THE CHALLENGES IN KEEPING THE BCMS UP TO DATE (in accordance with ISO 22301)

1
ATENÇÃO: O conteúdo desta apresentação é CONFIDENCIAL. Nada poderá ser divulgado por qualquer
forma ou meio, em qualquer tempo, sem a prévia autorização por escrito da STROHL Brasil.
Data Processing and Business
Continuity in 2040
February15th,2016
TO BE UPDATED BY PECB

2
Sidney R. Modenesi
Forum Leader
Sidney R. Modenesi is forum leader at Business Continuity Institute, also he is PECB partner and
trainer. Mr. Modenesi has more than 30 years’ experience in Business Continuity and a strong
background in ICT.
+55 11 5583-0033
sidney_modenesi@strohlbrasil.com.br
www.strohlbrasil.com.br
https://br.linkedin.com/in/sidneymodenesimbci
https://twitter.com/Sidney_STROHL
https://www.facebook.com/strohlbrasil/

3
Introductions
Sidney R. Modenesi
• Manager at STROHL Brasil;
• ISO 22301 BSI Technical
Expert, 2013;
• MBCI since 2006;
• Over 35 years experience in
DRP and BCM;
• Former ICT professional since
1977;
• International BCM trainer (ISO
22301, 22313 & others);
• BCI - Business Continuity
Institute forum leader in Brazil.
STROHL Brasil
• Brazilian company;
• 20+ years dedicated solely to
BCM;
• Solid and proved experience
in many different industries;
• Providing consultancy, training
and BCM software;
• Sungard Availability Service
Authorized Representative in
Brazil;
• PECB training partner.
333

4
Agenda
In today´s webinar we will talk about
the challenges in keeping the BCMS
up to date, in accordance with ISO
22301.
And also we will talk about:
 the potential risks in not monitoring
and updating the BCMS timely;
 the potential benefits in using other
Management Systems to feed
updates in the BCMS;
 key control points to capture
organizational changes that affect
the BCMS.
4

5
ISO 22301 REQUIREMENTS FOR
CHANGES AND UPDATES
5

6
Changes and Updates
• 5.3 Policy
The BCMS policy shall
- be reviewed for continuing suitability at defined
intervals and when significant changes occur.
• 7.5.3 Control of documented information
For the control of documented information, the
organization shall address the following activities, as
applicable
- control of changes (e.g. version control),
6

7
Changes and Updates
• 8.1 Operational planning and control
The organization shall control planned changes and
review the consequences of unintended changes,
taking action to mitigate any adverse effects, as
necessary.
• 8.5 Exercising and testing
g) are conducted at planned intervals and when
there are significant changes within the organization
or to the environment in which it operates.
7

8
Changes and Updates
• 9.1.2 Evaluation of business continuity
procedures
b) These evaluations shall be undertaken through
periodic reviews, exercising, testing, post-incident
reporting and performance evaluations. Significant
changes arising shall be reflected in the procedure(s)
in a timely manner;
d) The organization shall conduct evaluations at
planned intervals and when significant changes
occur.
8

9
Changes and Updates
• 9.3 Management review
Top management shall review the organization’s BCMS,
at planned intervals, to ensure its continuing suitability,
adequacy and effectiveness.
b) changes in external and internal issues that are
relevant to the business continuity management system.
Management reviews shall consider the performance of
the organization, including:
- the need for changes to the BCMS, including the policy
and objectives,
- any changes that could affect the BCMS, whether
internal or external to the scope of the BCMS.
9

10
Changes and Updates
The outputs of the management review shall include decisions related
to continual improvement opportunities and the possible need for
changes to the BCMS, and include the following:
d) modification of procedures and controls to respond to internal or
external events that may impact on the BCMS, including changes to:
1) business and operational requirements,
2) risk reduction and security requirements,
3) operational conditions and processes,
4) legal and regulatory requirements,
5) contractual obligations,
6) levels of risk and/or criteria for accepting risks,
7) resource needs,
8) funding and budget requirements; and
e) how the effectiveness of controls are measured.
10

11
Changes and Updates
• 10.1 Nonconformity and corrective action
7) making changes to the BCMS, if necessary.
f) make changes to the business continuity
management system, if necessary.
11

12
forma ou meio, em qualquer tempo, sem a prévia autorização por escrito da STROHL Brasil. 12

13
Changes and Updates
• 8.1 Operational planning and control
The organization shall control planned changes and review the
consequences of unintended changes, taking action to mitigate
any adverse effects, as necessary.
• 3.47 resources
all assets, people, skills, information,
technology (including plant and equipment),
premises, and supplies and information
(whether electronic or not) that an
organization has to have available to use, when
needed, in order to operate and meet its objective.
13

14
THE REALITY OF THE PDCA
14

15
The reality of the PDCA
• Exercises and Tests• Reactive corrections
in the Recovery
Strategy, Plans or
any other non
conformity found
• Recovery Strategy
Implementation
• Plan Development
• Training
• BIA
• Risk Assessment
• Recovery Strategy
Plan Do
CheckAct
15

16
Changes
Changes
More
changes
Even
more
changes
16
timePlan Do Check Act
BCMS
ORGANIZATION
Gaps-Risks

17
The longer we take to
identify and react to any
change in any
organizational resource,
overtime less efficient will
be the BCMS, increasing
the organizational risk in
the event of a disruptive
incident
17

18
CAPTURING CHANGES
18

19
Capturing Changes
From ISO 31000:2009(E) Risk management — Principles and
guidelines
3 Principles
For risk management to be effective, an organization should at all
levels comply with the principles below.
b) Risk management is an integral part of all organizational
processes.
Risk management is not a stand-alone activity that is separate
from the main activities and processes of the organization. Risk
management is part of the responsibilities of management and an
integral part of all organizational processes, including strategic
planning and all project and change management processes.
19

20
Change Management
Change Management (CM) refers to any approach
to transitioning individuals, teams,
and organizations using methods intended to re-
direct the use of resources, business process,
budget allocations, or other modes of operation that
significantly reshape a company or organization.
Source: https://en.wikipedia.org/wiki/Change_management
20

21
Capturing Changes – ICT
Change Management Process
21
Triggers BCMS
Update
Most likely
DRP Plans

22
ICT CMDB
A Configuration Management Data Base (CMDB) is a repository
that acts as a data warehouse for information technology (IT)
installations.
It holds data relating to a collection of IT assets (commonly referred
to as configuration items (CI)), as well as to descriptive
relationships between such assets.
When populated, the repository provides a means of
understanding:
• the composition of critical assets such as information systems
• the upstream sources or dependencies of assets
• the downstream targets of assets
Source: https://en.wikipedia.org/wiki/Configuration_management_database
22

23
ICT CMDB
23

24
Integrating ICT CMDB With BIA Findings
24
Impacts:
• Financial
• Operational
• Regulatory
• MTPD, MBCO,
RTOs, RPOs
• …
Will assist in defining the severity of
the change, consequently the priority
in updating the BCMS as required.

25
Sources to Capture Changes
• Risk management  ISO 31000 family;
• ICT Service Management  ISO 20000 family;
• Information Security Management  ISO 27000;
• Quality Management  ISO 9000 family;
• Supply Chain Management  ISO 28000;
• Environmental Management  ISO 14000.
We may use the same approach as used in
ICT Change Management.
25

26
WARNING
THE BCMS UPDATING PROCESS
WILL DEPEND UPON
THE UPDATING PROCESS
OF ALL OTHER DEPENDING
MANAGEMENT SYSTEMS.
26

27
Contacts
Sidney R. Modenesi, MBCI
Sidney_modenesi@strohlbrasil.com.br
+55 11 5583-0033
Skypeid sidneymd-strohl
Or
LinkedIn group "ISO 22301: Business Continuity Management
System, Implementation and Audit“
(https://www.linkedin.com/groups/8347186)
Thank you, very much for your attendance.
27

28
forma ou meio, em qualquer tempo, sem a prévia autorização por escrito da STROHL Brasil. 28
?
QUESTIONS
+55 11 5583-0033
sidney_modenesi@strohlbrasil.com.br
www.strohlbrasil.com.br
https://br.linkedin.com/in/sidneymodenesimbci
https://twitter.com/Sidney_STROHL
https://www.facebook.com/strohlbrasil/
THANK YOU

THE CHALLENGES IN KEEPING THE BCMS UP TO DATE (in accordance with ISO 22301)

Recomendados

Recomendados

Mais conteúdo relacionado

Destaque

Destaque (6)

Semelhante a THE CHALLENGES IN KEEPING THE BCMS UP TO DATE (in accordance with ISO 22301)

Semelhante a THE CHALLENGES IN KEEPING THE BCMS UP TO DATE (in accordance with ISO 22301) (20)

Mais de Sidney Modenesi, MBCI

Mais de Sidney Modenesi, MBCI (15)

THE CHALLENGES IN KEEPING THE BCMS UP TO DATE (in accordance with ISO 22301)