GB/T 30146-2023Security and resilience - Business continuity management systems - Requirements (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules for Standardization Documents" drafting.

This document replaces GB/T 30146-2013 "Requirements for Business Continuity Management System for Security and Resilience". Compared with GB/T 30146-2013, except for structural adjustment and editorial changes, the main technical changes are as follows:

--- Changed the scope (see Chapter 1, Chapter 1 of the 2013 edition);

--- Deleted some terms and definitions (see 3.4, 3.5, 3.7, 3.12, 3.14, 3.17, 3.18, 3.20, 3.22, 3.23, 3.25, 3.26, 3.28, 3.30, 3.36, 3.37, 3.39, 3.43~3.45, 3.49~3.52, 3.54, 3.55);

--- Added the terms "interruption" and "impact" (see 3.10, 3.13);

--- Deleted "management commitment" (see 5.2 of the 2013 edition);

--- Added "planning for business continuity management system changes" (see 6.3);

---Changed the relevant content of "communication" (see 7.4, 7.4 of the 2013 version);

--- Change "archived information" to "documented information" (see 7.5, 7.5 of the 2013 edition);

--- Change "implementation" to "operation" (see Chapter 8, Chapter 8 of the 2013 edition);

---Changed the relevant content of "business continuity strategy" (see 8.3, 8.3 of the 2013 edition);

--- Added "business continuity documents and capability evaluation" (see 8.6);

---Change "performance evaluation" to "performance evaluation" (see Chapter 9, Chapter 9 of the 2013 edition);

--- Changed the relevant content of "monitoring, measurement, analysis and evaluation" (see 9.1, 9.1.1 of the 2013 edition);

--- Deleted the "evaluation of business continuity procedures" (see 9.1.2 of the 2013 edition);

--- Added "audit program" (see 9.2.2);

--- Changed the relevant content of "management review" (see 9.3, 9.3 of the 2013 version);

--- Changed the relevant content of "continuous improvement" (see 10.2, 10.2 of the 2013 edition).

This document is equivalent to ISO 22301:2019 "Requirements for Business Continuity Management System for Security and Resilience" (English version).

The release status of previous versions of this document and the documents it replaces are as follows:

---First published as GB/T 30146-2013 in 2013;

--- This is the first revision.

Introduction

0.1 General

This document presents the structure and requirements for implementing and maintaining a Business Continuity Management System (BCMS), which establishes business continuity and organizational Appropriate to the amount and type of impact that may or may not be acceptable after a disruption occurs.

The results of maintaining a BCMS depend on the laws and regulations of the organization's environment, organizational and industry requirements, the products and services offered, the adopted process, size and structure of the organization, and interested party requirements. BCMS emphasizes the importance of.

---Understanding the needs of the organization and the need to formulate business continuity policies and objectives;

--- Operate and maintain the process, capability and response framework to ensure that the organization withstands disruption;

--- Monitor and review the performance and effectiveness of the business continuity management system;

--- Continuous improvement based on qualitative and quantitative measurements. Like other management systems, BCMS includes the following components.

a) Policy;

b) Personnel with clear responsibilities and corresponding capabilities;

c) management processes involving.

1) Policy;

2) Planning;

3) implementation and operation;

4) Performance evaluation;

5) Management review;

6) Continuous improvement.

d) documented information to support operational control and performance evaluation.

0.2 Benefits of a business continuity management system

The goal of a BCMS is to prepare, provide and maintain an organization's overall ability to continue operating during a disruption. To achieve this goal, the group To weave.

a) From a business perspective.

1) support its strategic objectives;

2) Build a competitive advantage;

3) protect and enhance its reputation and credibility;

4) Promotes organizational resilience.

b) From a financial point of view.

1) Reduce legal and financial risks;

2) Reduce direct and indirect disruption costs.

c) From the perspective of interested parties.

1) protection of life, property and the environment;

2) take into account the expectations of interested parties;

3) Increase confidence in the organization's ability to succeed.

d) From an internal process perspective.

1) Improve the organization's ability to remain effective during business disruptions;

2) Demonstrate effective and efficient proactive risk control;

3) Solve the operational vulnerability.

0.3 Plan-implement-check-improve cycle

This document uses the planning (establish), implement (execute and operate), check (monitor and review) and improve (maintain and improve) (PDCA) cycle To establish, maintain and continuously improve the effectiveness of the organization's BCMS.

This ensures compliance with other management bodies such as ISO 9001, ISO 14001, ISO /IEC 20000-1, ISO /IEC 27001 and ISO 28000 It provides a certain degree of consistency with system standards, thus supporting the consistent and integrated implementation and operation of related management systems.

According to the PDCA cycle, Chapters 4 to 10 include the following:

---Chapter 4 introduces the necessary requirements for the organization to establish the BCMS environment, needs, requirements and scope;

---Chapter 5 summarizes the requirements for the role of top management in the business continuity management system, and how the leadership adopts the policy statement Articulate its expectations to the organization;

---Chapter 6 describes the requirements for formulating the strategic objectives and guiding principles of the entire BCMS;

---Chapter 7 supports the operation of the BCMS, while recording, controlling, maintaining and retaining the required documented information, establishes the ability to define Establish communication with relevant parties regularly/as needed;

---Chapter 8 defines the business continuity requirements, determines how to address these requirements, and develops the management organization during the interruption program;

---Chapter 9 summarizes the requirements for measuring business continuity performance, compliance of BCMS with this document, and management review;

---Chapter 10 identifies and corrects nonconformities of the BCMS, and continues to improve by taking corrective actions.

0.4 Contents of this document

This document complies with the requirements of the ISO management system standard. These requirements include high-level architecture, the same core content, and having core concepts A generic term intended to benefit users implementing multiple ISO management system standards.

This document does not include requirements specific to other management systems, although elements of this document can be kept in line with those of other management systems. consistent or integrated.

This document contains requirements that organizations can use to implement a BCMS and assess compliance. Organizations can demonstrate compliance with this document by.

--- Make self-determination and self-declaration;

--- Seek confirmation of conformity from parties having an interest in the organization (such as customers);

--- Seek confirmation of its self-declaration from a party outside the organization;

--- Seeking certification/registration of its BCMS by external organizations.

Chapters 1 to 3 of this document set forth the scope, normative references, and terms and definitions applicable to the use of this document.

Clauses 4 to 10 contain the requirements used to assess compliance with this document. This document uses the following auxiliary verbs.

a) "shall" means a requirement;

b) "should" means a recommendation;

c) "may" means permission;

d) "Can" means possibility or ability.

Information marked "Note" is used to guide understanding or clarify related requirements. "Notes" used in Chapter 3 provide additional information, which may contain provisions relating to the use of the term.

1 Scope

This document specifies the requirements for implementing, maintaining and improving the management system in order to prevent and reduce the possibility of interruption events and to prepare for interruptions. Prepare, respond and recover from it.

All requirements specified in this document are general and applicable to organizations or their constituent parts of all types, sizes and characteristics. these requirements The scope of applicability depends on the operating environment and complexity of the organization.

This document is applicable to organizations of all types and sizes with the following needs.

a) implement, maintain and improve the BCMS;

b) ensure compliance with the organization's stated business continuity policy;

c) need to be able to continuously deliver products and services at an acceptable scheduled capacity during the interruption;

d) Attempt to enhance the resilience of BCMS through effective use.

This document can be used to assess an organization's ability to meet its own business continuity needs and responsibilities.

2 Normative references

The contents of the following documents constitute the essential provisions of this document through normative references in the text. Among them, dated references For documents, only the version corresponding to the date is applicable to this document; for undated reference documents, the latest version (including all amendments) is applicable to this document.

3 Terms and Definitions

The terms and definitions defined in ISO 22300 and the following apply to this document.