DER.4 Business Continuity Management

Introduction

In emergencies, organisations must having continued access to information in order to be able to restore a business process, an IT system, or a specialised task. To be able to maintain information security even in an emergency, appropriate processes should therefore be planned, established, and reviewed.

Optimal contingency planning and emergency response can only be achieved by adopting a planned and organised approach. A professional process for business continuity management reduces the impact of an emergency and thereby secures operations and the continued existence of the organisation affected. Suitable measures must be identified and implemented to make time-critical business processes and specialised tasks more robust and fail-safe. On the other hand, these measures should make it possible to deal with an emergency in a quick and targeted manner.

The preservation of information security in an emergency must be integrated into overarching business continuity management, ideally as part of an emergency management system. However, business continuity management has its own Process Owner: the BCM Officer, who coordinates with the Chief Information Security Officer.

Objective

The aim of this module is to describe requirements to ensure information security in organisations even in critical situations. For this purpose, the corresponding measures should be embedded in a holistic approach to business continuity management. In addition, all aspects should be considered that are necessary for maintaining information security even in the event of damage or emergencies. This includes anything from planning to the checking of all processes.

Scoping and Modelling

Module DER.4 Business Continuity Management must be applied once to the entire information domain under consideration.

In the event of damage, the correct information must be fully available. The present module does not address criteria or processes used by persons in charge to decide whether an emergency has occurred. This decision will be made during the handling of each security incident (see DER.2.1 Security Incident Handling).

Crises are considered within the scope of an own crisis management and only are addressed as interface in this module, e.g. within the scope of further escalation of emergencies. Further information on the individual phases of business continuity management and the differentiation between business continuity management and crisis management is included in BSI Standard 100-4, “Business Continuity Management”.

Useful resources

The International Organization for Standardization (ISO) provides guidelines for ensuring information security in the event of an emergency in ISO/IEC 27001:2013, “Information Technology - Security Techniques – Information Security Management Systems – Requirements” (annex A17, “Information Security Aspects of Business Continuity Management”).

The International Organization for Standardization (ISO) provides a framework for business continuity management in the standard ISO/IEC 22301:2012, “Societal Security – Business Continuity Management Systems – Requirements”. The requirements from the aforementioned standard ISO/IEC 27001:2013 (for example) can be integrated into this standard.

BSI Standard 100-4, “Business Continuity Management”, describes how a BCM can be established, maintained, and continuously improved.

The implementation framework (UMRA) published by the BSI on business continuity management in line with BSI Standard 100-4 contains further auxiliar resources to facilitate the establishment of a BCMS.

In addition, the web course “Business Continuity Management” provides an introduction to the topic in line with BSI Standard 100-4.

In “The Standard of Good Practice for Information Security”, the Information Security Forum (ISF) provides specifications on business continuity in the category BC (Business Continuity). Among other things, it requires that a continuity strategy be coordinated with a corresponding information security strategy.

In its Special Publication 800-34, Rev. 1, “Contingency Planning Guide for Federal Information Systems”, the National Institute of Standards and Technology (NIST) provides a guide for establishing continuity planning for (federal) information systems, which also incorporates information security. This document also provides information on interrelationships between continuity planning for information systems and other types of plans related to security and emergency management (e.g. a business continuity plan).

1. Panoramica

Titolo	Standard
DER.4.A1 Creating a Business Continuity Plan (S)	A business continuity plans SHOULD be drawn up that contains the most important information on the following: roles immediate measures alerts and escalation communication plans, basic business continuity plans, and restoration plans Responsibilities and competencies SHOULD be assigned, communicated, and recorded in the business continuity plan. It SHOULD be ensured that appropriately trained personnel are available in emergencies. Tests and drills SHOULD be performed regularly to check that the safeguards described in the business continuity plan work as intended. The business continuity plan SHOULD be checked regularly and updated as required. It SHOULD be accessible in an emergency. The business continuity plan SHOULD be supplemented with codes of conduct for special cases (involving a fire, for example). These rules SHOULD be communicated to all employees.
DER.4.A2 Integration of Business Continuity Management and Information Security Management [Chief Information Security Officer (CISO)] (S)	Security management processes SHOULD be coordinated with business continuity management (see DER.2.1 Security Incident Handling).
DER.4.A3 Specifying the Scope and the Business Continuity Strategy [Top Management] (H)	The scope of the business continuity management system at hand SHOULD be clearly specified. The respective organisation's Top Management SHOULD specify a business continuity strategy that states the goals to be reached and the level of risk considered acceptable.
DER.4.A4 Policy for Business Continuity Management and Acceptance of Overall Responsibility by Top Management [Top Management] (H)	The Top Management SHOULD adopt a policy for business continuity management. This SHOULD include the essential aspects of business continuity management. The business continuity policy SHOULD be checked regularly and revised when necessary. All employees SHOULD be informed of its provisions.
DER.4.A5 Establishing a Suitable Organisational Structure for Business Continuity Management [Top Management] (H)	Roles for business continuity management SHOULD be appropriately defined for the circumstances of the organisation in question. This SHOULD be documented in writing together with the tasks, obligations, and competencies of the roles. Qualified employees SHOULD be appointed to all the roles involved in the organisation's business continuity management. The organisational structure in business continuity management SHOULD be regularly checked to ensure it is effective, efficient, and fit for purpose.
DER.4.A6 Providing Adequate Resources for Business Continuity Management [Top Management] (H)	The financial, technical, and personnel resources provided SHOULD be sufficient to achieve an organisation's intended goals in business continuity management. The BCM Officer and the members of the business continuity management team SHOULD be allocated sufficient time to perform their tasks.
DER.4.A7 Creating a Contingency Concept [Top Management] (CIA)	All critical business processes and resources SHOULD be identified (e.g. based on a business impact analysis, or BIA). The most important and relevant risks to critical business processes and specialised tasks and the resources they require SHOULD be identified. The strategies to be used to treat risks SHOULD be specified for each identified risk. An organisation SHOULD develop continuity strategies that enable its critical business processes to be restored and restarted within the required time. A contingency concept SHOULD be drawn up. Contingency plans and safeguards SHOULD also be developed and implemented that enable an effective emergency response and quick recovery of the critical business processes. The contingency concept SHOULD include considerations of information security and elaborate on corresponding security concepts for business continuity solutions.
DER.4.A8 Integrating Employees into the Business Continuity Management Process [Supervisor, Human Resources Department] (H)	All employees SHOULD receive appropriate awareness training on business continuity management on a regular basis. There SHOULD be a training and awareness concept for business continuity management. The employees on the business continuity management team SHOULD receive regular training to hone the skills they need.
DER.4.A9 Integrating Business Continuity Management into Organisation-Wide Procedures and Processes [Top Management] (H)	It SHOULD be ensured that business continuity aspects are taken into account in all of an organisation's business processes and specialised tasks. The processes, requirements and responsibilities in business continuity management SHOULD be coordinated with risk management and crisis management.
DER.4.A10 Tests and Emergency Drills [Top Management] (H)	Regular and event-based testing and drills of all essential emergency measures and emergency plans SHOULD be carried out in an appropriate manner. The time frame and technical coverage of all drills SHOULD be documented in an overall drill plan. Business continuity management SHOULD have adequate resources available for planning, designing, executing, and assessing tests and drills.
DER.4.A12 Documentation in the Business Continuity Management Process (H)	The sequence of events in the business continuity management process, the results of the work done in each of the phases, and all major decisions SHOULD be documented. An established procedure SHOULD ensure that these documents are regularly updated. Furthermore, access to the documentation SHOULD be limited to authorised persons.
DER.4.A13 Checking and Controlling the Business Continuity Management System [Top Management] (H)	The Top Management of the organisation at hand SHOULD regularly obtain information on the status of its business continuity management system through management reports. It SHOULD therefore review and assess the business continuity management system on a regular basis and make any necessary corrections.
DER.4.A14 Regular Checking and Improvement of Business Continuity Safeguards [Top Management] (H)	All business continuity safeguards SHOULD be checked regularly or in case of major changes to see if they are still being adhered to and correctly implemented. Whether they are still suitable to achieve the defined objectives SHOULD be checked. During this process, it SHOULD be determined whether technical safeguards are implemented and configured correctly, and whether organisational safeguards are implemented effectively and efficiently. In case of deviations, the causes of defects SHOULD be identified and measures for improvement initiated. The organisation's Top Management SHOULD approve the summary of results. Furthermore, a process that controls and monitors whether and how measures for improvement are implemented SHOULD be established. Delays SHOULD be reported promptly to Top Management. The organisation's Top Management SHOULD specify how to coordinate the reviews. These examinations SHOULD be planned so that no relevant parts are skipped. In particular, the examinations performed in the areas of auditing, IT, security management, information security management, and business continuity management should be coordinated with each other. To this end, regulations SHOULD be in place that define who should which safeguards and when.
DER.4.A15 Assessing the Performance of the Business Continuity Management System [Top Management] (H)	The performance and effectiveness of a business continuity management system SHOULD be assessed regularly. Measurement and assessment criteria such as key performance indicators SHOULD be defined for this purpose. These metrics SHOULD be determined regularly and compared against suitable previous values, including (at minimum) the previous year's values. If the values deviate in a negative way, the causes SHOULD be identified and measures for improvement defined. The results of the assessment SHOULD be reported to Top Management. Top management SHOULD define the safeguards to be included in the further development of the business continuity management system. All Top Management decisions SHOULD be documented and the previous records updated.
DER.4.A16 Contingency Planning and Emergency Response Planning for Outsourced Components [Top Management] (H)	Contingency planning and emergency response planning for outsourced components SHOULD include regular reviews of the business continuity management systems of the respective suppliers and service providers with respect to the contracts signed with them. The processes in place SHOULD also be coordinated and, if applicable, performed together with the suppliers and outsourcing service providers in business continuity tests and drills. The results and assessments SHOULD be exchanged regularly between suppliers and service provides and the Top Management of the organisation in question. The assessments SHOULD also include any possible measures for improvement.

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti
Fonte	Requisito

3. Regolamentazioni correlate

Regolamentazioni
Fonte	Regolamentazione

Ticket collegati

Collegamenti
Tipo di collegamento	Ticket
includes	DER.4.G1. Shortage of Personnel
includes	DER.4.G2. Failure of IT Systems
includes	DER.4.G3. Failure of a Wide Area Network (WAN)
includes	DER.4.G4. Inability to Use a Building
includes	DER.4.G5. Unavailability of a Supplier or Service Provider

BSI -
Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)