业务连续性+·业务连续性问与答·Q9(下)
问题：
对业务连续性的管理涉及哪些关键步骤与活动？如何对其进行组织(下)？
回答：
业务连续性实务框架和业界主流的良好实践如ISO 22301、NFPA 1600及DRII PP有一定的对应的关系，详见下文中的交叉参考表：
……上两期回答了”一个好的业务连续性管理框架应符合5个原则”以及”业务连续性实务框架Ver2.0介绍”，以下接前面内容，给出业务连续性实务框架Ver2.0与ISO 22301：2012、NFPA 1600：2019和DRII Professional Practices 2017的交叉参考(较粗略，尽供参考)。
3. 业务连续性实务框架与ISO22301、NFPA1600及DRII PP的交叉参考表
| 业务连续性实务框架Ver2.0 (BCMPF Ver2.0) |
ISO 22301：2012 社会安全 - 业务连续性管理体系 - 要求 | NFPA 1600：2019连续性、应急和危机管理标准 | DRII Professional Practices 2017 (DRII PP) |
|---|---|---|---|
| 1.项目集管理 | |||
| A01 组织环境分析 | 4.1 了解组织和组织环境 | PP1 Program Initiation and Management | |
| A02 相关方识别和管理 | 4.2 理解相关方的需求和期望 | 4.6 Laws and Authorities | PP1 Program Initiation and Management PP10 Coordinating with External Agencies |
| A03 确定范围和目标 | 4.3 确定业务连续性管理体系的范围 6.2 业务连续性目标和实现计划 |
4.3 Performance Objectives | PP1 Program Initiation and Management |
| A04 业务连续性治理 | 5.3 方针 5.4 组织的角色、职责和权力 |
4.1 Leadership and Commitment 4.2 Program Coordinator 4.4 Program Committee |
PP1 Program Initiation and Management PP8 Business Continuity Plan Exercise, Assessment, and Maintenance |
| A05 业务连续性方针 | 5.3 方针 | 4.7 Resource Management | PP1 Program Initiation and Management |
| A06 项目集计划和路线图 | 6.2 业务连续性目标和实现计划 | 3.2 Planning | PP1 Program Initiation and Management |
| A07 项目集组件管理 | 7.1 运行规划和控制 8.3 制定和实施书面程序和计划 |
PP1 Program Initiation and Management | |
| A08 项目集维护和改进 | 9.1 监视、测量、分析和评价 10.1 不符合项和纠正措施 10.2 持续改进 |
PP1 Program Initiation and Management | |
| 2.能力规划 | |||
| B01 规划业务连续性能力框架 | 4.1 了解组织和组织环境 | 4.5 Risk Assessment | PP2 Risk Evaluation and Control |
| B02 风险评估 | 6.1 确定应对风险的措施 | 4.5 Risk Assessment | PP2 Risk Evaluation and Control |
| B03 业务影响分析 | 5.3 方针 | PP3 Business Impact Analysis | |
| B04 重要任务分析 | 7.1 运行规划和控制 8.3 制定和实施书面程序 |
||
| B05 业务连续性能力分析 | |||
| B06 核心能力及目标设定 | 6.1 确定应对风险的措施 6.2 业务连续性目标和实现计划 |
3.2 Planning | |
| 3.能力建设 | |||
| C01 应急组织和程序设计 | 7.4 沟通 | 5.1 Resource Management | PP4 Business Continuity Strategies |
| C02 预案编制、评审和发布 | 7.1 运行规划和控制 7.2.6 变更控制 7.5 文件化信息 |
6. Plans, Procedures, and Protocols | PP8 Business Continuity Plan Exercise, Assessment, and Maintenance |
| C03 关键资源建设 | 7.1 运行规划和控制 | 5.1 Resource Management | PP4 Business Continuity Strategies |
| C04 ICT连续性建设 | 7.1 运行规划和控制 | 5.1 Resource Management | PP5 Emergency Response and Operations PP7 IT/DR |
| C05 意识和培训 | 7.2 能力 7.3 意识 |
PP6 Awareness and Training | |
| C06 演练 | 8.4 验证其运行规划和控制 | 6.2 Training and Education 6.3 Exercises, Tests, Drills |
PP8 Business Continuity Plan Exercise, Assessment, and Maintenance |
| 4.能力运用 | 8.1 运行规划和控制 | ||
| D01 预防、减灾和准备 | 8.2 业务连续性计划和程序 | 3.3 Prevention and Mitigation | PP5 Emergency Response and Operations |
| D02 监测和预警 | 8.2 业务连续性计划和程序 | 3.4 Monitoring and Warning | PP5 Emergency Response and Operations |
| D03 应急响应 | 8.2 业务连续性计划和程序 | 3.5 Emergency Response | PP5 Emergency Response and Operations |
| D04 业务恢复 | 8.2 业务连续性计划和程序 | 3.6 Continuity and Recovery | PP5 Emergency Response and Operations |
| D05 事后重建 | 8.2 业务连续性计划和程序 | 3.7 Reconstruction and Resumption | |
| D06 危机管理和沟通 | 7.4 沟通 | 3.8 Crisis Communications | |
| 5.能力评估 | |||
| E01 监视和测量 | 9.1 监视、测量、分析和评价 | 4.8 Performance Monitoring and Evaluation | PP9 Business Continuity Program Management |
| E02 内部审核 | 9.2 内部审核 | PP9 Business Continuity Program Management | |
| E03 能力和能力要素评估 | 9.1 监视、测量、分析和评价 | PP9 Business Continuity Program Management | |
| E04 事件评估 | 9.1.2 评估 | PP8 Business Continuity Plan Exercise, Assessment, and Maintenance |
The End.