Security Mgt, ISO 27031 business continuity planning (intro)

1. ISO 22301 defines BCM
2. BCMS - business continuity management system

1. malware
2. systems intrusion
3. impacts continuity of business

1. plan
   1. establish IRBC policy, objectives, targets, processes and procedures relevant to managing risk and improving ICT readiness to deliver resultts in accordance with an org's overall BC policies and objectives
2. do
   1. implement the IRBC policy, controls, processes and procedures
3. check
   1. Assess and, where applicable, measure process performance against IRBC policy, objectives & practical experience, and report the results to mgt for review.
4. act
   1. Take corrective and preventative actions, based on the results of the mgt review, to achieve continual improvement of the IRBC.

Annotations:

• https://lh5.googleusercontent.com/-60zQyUvfXXQ/UYiGP35kNxI/AAAAAAAAAg8/JRRIhisEaOA/w800-h480/bcm-framework.png

1. components
   1. policies
   2. processes
   3. people
   4. ICT infrastructure
2. stages
   1. 1. risk assessment / review of BIA
   2. 2. strategy
   3. 3. BC plan
   4. 4. tests & exercises
   5. 5. awareness
   6. 6. program management & maintenance
3. ICT output
   1. ICT response & recovery
   2. ICT risk reduction controls
4. desired outcome
   1. business resiliency

1. incident preparedness
2. operational continuity management
3. disaster recovery planning
4. risk mitigation

1. improve indicident detection capabilities
2. prevent a sudden or drastic failure
3. ensure acceptable degredation of operational status should failure be unstoppable
4. shorten recovery time
5. minimize impact upon eventual occurence of the incident

1. hardware
2. network
3. software