GB/T 31595-2025Security and resilience - Business continuity management systems - Guidance on the use of GB/T 30146 (English PDF)

0.1 General Provisions

This document is intended to provide guidance for the requirements specified in GB/T 30146, rather than to provide general guidance for all aspects of business continuity.

Although this document contains the same clause headings as GB/T 30146, it does not restate its requirements or related terms and definitions.

This document aims to explain and clarify the meaning and purpose of the requirements in GB/T 30146, and to aid in the understanding of GB/T 30146.This document references...

International and national standards that provide supplementary guidance include GB/T 35625, GB/T 38299, GB/T 40054, ISO 22330, ISO 22331 and GB/T 38209.The scope of these documents may exceed the requirements of GB/T 30146.Therefore, organizations should always refer to...

GB/T 30146 is used to verify the requirements to be met.

The illustrations used in this document are for further clarification and explanation of key points. These illustrations are for illustrative purposes only; please refer to the relevant content first.

See the main text of this document.

Business continuity management systems emphasize the importance of the following aspects.

a) Establish business continuity policies and objectives that are aligned with organizational goals;

b) Operate and maintain processes, capabilities, and response mechanisms to ensure the organization can withstand disruptions;

c) Monitor and review the performance and effectiveness of the business continuity management system;

d) Continuous improvement based on qualitative and quantitative measurements.

The business continuity management system, like other management systems, includes the following components.

a) Policy.

b) Personnel with the corresponding abilities and clearly defined responsibilities.

c) Management processes involving the following.

1) Policy;

2) Planning;

3) Implementation and operation;

4) Performance evaluation;

5) Management review;

6) Continuous improvement.

d) Documented information supporting operational control and performance evaluation.

Business continuity is typically designed for a specific organization; however, its implementation can have profound implications for a wider group and third parties.

An organization is likely to rely on some external organizations, while other organizations will also rely on it. Therefore, effective business continuity helps...

Building a more resilient society.

0.2 Benefits of the Business Continuity Management System

A business continuity management system improves an organization's readiness to continue operating during disruptions and can also enhance its internal and external relationships.

Understand and better communicate with stakeholders to create an environment for continuous improvement. Implement the recommendations in this document and the requirements of GB/T 30146.

A business continuity management system can bring many other benefits.

a) In accordance with Chapter 4 ("Organizational Environment"), the organization.

1) Review its strategic objectives to ensure that the business continuity management system supports these objectives;

2) Reconsider the needs, expectations, and requirements of relevant parties;

3) Understand the applicable laws, regulations and other obligations.

b) In accordance with Chapter 5 ("Leadership"), the organization.

1) Reconsider management roles and responsibilities;

2) Promote the development of a culture of continuous improvement;

3) Assign responsibilities for performance monitoring and reporting.

c) Organize in accordance with Chapter 6 ("Planning").

1) Re-examine its risks and opportunities, and find ways to address and utilize them;

2) Establish effective change management.

d) In accordance with Chapter 7 ("Support"), organize.

1) Establish effective management of resources for the business continuity management system, including capability management;

2) Enhance employees' awareness of important management matters;

3) It has effective internal and external communication mechanisms;

4) Effective document management.

e) In accordance with Chapter 8 ("Operation"), the organization needs to consider.

1) Unexpected consequences of change;

2) Business continuity priorities and requirements;

3) Dependency relationships;

4) View vulnerability from the perspective of its impact;

5) Identify the risk of disruption and determine the best response method;

6) Alternative solutions for business operations under resource constraints;

7) Effective structures and procedures for handling disturbances;

8) Responsibilities to society and other stakeholders.

f) In accordance with Chapter 9 ("Performance Evaluation"), the organization.

1) It has an effective monitoring, measurement, and performance evaluation mechanism;

2) Managers participate in monitoring the performance of the business continuity management system and contribute to its effectiveness.

g) In accordance with Chapter 10 ("Improvements"), organize.

1) It has procedures for monitoring performance and improving effectiveness;

2) Benefiting from continuous improvement of the management system.

Therefore, implementing a business continuity management system can.

a) Protect life, assets, and the environment;

b) Protect and enhance the organization's reputation and credibility;

c) Enabling it to operate during periods of disruption helps enhance the organization's competitive advantage;

d) Reduce costs associated with disruptions and improve the organization's ability to remain effective during disruptions;

e) It contributes to building overall organizational resilience;

f) It helps stakeholders have greater confidence in the organization's success;

g) Reduce the organization's legal and financial risks;

h) Demonstrate the organization's ability to manage risks and address operational vulnerabilities.

0.3 Plan-Do-Check-Act (PDCA) Cycle

This document applies the Plan-Do-Check-Act (PDCA) cycle to plan, establish, implement, operate, monitor, review, and maintain.

And to continuously improve the effectiveness of the organization's business continuity management system. See Table 1 for an explanation of the PDCA cycle.

Figure 1 illustrates how a business continuity management system takes the business continuity requirements of stakeholders as input and implements necessary measures and...

The process produces business continuity outcomes that meet these requirements (i.e., controlled business continuity).

Table 1.PDCA Cycle Explanation

plan

(Establish)

Establish and improve business continuity policies, objectives, processes, and procedures, and align them with the organization's overall policies and objectives.

Consistent

Implementation

(Execution and operation) Implementing and operating business continuity policies, processes, and procedures examine (Monitoring and review) Performance is monitored and reviewed in accordance with business continuity policies and objectives, and the results are reported to management for review, identification, and...

Authorization to take remedial and improvement measures improve (Maintain and improve) Based on the results of the management review and a reassessment of the scope, policy, and objectives of the business continuity management system, the following measures were adopted.

Take corrective actions to maintain and continuously improve the business continuity management system.

Figure 1.PDCA cycle applied to business continuity management system processes.

0.4 Components of PDCA in this document

The correspondence between the chapters and the content of Figure 1 in this document is shown in Table 2.

Table 2.Correspondence between the PDCA cycle and Chapters 4-10

PDCA Components and Corresponding Chapters plan (Establish) Chapter 4 ("Organizational Context") discusses how an organization meets the requirements of a business continuity management system, taking into account all relevant internal and external factors.

Elements, including.

---Needs and expectations of stakeholders;

---Legal and regulatory obligations;

---Scope of Business Continuity Management System Requirements Chapter 5 ("Leadership"), The Key Role of Managers in Demonstrating Commitment, Defining Policy, and Assigning Roles and Responsibilities Chapter 6 ("Planning") outlines measures to establish strategic objectives and guiding principles for implementing a business continuity management system.

Chapter 7 ("Support") outlines the elements required to support a business continuity management system, namely resources, capabilities, awareness, communication, and written information.

Implementation

(Implementation and Operation) Chapter 8 ("Operations"), The Process of Establishing and Maintaining Business Continuity examine (Monitoring and review) Chapter 9 ("Performance Evaluation") provides a foundation for improving the business continuity management system through performance measurement and evaluation.

improve

(Maintain and improve) Chapter 10 ("Improvement") addresses corrective actions for nonconformities identified through performance appraisals.

0.5 Contents of this document

The purpose of this document is not to establish a unified business continuity management architecture, but rather to help organizations design architectures that suit their specific needs and meet their requirements.

A business continuity management system that meets the requirements of relevant parties. These requirements are dictated by laws, regulations, organizational and industry requirements, products and services, and the systems adopted.

It consists of processes, operating environment, organizational size and structure, and requirements of stakeholders.

This document cannot be used to assess whether an organization's capabilities meet its business continuity requirements, nor can it be used to assess whether it meets its customer, legal, or other requirements.

Legal and regulatory requirements. Organizations with this requirement may use GB/T 30146.

Chapters 1 through 3 define the scope, normative references, and terms and definitions applicable to this document. Chapter 4...

Chapter 10 contains usage guidelines for the requirements in GB/T 30146.

This document uses the following auxiliary verbs.

a) "" indicates a suggestion;

b) "" indicates permission;

c) "" indicates a possibility or ability.

0.6 Business Continuity

Business continuity is the ability of an organization to deliver products or services continuously at a predefined, acceptable level after a disruption has occurred.

Business continuity management is the process of implementing and maintaining business continuity (see 8.1.2 and Figure 5) to prevent, mitigate, and manage losses and to prepare for disruptions.

Be prepared.

Establishing a business continuity management system enables an organization to control, evaluate, and continuously improve its business continuity.

In this document, the term "business" refers broadly to the operations and services an organization undertakes to achieve its goals, objectives, or mission, and applies to large and medium-sized enterprises.

Small-scale industrial, commercial, public, and non-profit organizations.

Disruptions can potentially disrupt an organization's entire operation and its ability to deliver products and services. However, implementing business continuity measures before a disruption occurs is crucial.

A proactive management system, rather than responding unplanned after an incident occurs, will enable the organization to address the impact before it becomes severe.

Resuming operations before it is acceptable is not allowed.

Business continuity management includes.

a) Identify the organization's products and services, and the activities involved in delivering those products and services;

b) Analyze the impact of not resuming related activities, and the resources on which the activities depend;

c) Understand the risks of disturbance;

d) Determine the priorities, timeframes, capabilities, and strategies for restoring product and service delivery;

e) Develop solutions and plans to continue operations within the required timeframe following the occurrence of the disturbance;

f) Ensure that these plans are routinely reviewed and updated so that they remain effective in all circumstances.

An organization's business continuity management approach and its documented information should be adapted to its environment (e.g., operating environment, complexity, requirements, resources).

Business continuity is effective in handling both sudden disruptions (such as explosions) and gradual disruptions (such as pandemics).

Numerous unforeseen events can cause disruptions to operations, many of which are difficult to predict and analyze. These disruptions stem from concerns about business continuity.

Business continuity focuses on the impact of activities rather than their causes, thus enabling organizations to identify activities essential for fulfilling their obligations.

Sustainability means that organizations can recognize what preparations need to be made to protect their resources (e.g., people, facilities, technology, and information), supply chains, and related aspects before a disruption occurs.

This understanding also impacts the organization's reputation. Based on this understanding, the organization can effectively implement its response mechanisms, thereby gaining confidence in managing the effects of disruptions.

Figures 2 and 3 conceptually illustrate how business continuity can be effectively mitigated under certain circumstances, with each stage shown in the figures.

The relative distance between them does not represent a specific length of time.

Figure 2.Business continuity is effective against sudden disruptions.

Figure 3.Business continuity is effective against asymptotic disturbances (e.g., an impending pandemic).

Safety and Resilience Business Continuity Management System GB/T 30146 User Guide

4.1 Understanding the organization and its context

This section provides recommendations for understanding the organizational context relevant to a business continuity management system. Recommendations for establishing and maintaining business continuity are provided in 8.1.

Organizations should assess and understand internal and external matters (including positive and negative factors or conditions to be considered) related to their overall objectives.

Goods and services, and the quantity and type of risks that the organization can or cannot bear. Organizations implement and maintain their business continuity management system.

It is advisable to consider this information and prioritize it.

The organization's relevant external environment includes.

a) The international, national, regional, or local political, legal, and regulatory environment;

b) Social and cultural environment;