| Business
continuity management (ISO)
Information security aspects of business continuity
management
This category's objectiuve is to ensure timely resumption
from, and if possible prevention of, interruptions to
business activities and processes caused by failures of information
systems.
Authorities: ISO-27002:2005 14.; HIPAA
164.308(a)(7); JCAHO-IM:2004 2.20; PCI/DSS:2005 12.8.3
Including information security in the business continuity
management process • A managed process
should be developed and maintained for business continuity
throughout the organization, that includes information
security requirements needed for the organization's business
continuity. Control includes:
- identification of information assets involved in critical
business processes;
- a risk assessment that addresses likely causes and consequences
of information system failures;
- identification and consideration of preventive and
mitigating controls in light of these risks;
- identification of sufficient financial, technical
and human resources to address the preventive/mitigating
control requirements;
- development and documentation of business continuity
plans and processes, including assignment of responsibilities
and incorporation into the organization's general processes
and structure; and
- regular testing and updating of business continuity plans
and processes.
Authorities: ISO-27002:2005 14.1.1.; HIPAA
164.308(a)(7)(i);
Business continuity and risk assessment •
Events that can cause interruptions to business processes
should be identified, along with the probability and impact
of such interruptions and their consequences for information
security. Control includes:
-
identification of all significant risk/risk categories,
including the probability and probable impact on operations
in terms of scale, likely damage and recovery period;
-
full involvement of owners of significant organizational
assets in the assessment process;
-
identification of acceptable and unacceptable losses
and interruptions; and
-
formal documentation of the assessment's results,
and a plan for regular updating to ensure completeness
and currency (see next).
Authorities: ISO-27002:2005 14.1.2.; HIPAA
164.308(a)(7)(ii)(E);
Developing and implementing continuity plans including
information security • Business continuity
plans should be developed and implemented to maintain or restore
operations and ensure availability of information at the required
level and in the required time, following interruptions to
or failures of business processes. Control includes:
- identification of and agreement on all responsibilities
and operational procedures;
- specification of the disaster recovery/business continuity
procedures to effect recovery and restoration of business
processes;
- a data backup plan to ensure recovery of all data following
process restoration, including the ability to replicate
exact copies of data in its state prior to disruption of
operations;
- specification of alternative operational procedures to
follow pending completion of recovery and restoration, including
methods for accessing all critical data;
- documentation of the above plan elements;
- appropriate education and awareness efforts for staff
on the plan elements;
- testing and updating of the plan.
Authorities: ISO-27002:2005 14.1.3.; HIPAA
164.308(a)(7)(ii)(A-C); HIPAA
164.312(a)(2)(ii)
Business continuity planning framework •
A single framework of business continuity plans should be
maintained to ensure that all plans are consistent, consistently
assess information security requirements, and to identify
priorities for testing and maintenance. Control includes:
-
specification of conditions and criteria for activating
the plan; and
-
formal assignment of responsibilities for making assessments
about plan activation, choices among emergency procedures
and processes, resumption procedures, etc.
Authorities: ISO-27002:2005 14.1.4.; HIPAA
164.308(a)(7)(i)
Testing, maintaining and re-assessing
business continuity plans • Business continuity
plans should be tested and updated regularly to ensure that
they are up to date and effective. Control includes:
- testing that assures that all persons with significant
responsibilities under the plan(s) are aware of and competent
to perform them;
- a range and frequency of testing exercises, from table-top
to complete rehearsals, performed as necessary to ensure
awareness and competence; and
- regular reviews and updating of the plan(s) in light of
testing results.
Authorities: ISO-27002:2005 14.1.5.; HIPAA
164.308(a)(7)(ii)(D)
See also:
Last modified:
24-Jul-2006
[RC]
|
