the challenges in keeping the bcms up to date (in accordance with iso 22301)

1ATENÇÃO: O conteúdo desta apresentação é CONFIDENCIAL. Nada poderá ser divulgado por qualquer forma ou meio, em qualquer tempo, sem a prévia autorização por escrito da STROHL Brasil.

Data Processing and Business Continuity in 2040

Febr

uary

15th

, 201

6

TO BE UPDATED BY PECB


Sidney R. ModenesiForum Leader

Sidney R. Modenesi is forum leader at Business Continuity Institute, also he is PECB partner and trainer. Mr. Modenesi has more than 30 years’ experience in Business Continuity and a strong

background in ICT.

+55 11 5583-0033

[email protected]

www.strohlbrasil.com.br

https://br.linkedin.com/in/sidneymodenesimbci

https://twitter.com/Sidney_STROHL

https://www.facebook.com/strohlbrasil/


Introductions

Sidney R. Modenesi• Manager at STROHL Brasil; • ISO 22301 BSI Technical Expert,

2013;• MBCI since 2006;• Over 35 years experience in

DRP and BCM;• Former ICT professional since

1977;• International BCM trainer (ISO

22301, 22313 & others);• BCI - Business Continuity

Institute forum leader in Brazil.

STROHL Brasil• Brazilian company;• 20+ years dedicated solely to

BCM;• Solid and proved experience

in many different industries;• Providing consultancy, training

and BCM software;• Sungard Availability Service

Authorized Representative in Brazil;

• PECB training partner.

333


Agenda

In today´s webinar we will talk about the challenges in keeping the BCMS up to date, in accordance with ISO 22301.

And also we will talk about: the potential risks in not monitoring

and updating the BCMS timely; the potential benefits in using other

Management Systems to feed updates in the BCMS;

key control points to capture organizational changes that affect the BCMS.

4


ISO 22301 REQUIREMENTS FOR CHANGES AND UPDATES

5


Changes and Updates

• 5.3 PolicyThe BCMS policy shall- be reviewed for continuing suitability at defined

intervals and when significant changes occur.

• 7.5.3 Control of documented informationFor the control of documented information, the organization shall address the following activities, as applicable- control of changes (e.g. version control),

6


Changes and Updates

• 8.1 Operational planning and controlThe organization shall control planned changes and review the consequences of unintended changes, taking action to mitigate any adverse effects, as necessary.

• 8.5 Exercising and testingg) are conducted at planned intervals and when there are significant changes within the organization or to the environment in which it operates.

7


Changes and Updates

• 9.1.2 Evaluation of business continuity proceduresb) These evaluations shall be undertaken through periodic reviews, exercising, testing, post-incident reporting and performance evaluations. Significant changes arising shall be reflected in the procedure(s) in a timely manner;d) The organization shall conduct evaluations at planned intervals and when significant changes occur.

8


Changes and Updates

• 9.3 Management reviewTop management shall review the organization’s BCMS, at planned intervals, to ensure its continuing suitability, adequacy and effectiveness.b) changes in external and internal issues that are relevant to the business continuity management system.Management reviews shall consider the performance of the organization, including:- the need for changes to the BCMS, including the

policy and objectives,- any changes that could affect the BCMS, whether

internal or external to the scope of the BCMS.

9


Changes and Updates

The outputs of the management review shall include decisions related to continual improvement opportunities and the possible need for changes to the BCMS, and include the following:

d) modification of procedures and controls to respond to internal or external events that may impact on the BCMS, including changes to:1) business and operational requirements,

2) risk reduction and security requirements,

3) operational conditions and processes,

4) legal and regulatory requirements,

5) contractual obligations,

6) levels of risk and/or criteria for accepting risks,

7) resource needs,

8) funding and budget requirements; and

e) how the effectiveness of controls are measured.

10


Changes and Updates

• 10.1 Nonconformity and corrective action7) making changes to the BCMS, if necessary.

f) make changes to the business continuity management system, if necessary.

11

12ATENÇÃO: O conteúdo desta apresentação é CONFIDENCIAL. Nada poderá ser divulgado por qualquer forma ou meio, em qualquer tempo, sem a prévia autorização por escrito da STROHL Brasil. 12


Changes and Updates

• 8.1 Operational planning and controlThe organization shall control planned changes and review the consequences of unintended changes, taking action to mitigate any adverse effects, as necessary.

• 3.47 resourcesall assets, people, skills, information,technology (including plant and equipment),premises, and supplies and information(whether electronic or not) that anorganization has to have available to use, when needed, in order to operate and meet its objective.

13


THE REALITY OF THE PDCA

14


The reality of the PDCA

• Exercises and Tests• Reactive corrections in the Recovery Strategy, Plans or any other non conformity found

• Recovery Strategy Implementation

• Plan Development• Training

• BIA• Risk Assessment• Recovery Strategy

Plan Do

CheckAct

15



Changes

Changes

More changes

Even more changes

16

timePlan Do Check Act

BCMS

ORGANIZATIONGa

ps -

Risk

s



The longer we take to identify and react to any

change in any organizational resource,

overtime less efficient will be the BCMS, increasing the organizational risk in the event of a disruptive

incident

17


CAPTURING CHANGES

18


Capturing Changes

From ISO 31000:2009(E) Risk management — Principles and guidelines

3 PrinciplesFor risk management to be effective, an organization should at all levels comply with the principles below.

b) Risk management is an integral part of all organizational processes.

Risk management is not a stand-alone activity that is separate from the main activities and processes of the organization. Risk management is part of the responsibilities of management and an integral part of all organizational processes, including strategic planning and all project and change management processes.

19


Change Management

Change Management (CM) refers to any approach to transitioning individuals, teams, and organizations using methods intended to re-direct the use of resources, business process, budget allocations, or other modes of operation that significantly reshape a company or organization.

Source: https://en.wikipedia.org/wiki/Change_management

20


Capturing Changes – ICTChange Management Process

21

Triggers BCMS Update

Most likelyDRP Plans


ICT CMDB

A Configuration Management Data Base (CMDB) is a repository that acts as a data warehouse for information technology (IT) installations.

It holds data relating to a collection of IT assets (commonly referred to as configuration items (CI)), as well as to descriptive relationships between such assets.

When populated, the repository provides a means of understanding:• the composition of critical assets such as information systems• the upstream sources or dependencies of assets• the downstream targets of assets

Source: https://en.wikipedia.org/wiki/Configuration_management_database

22


ICT CMDB

23


Integrating ICT CMDB With BIA Findings

24

Impacts:• Financial• Operational • Regulatory• MTPD, MBCO,

RTOs, RPOs• …

Will assist in defining the severity of the change, consequently the priority

in updating the BCMS as required.


Sources to Capture Changes

• Risk management ISO 31000 family;• ICT Service Management ISO 20000 family;• Information Security Management ISO 27000;• Quality Management ISO 9000 family;• Supply Chain Management ISO 28000;• Environmental Management ISO 14000.

We may use the same approach as used inICT Change Management.

25


WARNING

THE BCMS UPDATING PROCESSWILL DEPEND UPON

THE UPDATING PROCESSOF ALL OTHER DEPENDINGMANAGEMENT SYSTEMS.

26


Contacts

Sidney R. Modenesi, MBCI

[email protected]

+55 11 5583-0033

Skypeid sidneymd-strohl

Or

LinkedIn group "ISO 22301: Business Continuity Management System, Implementation and Audit“ (https://www.linkedin.com/groups/8347186)

Thank you, very much for your attendance.

27

mailto:[email protected]

28ATENÇÃO: O conteúdo desta apresentação é CONFIDENCIAL. Nada poderá ser divulgado por qualquer forma ou meio, em qualquer tempo, sem a prévia autorização por escrito da STROHL Brasil. 28

?QUESTIONS

+55 11 5583-0033

[email protected]

www.strohlbrasil.com.br

https://br.linkedin.com/in/sidneymodenesimbci

https://twitter.com/Sidney_STROHL

https://www.facebook.com/strohlbrasil/

THANK YOU

the challenges in keeping the bcms up to date (in accordance with iso 22301)

Technology