Reference no: EM133337768

Question: Implementation Guidelines: In the case of any serious unexpected event, especially one that affects business continuity, it is important that information security does not 'fall by the wayside'. if allevel of security is necessary when things are going well, then it is also necessary when things are going wrong.- unless the organisation wishes to escalate a business continuity event into a combined business continuity event and information security incident.

It is therefore essential that information security is considered and included in the overall business continuity management process. The process that the organisation uses to manage and recover from crises (whether it is called the disaster recovery process, the business continuity process or something else) should have integrated into it the principle that information security remains important in a crisis and should make this possible. The organisation should identify and document its information security requirements for business continuity. These should be based upon clearly realised and authorised oblectives for information security in atvpical circumstances

If the organisation is dependent on the availability and reliability of services provided by a supplier, it should also check the plans that the supplier has put in place to deal with interruptions of its services.

The organisation should ensure that the levels of information security provided in suppliers' business continuity arrangements are sufficient for its requirements. It might also be worthwhile testing these situations to know what to expect in an emergency situation.