Commentary: ASIS BCM Standard
At the recent BCI board of directors meeting in Brighton, England, there was a discussion on BCM standards development activities in Europe, particularly at the ISO level. According to board members who are active in the standards committees, it could be another 18 months or so before we see a definitive global BC standard from the ISO. The BCI board is also keenly aware of the ASIS BCM project and is keeping a close eye on things.
In the discussion we learned that there are currently two publicly available specifications (PAS) in play that could evolve into the ISO standard. The first is PAS 22399 (known as Societal Security), and one of the board members is involved with the committee working on that document.
The second important player is PAS 22301, which is quite new, and is thought to include elements of BS 25999 Part 2 in addition to the well-known Plan-Do-Check-Act (PDCA) process. A similar committee to the one for PAS 22399 is being formed to address PAS 22301.
As noted in the discussion, the two committees will be operating in parallel; work associated with PAS 22301 may be completed before the final work is done on PAS 22399. What happens after that remains to be seen. Curiously, a search of the ISO web site indicated no PAS or other document with the 22301 designation. It must be very recent.
Analysis
It’s very likely that people in this country involved in the ASIS project have current intel regarding the global BC standard development process; otherwise, it would make little sense to go through the effort to supersede NFPA 1600 with a new American national standard. Perhaps the ASIS effort is being made so that Title IX afficionados will have an accepted American standard for certification and audit purposes. We believe you’ll find that people involved with the new ASIS effort will take a very hard look at the British standards, especially BS 25999 and others also in play. This explains the presence of the British Standards Institution (BSI) in the ASIS project team. It may be the underlying ASIS strategy to create an American standard (ahead of the 18-month distant global standard, so we get some bragging rights) that maps closely to the future global standard, thus obviating the need for America to acknowledge and adopt yet another ISO standard (recall ISO 17799/27001 et al) in lieu of its own home-grown one. There are major politics at play here, to be sure.
Paul Kirvan, FBCI, CBCP, CISSP
Member of the Board, The Business Continuity Institute
Note: Any opinions expressed in this blog are the author’s and do not represent the Business Continuity Institute’s position.
Tags: Business Continuity Management, Business continuity standards
