Standards

Business Continuity Forum Support guidance 25999 standards 

The US Commodity Future Trading Commission is proposing to introduce new regulations affecting Business Continuity and Disaster Recovery, based on an expected standard for Designated Contract Markets and the associated Derivative Clearing Organisations. The CFTC has recommended that rule changes be put in place requiring both DCM’s and DCO’s to harden measures that aim to prevent wide scale disruption to Commodity trading arising from an event. 

The latest Standard to the be released titled “AS/NZ5050 - Business Continuity Managing disruption-related risk” comes from Standards Australia and arrived just a few months before the US BCM Standard jointly developed by the BSI and ASIS . 

In an interesting departure from established convention the Australia/New Zealand Standard takes different slant on key aspects of the process and connects far more with with risk management principles than others. The Standard itself declares that “the approach (taken) to managing disruption-related risk described in the Standard is through application of AS/NZS ISO 31000:2009, Risk management—Principles and guidelines.”

BSI British Standard  BS 25777 for Information and Communications Technology continuity management.

Following on from the development of BS25999 BSI has announced a complimentary standard aimed at detailing good practice at the ICT level, BS25777 for ICT Continuity.

ICT continuity management, a key part of the overall business continuity management (BCM) process of an organization, ensures that ICT services are resilient and in the event of disaster, can be recovered within timescales agreed with senior management.

American Standard Body to produce US Standard for Business Continuity

ASIS  based in Virginia has now started the work to develop its American National Standards Institute (ANSI) project to produce a Business Continuity Management (BCM) standard, for approval by ANSI.

Many organisations are dangerously unaware of the risks of not having an IT continuity plan in the event of disaster

Many organisations are operating under the dangerous illusion that they will never suffer a major loss of IT systems, or that such a loss will have a relatively low impact, research from the British Standards Institute has warned.

BSI's Publicly Available Specification (PAS) advisory paper, IT Service Continuity Management Code of Practice (reference 77:2006), paints a grim picture of the potential disaster facing ill-prepared organisations. It cautions that while many firms believe that they have invested in adequate systems resilience, in reality most do not have adequate plans to protect themselves from natural disasters or human error.

Your chance to review and comment on BS25999

The draft stand for the new British Standard BS 25999 titled "Guide of Practice for Business Continuity Management" will commence the public comment stage during early July.

The Standard has been developed from the work of the technical committee formed in August of 2005 and this public consultation on the draft standard marks one of the final steps ahead of the final publication of BS25999 (Part 1).

The public comment stage will last 60 days and once closed all submissions will be reviewed by the committee. There will be a standard form for all submissions on the draft standard which will shortly be available from the BSI. With the degree of interest likely in the draft, and the time required to review all comments the BSI now hopes to publish BS25999-1 in the late Autumn.

Work on Part 2, which importantly establishes the control framework for the standard, will start in July 2006 and the committee expects to publish this in early 2007.

The Continuity Forum will continue working with the BSI committee throughout this period and we'll be running a number of supporting events aimed at helping organizations to understand and manage their transition to the new standard. For more information on this topic please contact us directly.

Outsourcing managing the relationship honestly 

'Force majeure' is written into many contracts, but it is a mistake to treat it as a boilerplate clause. It is vital that definition and terms are spelt out clearly.

Like so many things left to chance, the modest clause of "force majeure" is written into the terms of many IT outsourcing, credit card, lease, insurance and financial contracts, and could be a disaster just waiting to happen.

So what is force majeure, and why is it sometimes overlooked for serious consideration when spelling it out could benefit both the supplier and the customer?

As announced on this website on the 30th June, British Standards Institution has formed a technical committee to commence the development of a British Standard for Business Continuity Management.

The first meeting of the committee will take place on the 23rd August and John Sharp, Policy & Development Director of Continuity Forum, who chaired the team that developed the BSI Guide to BCM, (PAS56), will sit on the committee along with Continutiy Forum Chairman, Russell Price.

Over the next 12 to 18 months the UK has a unique opportunity to build on the foundation of PAS 56, which has sold over 4500 copies worldwide, and create a workable BCM Standard.

As BCM has developed and it becomes more mainstream it has been recognised that some uniformity of approach is required. No organisation is an island, they reply upon suppliers, outsourcers and intermediaries, i.e. their partners, to assist them in delivering their products and services to their clients and customers. These partners serve many organisations across all sectors and they will be called upon to have BCM processes in place by many of their customers.

If the processes comply with a BS BCM Standard then organisations will have greater confidence in their trading partners and the partners will minimise their cost of BCM compliance by using a single certification process.

The creation of a BCM standard raises many questions:

- What form should that standard take and what should be included?

- What, if any, evaluation criteria should used to ensure that an organisation has achieved compliance with the standard?

- How should organisations be certified and audited?

- Can it apply to public sector organisations?

- How do we avoid the standard being for the 'big boys' only and not applicable for the SME market?

- How do we avoid more red tape being imposed on an already pressurised SME management?

The Continuity Forum provides you an opportunity to have your say. By joining in our BCM standards debate you will be able to share with other participants your views and indirectly provide input to the BSI deliberations.

To support this debate we will be holding a number of general face to face meetings addressing issues related to the developing standard. These will commennce in the Autumn after the formal launch of the Standards Committee in August.

We will also be hosting through the Forum Discussion area of this website an on-line group which will facilitate further professional debate and provide an opportunity to share ideas and materials relevant to the profession.

END

If you would like to know more about how your organisation can get involved and benefit from working with the Continuity Forum, please email us HERE! or call on + 44 (0) 208 993 1599.

Business continuity and disaster recovery fundamentals are strong in Singapore because of its: Strategic geographical location - Free from natural disasters such as earthquakes and typhoons, Singapore is well known as a major financial, transportation and infocomm hub, and is home to more than 7,000 multinational corporations. Many use it as a launch pad to expand into the region.