+Business Continuity Management (BCM)
---+Top management responsibility
---+Business impact analysis policies and instructions
---+Planning business continuity
---+Verification, updating and testing of the business continuity
|
Business Continuity Management (BCM)
None
1. Pregled
| Naslov |
Standard |
|
Top management responsibility
|
The top management (or a member of the top management) of the Cloud Service Provider is named as the process owner of business continuity and emergency management and is responsible for establishing the process within the company as well as ensuring compliance with the guidelines. They must ensure that sufficient resources are made available for an effective process.
People in management and other relevant leadership positions demonstrate leadership and commitment to this issue by encouraging employees to actively contribute to the effectiveness of continuity and emergency management.
Additonal Criteria-
Supplementary Information - About the Criteria-
|
|
Business impact analysis policies and instructions
|
Policies and instructions to determine the impact of any malfunction to the cloud service or enterprise are documented, communicated and made available in accordance with SP-01. The following aspects are considered as minimum:
• Possible scenarios based on a risk analysis;
• Identification of critical products and services
• Identify dependencies, including processes (including resources required), applications, business partners and third parties;
• Capture threats to critical products and services;
• Identification of effects resulting from planned and unplanned malfunctions and changes over time;
• Determination of the maximum acceptable duration of malfunctions;
• Identification of restoration priorities;
• Determination of time targets for the resumption of critical products and services within the maximum acceptable time period (RTO);
• Determination of time targets for the maximum reasonable period during which data can be lost and not recovered (RPO); and
• Estimation of the resources needed for resumption.
Additonal Criteria-
Supplementary Information - About the CriteriaScenarios to be considered according to the basic criterion are, for example, the loss of personnel, buildings, infrastructure and service providers.
|
|
Planning business continuity
|
Based on the business impact analysis, a single framework for operational continuity and business plan planning will be implemented, documented and enforced to ensure that all plans are consistent. Planning is based on established standards, which are documented in a "Statement of Applicability".
Business continuity plans and contingency plans take the following aspects into account:
• Defined purpose and scope with consideration of the relevant dependencies;
• Accessibility and comprehensibility of the plans for persons who are to act accordingly;
• Ownership by at least one designated person responsible for review, updating and approval;
• Defined communication channels, roles and responsibilities including notification of the customer;
• Recovery procedures, manual interim solutions and reference information (taking into account prioritisation in the recovery of cloud infrastructure components and services and alignment with customers);
• Methods for putting the plans into effect;
• Continuous process improvement; and
• Interfaces to Security Incident Management.
Additonal Criteria-
Supplementary Information - About the CriteriaThe consistency of plans according to the basic criterion must also be maintained when different locations are used.
|
|
Verification, updating and testing of the business continuity
|
The business impact analysis, business continuity plans and contingency plans are reviewed, updated and tested on a regular basis (at least annually) or after significant organisational or environmental changes. Tests involve affected customers (tenants) and relevant third parties. The tests are documented and results are taken into account for future operational continuity measures.
Additonal CriteriaIn addition to the tests, exercises are also carried out which, among other things, have resulted in scenarios from security incidents that have already occurred in the past.
Supplementary Information - About the CriteriaTests are primarily conducted at the operational level and are aimed at operational target groups. Tests include e.g.:
• Test of technical precautionary measures;
• Functional tests; and
• Plan review.Exercises also take place on a tactical and strategic level. These include e.g.:
• Plan meeting;
• Staff exercise;
• Command post exercise;
• Communication and alerting exercise;
• Simulation of scenarios; and
• Emergency or full exercise.
After a completed exercise:
• Review and possible adaptation of the existing alarm plan.Relevant third parties are in particular service providers and suppliers of the Cloud Service Provider who contribute to the provision of the cloud service (cf. basic criteria SSO02 and SSO05).
|
1.1 Sklici
1.2 Ugotovljene zahteve
1.3 Povezani predpisi
2. Ugotovljene zahteve
3. Povezani predpisi
|