СИСТЕМА ЗА УПРАВЛЕНИЕ НА НЕПРЕКЪСНАТОСТТА НА БИЗНЕСА (СУНБ)

ДОКУМЕНТАЛНА ЧАСТ НА СУНБ, СЪГЛАСНО ИЗИСКВАНИЯТА НА ISO 22301:2012

При изграждането  на СУНБ е необходимо да се разработят следните документи (показани в следващата Таблица 1):

Таблица 1

№	Наименование на документа	Клауза от ISO 22301	Забележка
	ЗАДЪЛЖИТЕЛНИ ДОКУМЕНТИ НА СУНБ
1	Процедура за определяне на законовите / регулаторните изисквания	4.2.2	Определя отговорностите за постигане на съответствие със законовите / регулаторни изисквания
2	Списък на законовите / регулаторни и други, приложими изисквания	4.2.2	Пълен списък на изискванията, които трябва да се изпълняват
3	Обхват на СУНБ и описание на изключенията	4.3	Определя, къде ще бъде внедрена СУНБ
4	Политика за непрекъснатост на бизнеса	5.3	Определя основните отговорности и очакванията на Ръководството.
5	Цели на непрекъснатостта на бизнеса	6.2	Определя измерими цели, които ще се постигнат чрез непрекъснатост на бизнеса
6	Компетентност на персонала	7.2	Определя необходимите знания и умения на персонала
7	Комуникация с трети страни, имащи интерес от непрекъснатостта на бизнеса	7.4	Определя интересуващите се трети страни и как да се комуникира с всяка от тях
8	Процес на анализ на влиянието върху бизнеса и оценка на рисковете	8.2.1	Определя и описва приетата методология за провеждане на анализ на влиянието върху бизнеса и оценката на рисковете
9	Резултати от проведения анализ на влиянието върху бизнеса	8.2.2	Документира резултатите от проведения анализ
10	Резултати от проведения анализ на рисковете	8.2.3	Документира резултатите от проведения анализ ва рисковете
11	Процедури за непрекъснатост на бизнеса	8.4.1	Включват се планове за инциденти, възстановяване и бизнес планове
12	Процедури за реакция при инциденти	8.4.2	Определят първоначалните действия при реакция на различни видове инциденти
13	Решение дали рисковете и влиянието трябва да се комуникират извън организацията	8.4.2	Обикновено се извършва от Менажера (служителя) по кризисните ситуации
14	Комуникации с трети страни, вкл. със системи на национално / регионално ниво	8.4.3	Може да се документира, както е приложимо – електронна поща, бележки от работни срещи и др.
15	Записи на важни данни / информация за инцидентите и съответните мерки и решения	8.4.3	Обикновено записите са на база документираните работни данни / информация  по и след времето на възникване на инцидента
16	Процедури за реакция при разрушителни инциденти	8.4.4	Включват се планове за непрекъснатост на бизнеса и за възстановяване, вкл. и плановете за възстановяване от бедствия
17	Процедури за възстановяване на бизнеса и връщане към нормалните бизнес операции	8.4.5	Тези процедури описват какво се прави, след като бизнес операциите са възстановени.
18	Резултати от действията, предприети спрямо неблагоприятни тенденции или резултати	9.1.1	Това, основно са резултати от проведени превантивни действия
19	Данни и резултати от проведените наблюдения и измервания	9.1.1	Чрез тези данни / резултати се определя, дали СУНБ изпълнява поставените цели към нея.
20	Резултати от проведени наблюдение след приключването на инцидент	9.1.2	Чрез тези резултати се оценява колко ефективна е внедрената СУНБ
21	Резултати от проведени вътрешни одити	9.2	Обикновено, това са доклади от проведени вътрешни одити
22	Резултати от проведени прегледи от Ръководството	9.3	Обикновено, това са протоколи от проведените прегледи от Ръководството и съответните решения в тях
23	Видове несъответствие и предприети действия	10.1	Описание на разкритите несъответствие и съответните случаи, в които са разкрити
24	Резултати от приложени коригиращи действия	10.1	Описание на предприетите действия за премахване на разкритите несъответствия
	ПРЕПОРЪЧИТЕЛНИ ДОКУМЕНТИ НА СУНБ
1	План за внедряване на СУНБ	6.2
2	План за обучение и тренировки	7.2 /7.3
3	Процедура за контрол на документираната информация	7.5
4	Договори / Споразумения зя нива на предоставяните услуги с доставчици и/или подизпълнители	8.1
5	Стратегия за постигане на непрекъснатост на бизнеса	8.3
6	Противодействие на рисковете (описание)	8.3.3
7	Оперативни сценарии за действие при възникване на различни по тип инциденти	8.5
8	Планове за провеждане на тренировки и тестване на процедурите	8.5
9	Доклади за резултатите от предприетите мерки	8.5
10	План за поддръжка и развитие на СУНБ	9.1.1
11	Описание на прилаганите методи за наблюдение, измервания, анализи и оценка	9.1.1
12	Процедура за провеждане на вътрешни одити на СУНБ	9.2
13	Програма за провеждане на вътрешни одити	9.2
14	Процедура за провеждане на корективни действия	10.1

ISO 22301 - Business Continuity Management System Questionnaire 

ISO 2230 is a business continuity management standard. 
Use it to ensure that operations continue and that products and services 
are delivered at predefined levels, that brands and value-creating activities 
are protected, and that the reputations and interests of key stakeholders 
are safeguarded whenever disruptive incidents occur.
Self-assessment questionnaire

How ready are you for ISO 22301?

This document has been designed to assess your company’s readiness for an ISO 22301 Business Continuity Management System (BCMS). By completing this questionnaire your results will allow you to self-assess your organization and identify where you are in the ISO 22301 process.

QUESTIONS: 

1. The organization and its context

- Have the issues that will drive the BCMS been defined?
- Has the environment within which the BCMS will operate (internal & external), and the expected outcomes of the system, been identified?
- Has an appropriate and repeatable risk assessment method and the acceptable levels of risk been defined and documented?

2. Needs and expectations of interested parties

- Is the scope of the BCMS clear and documented?
- Is there a procedure in place to identify, take into account, document and maintain information on the applicable legal and regulatory requirements for the BCMS?
- Have these legal, regulatory and other requirements been communicated to affected employees and identified interested parties?

3. Scope of the BCMS

- Is the scope of the BCMS clear and documented?
- Have options for risk treatment been identified and evaluated?
- Does the scope define the BCMS in terms of its extent, purpose, deliverables, needs and expectations in a way that is appropriate to the organization?
- Is there any exclusion from scope, and if so is it in an area that will not affect the organization’s ability to provide continuity of operations?

4. Leadership and management commitment

- Is the organization’s leadership commitment to BCM visible and repeated?
- Is there a policy, program and roles to evidence top management commitment to the BCMS?
- Has top management been appropriately involved in the BCMS implementation and review through a formal management review process?

5. Business Continuity Management (BCM) policy

- Is there an established BCM policy that is appropriate, maintained, communicated, and documented?
- Is the policy available to employees and all interested parties identified?

6. Risks and opportunities of BCMS implementation

- Has an analysis of the threats and opportunities that may impact the implementation of the BCMS been conducted?
- Has a plan to manage the risks and opportunities of the BCMS implementation been developed and auctioned?

7. Business continuity objectives

- Have measurable business continuity (BC) objectives been established, documented and communicated throughout the organization?
- Is the achievement of these objectives evaluated by both internal audit and the management review?

8. BCMS resources and competence

- Are roles within the BCMS clearly defined?
- Is the BCMS adequately resourced?
- Is there a process defined and documented for determining competence for BCMS roles?
- Are those undertaking BC roles competent, and is this competence documented appropriately?

9. Awareness and communication

- Is everyone within the organization’s control aware of the importance of the BCM policy, their involvement in implementing it and their role in a disruption?
- Has a communication needs analysis been conducted for the BCMS?
- Have procedures been confirmed and facilities made available for communicating incidents? Are they regularly tested with results recorded?
- Is appropriate documentation created, maintained and controlled to demonstrate the effectiveness of the BCMS?

10. Operational planning and control

- Have you devised and implemented a program to ensure the BCMS achieves its outcomes?
- Has there been analysis of the threats to any outsourced processes and their impact on achieving BCMS and recovery time objectives?

11. Business Impact Analysis (BIA)

- Is there a formal and documented process for understanding the organization through a BIA?
- Is there a formal process for determining continuity objectives based on understanding the impact of disruptive incidents?
- Does the BIA enable prioritization of time frames for resuming each activity (Recovery Time Objectives)?
- Have minimum acceptable levels for resuming activities been identified?

12. Risk assessment and treatment

- Is there a formal risk assessment process for analysis the risk of disruptive incidents?
- Does this risk assessment method identify risk treatments appropriate to BC objectives?
- Is there evidence of prioritizing risk treatments with costs identified?

13. Business continuity strategy

- Is the BC strategy based on the outputs of the BIA and risk assessment?
- Does the BC strategy protect prioritized activities and provide appropriate continuity and recovery of them, their dependencies and resources?
- Does the BC strategy provide for mitigating, responding to and managing impacts?
- Have prioritized time frames been set for the resumption of all activities?
- Have the BC capabilities of suppliers been evaluated?
- Have the resource requirements for the selected strategy options been determined, including people, information and data, infrastructure, facilities, consumables, IT, transport, finance and partner/supplier services?
- Have measures to reduce the likelihood, duration or impact of a disruption for identified risks been considered and implemented, and are these in accordance with the organization’s risk appetite?

14. Establishing and implementing BC procedures

- Have BC procedures been put in place to manage a disruptive incident, and have continuity activities based on recovery objectives been identified in the BIA?
- Are the business continuity procedures documented?
- Have internal and external communication protocols been established as part of these procedures?

15. Incident Response Structure (IRS)

- Is there the management structure and trained personnel in place to respond to a disruptive incident?
- Does the IRS and associated procedures include thresholds, assessment, activation, resource provision and communication?
- Do the people in your IRS have the necessary competency to perform their duties, and have you kept records to demonstrate their competence?

16. Incident communications and warnings

- Is there a procedure for detecting and monitoring incidents?
- Is there a procedure for managing internal communications and external communications from interested parties during a disruptive incident?
- Is there a procedure for receiving and responding to warnings from outside agencies and emergency responders?
- Is there a structure to communicate with emergency responders and other authorities during an incident, or for responding organizations are communications interoperable with others?
- Is there a procedure for recording vital information about the incident, actions taken and decisions made?
- Is there a procedure for issuing alerts and warnings if appropriate?
- Are the organization’s communication and warning systems regularly exercised, and records kept of the results?

17. Business continuity response and recovery plans

- Are there documented plans/procedures for restoring business operations after an incident?
- Do these plans reflect the needs of those who will use them?
- Do the plans define roles and responsibilities?
- Do the plans define a process for activating the response?
- Do the plans consider the management of the immediate consequences of a disruption, in particular the welfare of individuals, options for response and further loss prevention?
- Do the plans detail how to communicate with the various interested parties during the disruption?
- Do the plans contain details on how prioritized activities will be continued or recovered within predetermined time frames?
- Is there a planned media response to an incident?
- Do the plans include a procedure for standing down the response?
- Does each plan contain the essential information to use it effectively?

18. Exercising and testing

- Have business continuity procedures been tested to ensure they are consistent with your BC objectives?
- Do top management “actively engage” in testing and exercising the BCMS?
- Are the test exercises clearly defined, consistent with the scope of the BCMS and business continuity objectives, and based on appropriate scenarios?
- Will the test exercises that have been conducted over time validate the whole of the organization’s business continuity arrangements?
- Are the test exercises designed to minimize the risk of disruption to operations?
- Have formal post-exercise reports been produced for the conducted tests? Are the outcomes of exercises reviewed to ensure they lead to improvement?
- Are test exercises undertaken at planned intervals, and when significant changes occur is this process documented within the BCMS?

19. Monitoring, measurement and evaluation

- Has it been determined how (i.e. metrics or KPI’s) and when performance of the BCMS will be monitored?
- Has the performance and effectiveness of the BCMS been evaluated and documented, including recordings of any proactive corrective measures taken?
- Has an appropriate procedure for monitoring the BCMS been documented?
- Are reviews conducted, both periodically and when significant changes occur, to ensure that the business continuity capability is effective and compliant?
- Are post-incident reviews undertaken and documented following disruptive incidents?

20. Internal audit

- Are internal audits conducted periodically to check that the BCMS is effective and conforms to both ISO 22301 and the organization’s requirements?
- Is the audit conducted with an appropriate method, audit program, and based on the results of risk assessments and previous audits?
- Are corrective actions implemented and verified without undue delay?

21. Management review

- Do top management undertake a periodic review of the BCMS?
- Does the management review of the BCMS capture the outlined input and output requirements?
- Does the output from the BCMS management review identify changes and improvements?
- Are the results of the management review documented, acted upon and communicated to appropriate interested parties?

22. Corrective action and continual improvement

- Have corrective actions for any non conformity been identified and implemented in the BCMS? Is this reported at management review?
- Do the reviews result in an improvement to the BCMS?