Description

BS 25999-2:2007 specifies requirements for planning, establishing, implementing, operating, monitoring, reviewing, exercising, maintaining and improving a documented BCMS within the context ofmanaging an organization’s overall business risks.

The requirements specified in BS 25999-2:2007 are generic and intended to be applicable to all organizations (or parts thereof), regardless of type, size and nature of business. The extent of applicationof these requirements depends on the organization’s operating environment and complexity.

It is not the intent of BS 25999-2:2007 to imply uniformity in the structure of a BCMS but for an organization to design a BCMS that is appropriate to its needs and that meets its stakeholders’ requirements.

These needs are shaped by regulatory, customer and business requirements, the products and services, the processes employed, the size and structure of the organization and the requirements of its stakeholders.

BS 25999-2:2007 can be used by internal and external parties, including certification bodies, to assess an organization’s ability to meet its own business continuity needs, as well as any customer, legal or regulatory needs.

Cross References:
BS EN ISO 9000:2005
BS EN ISO 9001:2000
BS EN ISO 14001:2004
BS ISO/IEC 17799:2005
BS ISO/IEC 20000-1:2005
BS ISO/IEC 20000-2:2005
BS ISO/IEC 27001:2005
BS ISO/IEC TR 13335-3:1998
BS ISO/IEC TR 13335-4:2000
ISO/IEC Guide 62:1996
ISO Guide 73:2002