British Standard BS25999

BS25999 was a two-part BCM standard which brought a more structured approach to implementing the BCM cycle.

BS25999 was developed by British Standards Institution (BSI), replacing Publicly Available Specification 56 (PAS56). BS25999 was developed by practitioners throughout the business continuity community, drawing upon their academic, technical and practical experiences of BCM. It was produced to provide a system based on good practice for BCM.

There are two parts to the BS25999. The first, “BS25999-1:2006 Business Continuity Management. Code of Practice”, takes the form of general guidelines and seeks to establish processes, principles and terminology for Business Continuity Management. It was published in 2006 and withdrawn in 2013 when the International Standard ISO22313 ″Societal Security — Business continuity management systems — Guidance″, was published. The second, “BS25999-2:2007 Specification for Business Continuity Management”, specifies requirements for implementing, operating and improving a documented Business Continuity Management System (BCMS), describing only requirements that can be objectively and independently audited. It was published in 2007 and was also withdrawn in 2012 following the publication of ISO22301 “Societal Security — Business continuity management systems — Requirements″.

 

The BCM life cycle

With the publication of BS25999-1, a new illustration regarding the BCM life cycle was introduced.

The Plan-Do-Check-Act (PDCA) methodology can be related Business Continuity Management System (BCMS) as below:

In the BCM life cycle illustration, the ‘BCM programme management’ and ‘Embedding BCM in the organisation’s culture’ refers to the Plan, Check, and Act portion in the PDCA cycle. The rest of the cycle (Understanding the organization, Determining BCM strategy, Developing and implementing BCM response, and Exercising, maintaining and reviewing) represent the Do element of the cycle.