http___www.iso27001standard.com_hr_1.xml
1.1 2.1 3.1 3.2 4.1 5.1 6.1 6.2 7.1 8.1 9.1 10.1 10.2 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 39.1 40.1 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1
ISO 22301 Basics What is ISO 22301? The full name of this standard is ISO 22301:2012 Societal security – Business continuity management systems – Requirements. This standard is written by leading business continuity experts and provides the best framework for managing business continuity in an organization. One of the features that differentiates this standard compared to other business continuity frameworks/standards is that an organization can become certified by an accredited certification body, and will therefore be able to prove its compliance to its customers, partners, owners and other stakeholders. Relationship with BS 25999-2 ISO 22301 has replaced 25999-2 – these two standards are rather similar, but ISO 22301 could be considered an upgrade from BS 25999-2. For differences between these two standards see ISO 22301 vs. BS 25999-2 infographic. What are the benefits of business continuity? When implemented properly, business continuity management will decrease the possibility of a disruptive incident, and if such incident occurs an organization will be ready to respond in an appropriate way, and thus drastically decrease the potential damage of such incident. Who can implement this standard? Any organization – large or small, for profit or non-profit, private or public. The standard is conceived in such a way that it is applicable to any size or type of organization. How does business continuity fit into overall management? Business continuity is part of overall risk management in a company, with overlapping areas with information security management and IT management. Note: Risk management is part of overall corporate management. Basic terms used in a standard - Business Continuity Management System (BCMS) – part of an overall management system that takes care business continuity is planned, implemented, maintained, and continually improved - Maximum Acceptable Outage (MAO) – the maximum amount of time an activity can be disrupted without incurring unacceptable damage (also Maximum Tolerable Period of Disruption – MTPD) - Recovery Time Objective (RTO) – the pre-determined time at which an activity must be resumed, or resources must be recovered - Recovery Point Objective (RPO) – maximum data loss, i.e., minimum amount of data that needs to be restored - Minimum Business Continuity Objective (MBCO) – the minimum level of services or products an organization needs to produce after resuming its business operations Content of ISO 22301 The standard includes these sections: Mandatory documentation If an organization wants to implement this standard, the following documentation is mandatory: - List of applicable legal, regulatory and other requirements - Scope of the BCMS - Business Continuity Policy - Business continuity objectives - Evidence of personnel competences - Records of communication with interested parties - Business impact analysis - Risk assessment, including risk appetite - Incident response structure - Business continuity plans - Recovery procedures - Results of preventive actions - Results of monitoring and measurement - Results of internal audit - Results of management review - Results of corrective actions Related standards Other standards that are helpful in implementation of business continuity are: - ISO/IEC 27031 – Guidelines for information and communication technology readiness for business continuity - PAS 200 – Crisis management – Guidance and good practice - PD 25666 – Guidance on exercising and testing for continuity and contingency programmes - PD 25111 – Guidance on human aspects of business continuity - ISO/IEC 24762 – Guidelines for information and communications technology disaster recovery services - ISO/PAS 22399 – Guideline for incident preparedness and operational continuity management - ISO/IEC 27001 – Information security management systems – Requirements
1.1 3.1 4.1 5.1 5.2 6.1 6.2 7.1 8.1 8.2 8.3 9.1 9.2 10.1
Jednostavniji i brži način implementacije Pogledajte naše proizvode za samostalnu implementaciju Razvili smo razne online proizvode koji će vam omogućiti da samostalno implementirate sustav upravljanja informacijskom sigurnošću i/ili sustav upravljanja kontinuitetom poslovanja, i to 50% brže. Norma ISO 27001 propisuje na koji način organizirati informacijsku sigurnost u bilo kojoj vrsti organizacije, bez obzira da li se radi o profitnoj ili neprofitnoj, privatnoj ili državnoj, maloj ili velikoj. Možemo slobodno reći da je ovo temeljna norma za upravljanje informacijskom sigurnošću. ISO 27001 znači za informacijsku sigurnost isto ono što ISO 9001 znači za kvalitetu – to je norma koju su pisali najbolji svjetski stručnjaci u polju informacijske sigurnosti, i svrha joj je da pruži metodologiju na koji način uvesti informacijsku sigurnost u neku organizaciju. Ona isto tako pruža mogućnost da organizacija dobije certifikat što znači da je nezavisno certifikacijsko tijelo potvrdilo da je informacijska sigurnost na najbolji način provedena u dotičnoj organizaciji. BS 25999-2 je britanska norma izdana 2007. godine, i u kratko vrijeme je postala glavna norma za upravljanje kontinuitetom poslovanja – iako se radi o nacionalnoj britanskoj normi ona se koristi i u mnogim drugim zemljama, i predviđa se da će se uskoro prihvatiti kao međunarodna (ISO 22301) norma. Kao i ISO 27001, ISO 9001, ISO 14001 i ostale norme koje propisuju sustave upravljanja, i BS 25999-2 propisuje sustav upravljanja kontinuitetom poslovanja (engl. BCMS – business continuity management system) koji u sebi sadrži iste četiri faze upravljanja: planiranje, implementaciju, pregledavanje i praćenje, te na kraju poboljšavanje. Smisao te četiri faze jest da se sustav kontinuirano ažurira i poboljšava, kako bi bio upotrebljiv u situacijama kada dođe do havarije. Puni naziv ovog standarda je ISO 22301:2012 Societal security – Business continuity management systems – Requirements (za sada ne postoji službeni prijevod na hrvatski jezik). Ovaj standard su pisali vodeći stručnjaci za kontinuitet poslovanja, i on pruža najbolji okvir za upravljanje kontinuitetom poslovanja u organizaciji. Jedna od stvari po čemu se ovaj standard razlikuje od ostalih metodologija i standarda za kontinuitet poslovanja jest što se organizacije mogu certificirati po ISO 22301 od strane akreditiranih certifikacijskih kuća, i na taj način dokazati svoju sukladnost prema svojim klijentima, partnerima, vlasnicima i ostalim zainteresiranim stranama.