Organisations urged to certify on business continuity standard

Industry standards are often perceived as adding nothing but cost to business, but that does not appear to be true of the new British standard for business continuity.

Industry standards are often perceived as adding nothing but cost to business, but that does not appear to be true of the new British standard for business continuity.

Growing numbers of organisations in the UK and around the world have begun working towards certification on the standard since the requirements were published by BSI British Standards in November 2007.

Several companies, including TDG logistics and SunGard Availability Services, have certified on the standard in the past five months, and many, such as global consulting firm Watson Wyatt, have said they plan to certify by 2009.

A poll carried out by the organisers of this week's Business Continuity Expo 2008 showed that 60% of companies were considering certification.

But what makes BS 25999 different from other business management standards?

The answer lies partly in the fact that much consultation has gone into its development.

The standard, which has been in the pipeline since the publication of the first business continuity specification (PAS 56) in 2003, has been supported by a variety of public and private organisations., including the Cabinet Office Civil Contingencies Secretariat, the Financial Services Authority, the Post Office, Sainsbury's, and Royal and SunAlliance.

The UK government's involvement indicates that BS 25999 is likely to become part of future legislation, which is one good reason for many organisations to aim for certification.

More immediate drivers are likely to be direct business considerations such as competitive advantage, particularly for organisations trying to become or remain part of other companies' supply chains.

As the first business continuity standard to emerge and because of the likelihood it will evolve into an international standard, BS 25999 is widely expected to become a competitive imperative for supply chains.

The standard will enable organisations to assess suppliers' business continuity status quickly and focus on other areas of risk, making them more attractive than uncertified competitors.

Other business benefits include helping organisations to protect their brand and reputation as well as retain clients because of reduced risk, says John Hele, global product manager for BSI Management Systems.

The business advantages are clear, but certification on the standard is not achieved overnight, so suppliers of business continuity services are warning organisations not to delay.

Some predict that BS 25999 will be included in public sector regulations within a year and evolve into an international standard within two years.

Robin Gaddum, consultant at IBM business continuity and resiliency services, said it could take years to embed business continuity into an organisation's culture.

He said organisations should start the process now to ensure they are ready for when business continuity certification becomes necessary for regulatory compliance.

BS 25999 will be of value in terms of supply chain continuity assurance, competitive advantage, and in simplifying and reducing the costs of future regulatory compliance, but organisations need to get their act together soon.

Read more on IT risk management