, temporary loss of key staff

12. Business Continuity Strategies and Solutions
Identification of
strategies
•Recover
prioritized
activities within
the identified
timeframes and
agreed capacity;
•Reduce the
likelihood of
disruption; (eg.
Prevent from fire)
•Shorten the
period of
disruption;
Selection of
strategies
•Consider the
amount and type
of risk the
organization may
or may not take;
•Consider
associated costs
and benefits.
•Limit the impact
of disruption.
Resource
requirements
•people;
information and
data;
•Infrastructure
•Information and
communication
technology
(ICT) systems;
•Transportation
and logistics;
•Finance;
•Partners and
suppliers

13. BCMS Performance review
Monitoring,Measurement,AnalysisofcurrentBCMS
EvaluationofBCMS
InternalAudit/ExternalAudit/Selfreview
Managementreview
Nonconformityandcorrectiveaction
Input/Feedbackfromstakeholders
ContinualImprovementbasisfeedback

14. Case Studies
CaseStudy1:TerroristattackonGlasgowairport
•On30June2007,avehiclewasdeliberatelydrivenintothemainterminalbuildingatGlasgowAirportandset
alight
•Thecrisisteamwasinitiatedandoperationalwithin45minuteswithabusinessrecoveryteamoperationalan
hourlater
•TrafficwasbannedfromtheforecourtareaoftheAirport,around3,500passengerswereevacuatedtoallow
thePolicetointerviewthemaspotentialwitnesses.
•Theirholisticstrategyisbasedaround“7R’s”.
Risk
Resilience
Rehearse
Response
Recovery
Review
Reputation
•Thisenabledtoreopenedtheterminalbuildingin23hours59minutesaftertheattack.
•BusinessContinuityAwardsinMay2008,winningthe“BusinessContinuityRecoveryoftheYear”.

15. Case Studies
CaseStudy2:EarthquakeinJapan-OnJuly16,2007anEarthquakeofmagnitude6.8inJapan
•NTTFACILITIES,INC.whichisasubsidiaryofNipponTelegraphandTelephoneCorporation,managesthe
maintenanceofthepowerandbuildingfacilitiesfortelecommunications.
•Itestablishesabusinesscontinuityplanforcontinuedpowersupply,andconductstheannualexercise,
assumingalarge-scaleearthquake
•Disasterrecoveryteamdeterminedthepriorityforpreparingmobileenginegenerators,consideringthe
batterybackuptime
•Within3hoursafterthemainshock,eighttruck-mountedenginegeneratorsreachedsiteandstaredsupplied
power
•Commercialpowersupplytothebuildingsresumedaftertwodaysofthedisaster
•Nofailureoftelecommunicationsservicesaroseduetoshutdownofpower
•Thisispossibleduetorobustbusinesscontinuityplan,theyconductstheannualexercise,assumingalarge-
scaleearthquakeandpoweroutrage
•Linktoreadmorecasestudies: