GB/T 35625-2017Societal security -- Business continuity management systems -- Guidelines for business impact analysis (BIA) (English PDF)

Foreword

This standard was drafted in accordance with the rules given in GB/T 1.1-2009.

This standard uses the translation method identical with ISO/T S22317..2015 "Public Safety Business Continuity Management System Business Impact Score Analysis Guide "(in English), made the following editorial changes.

--- Added abbreviations (see 3.2);

--- In accordance with the order of adjustment of the order of the international standard appendix.

This standard by the National Public Security Foundation Standardization Technical Committee (SAC/TC351) and focal point.

This standard was drafted. China National Institute of Standardization, China Information Security Certification Center, State Grid Shandong Power Company, Jiangsu Province, the quality and Standardization Institute, Xiamen International Bank Co., Ltd., Beijing University of Science and Technology, China Development Bank, China Quality Certification Center, the British standard certification technology Training (Beijing) Co., Ltd., China International Disaster Recovery Association Branch.

Introduction

This standard provides detailed guidance for the establishment, implementation and continuous improvement of Business Impact Analysis (BIA) and is maintained in accordance with ISO 22301 Consistent.

This standard applies to any process of BIA.

Figure 1 illustrates the relationship between BIA and Business Continuity (BC). The organization should complete the BIA before the business continuity strategy is finalized.

Figure 1 Business Continuity Management (BCM) Element (Source. ISO 22313)

BIA is the process of analyzing the consequences of disruptive events on the organization. The result is a discussion of the need for business continuity.

The BIA process consists of several separate BIA, each focused on a small part of the business continuity plan. BIA process First, prioritize products and services and continue to process and activities as they cover the full spectrum of business continuity options the distinction between the priorities. After a period of time has been established by the organization, the individual BIA is repeated to ensure that the requirements of BC are always maintained up to date.

Note. In this standard, business continuity requirements and continuity of recovery priority, purpose and purpose of the agreement is the same (ISO 22301.:2012, 8.2.2).

The purpose of this standard.

--- Provide a basis for the organization to understand, develop, implement, inspect, maintain and enhance the effective BIA process;

--- BIA planning, implementation and improvement to provide guidance;

--- To assist the organization to carry out BIA;

--- Make sure the BIA process is well coordinated with the BC solution.

The outputs of the BIA process include the following.

--- The organization's business continuity program to recognize or amend the scope;

- Determine the legal, regulatory and contractual requirements and their impact on business continuity requirements;

--- Assess the impact on the organization over time, as a proof of business continuity requirements (time and ability);

--- Identify and understand the delivery requirements for the product/service after the incident, and then prioritize recovery activities and resources time;

--- Identify and identify the relationship between products/services, processes, activities and resources;

--- Determine the need for priority activities (such as space, personnel, equipment, information, communications and technical equipment; supplies and resources gold);

--- Understand the dependencies between other activities, supply chains, partners and other stakeholders;

--- Determine how to update the required information.

NOTE The purpose of this technical standard, the supply chain required for the production of products, works and services, is referred to as "supply" for the remainder of this document.

Figure 2 shows the life cycle of BIA, the preconditions, and the relationship between strategy identification. The terms quoted in the figure are the clauses of this standard.

Figure 2 BIA process

Public safety business continuity management system Business Impact Analysis Guide (BIA)

1 Scope

This standard for the establishment of the establishment, the implementation of business impact analysis (BIA) to provide good operational advice, it does not provide a unified BIA program.

This standard applies to all types, sizes and nature of the organization. Organizations can be made based on their needs, goals, resources and constraints Adjustment.

2 Normative references

The following documents for the application of this document is essential. For dated references, only the dated version applies to this article Pieces. For undated references, the latest edition (including all revisions) applies to this document.

ISO 22300 Public Safety Terminology (Societalsecurity-Terminology).

3 Terms and definitions and abbreviations

4 Preconditions