Business Continuity Management:

Information Security Aspects of Business Continuity Management

This category's objective is to ensure timely resumption from, and if possible prevention of, interruptions to business activities and processes caused by failures of information systems.

Business Continuity Management Considerations

Events that trigger the implementation of a business continuity plan may have significant security implications. Depending on the event, some or all of the elements of the security environment may change. Different people may be involved in operations, at different physical locations, using similar but different machines and software which may communicate over different communications lines. Different trade offs may exist between availability, integrity, confidentiality, and accountability, with a different appetite for risk on the part of management.

Business continuity plans should be reviewed as an integral part of the security process. Risk assessments should consider the changing risks that appear in business continuity scenarios and the different security posture that may be established. Strategies should consider the different risk environment and the degree of risk mitigation necessary to protect the institution in the event the continuity plans must be implemented. The implementation should consider the training of appropriate personnel in their security roles, and the implementation and updating of technologies and plans for back-up sites and communications networks. These security considerations should be integrated with the testing of business continuity plan implementations.

Business Continuity Management Policy Samples

ISO 27001 defines Business Continuity Management objectives to counteract interruptions to business and protect critical business processes from the effects of major failures or disasters. This section provides templates for Information Security standards that are required to comply with ISO Business Continuity Management objectives and support the objectives established in the Asset Protection Policy, and Threat Assessment and Monitoring Policy.

1. Sample ISO Availability Protection Standard

The Availability Protection Standard is required to comply with ISO Business Continuity Management objectives and builds on the objectives established in the Asset Protection Policy by providing specific requirements for protecting the availability of information assets.

2. Sample ISO Threat Monitoring Standard

The Threat Monitoring Standard is required to comply with ISO Business Continuity Management objectives and builds on the objectives established in the Threat Assessment and Monitoring Policy by providing specific requirements for periodically identifying, analyzing, and prioritizing threats to sensitive information such as health information pertaining to individuals. The Threat Monitoring Standard provides specific requirements for performing real-time intrusion detection monitoring and periodic intrusion detection analysis to detect threat and intrusion activity.

3. Sample ISO Incident Response Standard

The Incident Response Standard is required to comply with ISO Business Continuity Management and builds on the objectives established in the Threat Assessment and Monitoring Policy by providing specific requirements for developing and exercising formal plans, and associated metrics, for responding to security incidents and intrusions.

IT Service Continuity Management

IT Service Continuity Management helps to ensure the availability and rapid restoration of IT services in the event of a disaster. The high level activities are Risk Analysis, Contingency Plan Testing, and Risk Management.

HORSE FACTS: Financial institutions should consider:

1. Identification of personnel with key security roles during a continuity plan implementation, and training personnel in those roles.
2. Security needs for back-up sites and alternate communication networks.

See Also

ISO-27002:2005 14
HIPAA 164.308(a)(7)
JCAHO-IM:2004 2.20
PCI/DSS:2005 12.8.3
ISO-27002:2005 14.1.1
HIPAA 164.308(a)(7)(i)
ISO-27002:2005 14.1.2
HIPAA 164.308(a)(7)(ii)(E)
ISO-27002:2005 14.1.3
HIPAA 164.308(a)(7)(ii)(A-C)
HIPAA 164.312(a)(2)(ii)
ISO-27002:2005 14.1.4
HIPAA 164.308(a)(7)(i)
ISO-27002:2005 14.1.5
HIPAA 164.308(a)(7)(ii)(D)

References

• See: Continuity Management
  
• The “Business Continuity Planning” booklet of the FFIEC IT Examination Handbook.
  
• ISO 17799/27002 - Code of Practice for Information Security Management.