The ISO 22399 / PAS 22399 Dilemma
The business continuity story just gets stranger and stranger. We have covered this previously, with respect to ISO 27031. However, as events unfold the situation becomes ever more tangled.
To recap, there are a host of developments with respect to business continuity and standardization:
1) We have pondered where BSI's useful looking business continuity management standard BS 25999-1 fits into the equation. Even with respect to their own standard set they also have a related publication PAS77, and are developing a standard BS 25777 from this. The second part of BS 25999 was in fact published this week, and as a specification, third party certification schemes will soon be in place.
2) Even within ISO though, the water is as clear as mud. A new standard, ISO 22399 (specifically ISO/PAS 22399) has just been published. This is a "Guideline for incident preparedness and operational continuity management".
Great: so where does this (ISO22399) fit with respect to ISO 27031? And what about chapter 14 of ISO 27002? Or ISO 27001? Let alone all those developments over at BSI, who seem far more advanced in the area.
One might ask what exactly is going on here? How do all these developments relate? Do ISO actually have any idea themselves?
If they do in fact have a road map or overview of all these overlapping standards, it would be nice if they shared it with the public. Our guess is that no such document exists, which is rather bad news for standardization in this area.