ISO/DTS 22317-2015: Societal security – Business continuity management systems – Business impact analysis

Description

1 Scope 2 Normative references 3 Terms and definitions 4 Prerequisites 4.1 General 4.2 BCM Programme Context and Scope 4.2.1 BCM Programme Context 4.2.2 Scope of the BCM Programme 4.3 BCM Programme Roles 4.3.1 BCM Programme Roles and Responsibilities 4.3.2 BIA-Specific Roles and Competencies 4.4 BCM Programme Commitment 4.5 BCM Programme Resources 5 Performing the Business Impact Analysis 5.1 Introduction 5.2 Project Planning and Management 5.2.1 Introduction (overview) 5.2.2 Initial versus Ongoing BIA Processes 5.3 Product and Service Prioritization 5.3.1 Introduction (Overview) 5.3.2 Inputs 5.3.3 Outcomes 5.4 Process Prioritization 5.4.1 Introduction (Overview) 5.4.2 Inputs 5.4.3 Outcomes 5.5 Activity Prioritization 5.5.1 Introduction (Overview) 5.5.2 Inputs 5.5.2.1 Information 5.5.2.2 Resource requirements 5.5.2.3 Interdependencies 5.5.3 Outcomes 5.6 Analysis and Consolidation 5.6.1 Introduction (Overview) 5.6.2 Inputs 5.6.3 Methods 5.6.4 Outcomes 5.7 Obtain Top Management Endorsement of BIA Results 5.7.1 Introduction (Overview) 5.7.2 Inputs 5.7.3 Methods 5.7.4 Outcomes 5.8 Next Step – Business Continuity Strategy Selection 6 BIA Process Monitoring and Review Annex A (informative) Business Impact Analysis within an ISO 22301 Business Continuity Management System Annex B (informative) Business Impact Analysis Terminology Mapping Annex C (informative) Business Impact Analysis Data Collecting Methods C.1 Documentation Review C.2 Interview C.3 Survey/Questionnaire C.4 Workshops C.5 Scenario-based exercise Annex D (informative) Other Uses for the Business Impact Analysis Process D.1 Collection of Additional Recovery Planning Information D.2 The collection of information useful for plan development and incident response D.2.1 Increasing the efficiency of the organisation D.2.2 To explore alternative strategic planning options D.2.3 To assist with longer term strategy decision-making D.2.4 Project or event BIA D.2.5 BIA as a Risk Analysis