According to an international standard ISO 22301, BCM is defined as a “holistic man- agement process that identifies potential threats to an organization and the impacts to business operations those threats, if realized, might cause, and which provides a frame- work for building organizational resilience with the capability of an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities” (ISO 22301:2012, 2). Before drilling down further into the contents of this process, it is imperative to explain the significance of the fact this definition comes from the International Organization for Standardization, the ISO. This analysis will also shed light to the decision to select the ISO 22301 as the regulation to adhere to while evaluat- ing and developing the BCM maturity model.
From the regulations and standards perspective, five phases can be recognized in the history of BCM – the first four of which were introduced by Herbane (2010a) and the fifth which can be argued to have emerged since 2012. These five phases, their drivers, practices and nature of progress are presented in Table 5.
Table 5 Development of business continuity management (further developed from Her- bane 2010a, 992)
The first initiative forcing companies to consider disaster recovery and business con- tinuity related issues came from the US, where the Flood Disaster Protection Act was introduced in 1973. Eventually the regulation was expanded from covering a single type of disaster to covering whole fields of industry and disaster scenarios, by introducing legislation such as the Health Insurance Portability and Accountability Act (HIPAA) in 1996, the Telecommunications Act in 1996 and the Gramm–Leach–Bliley Act in 1999. This first phase, from mid-1970s to mid-1990s, represents the emerging legislation phase (Herbane 2010a, 985).
Although the importance of business continuity for certain industries was recognized during the emerging legislation phase, it was not until the second phase, the emerging standards phase stretching from mid-1990s to 2001, when the first standards emerged bringing business continuity into the focus across industries and also outside the US (Herbane 2010a, 986).
During the second phase, the “control objectives for information and related technol- ogy version 4.0” (COBIT 4.0), a good practices guideline for IT management and gov-
ernance, was introduced by the IT Governance Institute (ITGI) and the Information Sys- tems Audit and Control Association (ISACA) in 1992. Ensuring continuous service was now incorporated to the high level control objectives, which explicitly recognized busi- ness continuity management as a suggested solution (Herbane 2010a, 986).
Furthermore, in the US the National Fire Protection Association (NFPA) published a set of business continuity guidelines in 1995, and eventually the NFPA 1600 “standard for disaster/emergency management and business continuity programs” in cooperation with BCI and DRI in 2000 (Herbane 2010a, 986). Another important initiative during this phase came from the Ministry of Defence in United Kingdom, as they published the ministry‟s continuity management policy and good practices called “Joint service publi- cation 503 – business continuity management” in 2000. It was based on the BCI‟s BCM model (Herbane 2010a, 986), which eventually transformed via the “BCM Good Prac- tice Guidelines” published in 2002 to the widely adopted BS 25999 standard published in November 2006 (Gallagher 2007, 34).
The third phase, from 2002 to 2005, emerged from the aftermath of the terrorist at- tacks on September 11 in 2001 in the US, where three hijacked airplanes were crashed to the World Trade Center and Pentagon causing massive casualties and numerous companies going out of business. According to a Business Operations Specialist Car- olyn Castillo of Boeing‟s Navigation Systems Programme (2004, 9), not only did the lessons learned from these events affect one of the largest global companies in the aero- space industry, but it had given a “new meaning to disaster preparedness and Business Continuity Planning”. Indeed, the event triggered a series of new business continuity guidelines and regulations being published not only in the US, but also in Europe, Asia, Africa and Middle-East. Most of the regulation was targeting the financial institutions, public authorities and utilities sector (Herbane 2010a, 988).
During the third phase, the BCI published BCM “Good practice guidelines”. These guidelines influenced the publication of “Publicly available specification (PAS) 56: Guide to business continuity management” by the British Standards Institution (BSI), which was a discussion document related to proposing a new standard for BCM. Unlike any similar PAS document before, the PAS 56 received a huge interest in the organiza- tions internationally, as 2500 responses to the document were received (Gallagher 2007, 34; Mason 2010, 423).
At the verge of the fourth phase driven by competing standards, a CFO and executive vice president of an information storage and management company was quoted claim- ing: “I recently saw a statistic that there are 16 000 regulations around the world related to internal controls and business continuity” (Krell 2006, 21). Whether the claim was accurate or not is irrelevant – the point being regulations were fragmented across indus- tries and countries and there was still no consensus over a global standard.
As the BSI combined the BCM body of knowledge from the PAS 56 and its feed- back, the BCI Good Practice Guidelines, the Australian BCM standard HB 221, NFPA 1600 and the parts from Information Technology Infrastructure Library (ITIL) covering IT service continuity, it subsequently introduced the British Standard BS 25999 at a record-breaking speed in November 2006 (Gallagher 2007, 34; Mason 2010, 423). Not only was the BS 25999 published in a record-breaking time since the inception of PAS 56, but it became also the best-selling standard in the number of global sales (Mason 2010, 423).
The standard was divided in two parts, the BS 25999-1 describing the overall objec- tives, guidance and recommendations and the BS 25999-2 describing the requirements for a BCM system. Furthermore, the second part was auditable, which enabled organi- zations to certify their compliance via third party auditors (Tammineedi 2010, 37). The core of BS 25999 was formed from the BCM policy, BCM program management, un- derstanding the organization, determining business continuity strategy, developing and implementing a BCM response, exercising, maintaining and reviewing BCM arrange- ments and embedding BCM in the organization‟s culture (Tammineedi 2010, 37–38; Herbane 2010a, 989; Mason 2010, 424). Together these six factors formed the business continuity life cycle presented in Figure 4, which aimed at representing the continuous operation of the business continuity program (Mason 2010, 424).
Figure 4 The business continuity life cycle in BS 25999 (Mason 2010, 427)
During the fourth phase from 2006 to 201, the internationalization of BCM standards begun, as national BCM standards were being increasingly transformed into interna- tional standards and at the same time the ISO was introducing new international stand-
ards (Herbane 2010a, 990). Business continuity was now mentioned as a subset in the ISO 27000 series of standards related to information security (Mason 2010, 424), the Singaporean business continuity standards for business continuity and disaster recovery service providers had been transformed into an international standard ISO/IEC 24762, and the ISO/IEC 27031 standard was trying to merge the national standards NFPA 1600, BS 25999, HB 221 and the Japanese and Israeli equivalents into one international standard (Herbane 2010a, 990).
Although the BSI had started this phase by introducing the BS 25999 which quickly gained international attention in organizations (Mason 2010, 428), it was still unclear which standard would become the de facto international BCM standard or whether such standard was even required, as the repository of national standards was so vast (Herbane 2010a, 990).
One could argue the race for the de facto international BCM standard was started as the ISO workshop on “Emergency preparedness” gathered in Italy in 2006. During the workshop, the experts were arguing over the best national standard suited for interna- tionalization. After identifying the similarities between the national standards a consen- sus was eventually found, and the results were published as a guidance document ISO/PAS 22399 in 2007 (Tangen & Austin 2012).
Almost simultaneously at the other side of the Atlantic a project with similar objec- tives was established by the American Society for Industrial Security (ASIS) (Stack 2008). This initiative was objected by the Disaster Recovery Institute International (DRII), which claimed the NFPA 1600 was already an internationally recognized stand- ard in the field and that another new BCM standard would add confusion in the industry (Herbane 2010a, 990). The open letter sent as a response from ASIS to the DRII‟s ob- jections reflects their motive to create a BCM standard which would eventually be se- lected as the basis of the upcoming BCM ISO standard (American Society for Industrial Security 2008). Despite the resistance, ASIS eventually managed to publish a national standard, “ASIS SPC.1-2009: Organizational Resilience: Security, Preparedness and Continuity Management Systems – Requirements with Guidance for Use” (Stack 2009). The fifth and the current phase in the development of BCM can be argued to have started in 2012, as the race for the international BCM standard was finished upon the introduction of ISO 22301 “Societal security – Business continuity management sys- tems – Requirements” and the optional complementary standard ISO 22313 “Societal security – Business continuity management systems – Guidance” (Tangen & Austin 2012). The BS 25999 was used as the main foundation of the new ISO 22301 (Sharp 2012, 4), although the NFPA 1600, ASIS SPC.1 along with the Israeli, Singaporean and Japanese equivalents are also listed in its bibliography (ISO 22301:2012, 24).
As a consensus on the content of an international BCM standard seems to have been finally found, validating the adequacy of existing frameworks for assessing the maturity
of BCM in organizations in the light of this new consensus seems justified. Further- more, this contributes to the study of problem relevance – the first phase in the maturity model development process as suggested by Becker et al. (2009, 218). Before going further into evaluating the existing maturity models in the application domain of BCM, drilling down to the contents of the ISO 22301 standard is required for a more compre- hensive understanding of the topic.