AS/NZS 5050:2010

AS/NZS 5050:2010 BUSINESS CONTINUITY-MANAGING DISRUPTION-RELATED RISK

PREFACE

CONTENTS

FOREWORD

SECTION 1 SCOPE AND GENERAL

1.1 SCOPE

1.2 REFERENCED DOCUMENTS

1.3 DEFINITIONS

1.3.1 Activation

1.3.2 Assurance

1.3.3 Audit

1.3.4 Business impact analysis (BIA)

1.3.5 Business function

1.3.6 Capability

1.3.7 Communication and consultation

1.3.8 Contingency plan

1.3.9 Contingent capability

1.3.10 Control

1.3.11 Consequence

1.3.12 Crisis

1.3.13 Critical business function

1.3.14 Critical objectives

1.3.15 Disruption-related risk

1.3.16 Establishing the context

1.3.17 Event

1.3.18 External context

1.3.19 Infrastructure

1.3.20 Internal context

1.3.21 Likelihood

1.3.22 Maximum acceptable outage (MAO)

1.3.23 Monitoring

1.3.24 Mutual aid

1.3.25 Recovery

1.3.26 Recovery Time Estimate (RTE)

1.3.27 Resilience

1.3.28 Review

1.3.29 Risk

1.3.30 Risk analysis

1.3.31 Risk assessment

1.3.32 Risk criteria

1.3.33 Risk evaluation

1.3.34 Risk identification

1.3.35 Risk management

1.3.36 Risk management framework

1.3.37 Risk register

1.3.38 Risk source

1.3.39 Risk treatment

1.3.40 Stabilization

1.3.41 Stakeholder

1.3.42 Through chain

1.3.43 Top management

1.3.44 Vulnerability

SECTION 2 PRINCIPLES

SECTION 3 FRAMEWORK

3.1 GENERAL

3.2 MANDATE AND COMMITMENT

3.3 DESIGN

3.3.1 The organization and its context

3.3.2 Establishing the policy

3.3.3 Accountability

3.3.4 Integration

3.3.5 Resources

3.3.6 Communication and reporting

3.4 IMPLEMENTATION

3.5 MONITORING AND REVIEW OF THE FRAMEWORK

3.6 CONTINUAL IMPROVEMENT OF THE FRAMEWORK

SECTION 4 THE PROCESS

4.1 GENERAL

4.2 ESTABLISHING THE CONTEXT

4.2.1 General

4.2.2 Objectives

4.2.3 Establishing the external context

4.2.4 Establishing the internal context

4.2.5 Defining risk criteria

4.2.6 Establishing the purpose, scope and structure of the particular risk management activity

4.3 RISK ASSESSMENT

4.3.1 Overview

4.3.2 Risk identification

4.3.3 Risk analysis

4.3.4 Risk evaluation

4.4 RISK TREATMENT

4.4.1 General

4.4.2 Proactive risk treatment

4.4.3 Contingency plans and contingent capability

4.4.4 Maintain the plans

4.4.5 Exercise the plans

4.5 COMMUNICATION AND CONSULTATION

4.6 MONITORING AND REVIEW

4.7 RECORDING AND DOCUMENTATION

4.7.1 General

4.7.2 Recording the risk management process

4.7.3 Contingency plan documentation

SECTION 5 VERIFICATION

APPENDIX A - ATTRIBUTES OF EFFECTIVE MANAGEMENT OF DISRUPTION-RELATED RISK

A1 GENERAL

A2 OUTCOME ATTRIBUTES

A3 PROCESS ATTRIBUTES

A3.1 Continual improvement

A3.2 Full accountability for disruption-related risks

A3.3 All related decision-making involves consideration of disruption-related risk

A3.4 Continual communications

A3.5 Full intefreation into the organization™s governance structure