기업, 조직이 얼마나 효과적으로 비즈니스연속성관리체계(BCP)를 수립, 운영하는지, 어느정도의 성숙도와 품질 수준인지를 판단하기는 매우 어렵고, 이를 가이드 하는 것 역시 난제다. 비즈니스연속성(BCP), 보안(security), 정보시스템, 커뮤니케이션, 리스크관리 등 어떤 쪽에 비중을 더 두고 있던지 간에 BCP 수립과 관련된 너무도 많은 권고안, 가이드라인 등에 갈피를 못 잡고 있는 것이 현실이다. 또한 제조업, 금융업, 서비스업, 도소매/유통 등 산업별로 다양한 요건 등을 수용하는 것 등 앞길은 더욱 복잡하기만 하다.
There has been a great deal of difficulty in determining the effectiveness and quality of an organization’s business continuity process and where to turn for the best guidance regarding how to build an effective program. This has particularly been an issue in multiple industries where there has been no single form of consensus. Whether your background is focused on business continuity, security, information technology, communications, risk management or any other competency, you most likely feel besieged by an overabundance of recommendations, guidelines and general thoughts regarding how to plan for continuity of operations. Add to that the different needs of manufacturing, banking, service, retail and hospitality organizations (to name a few), and the path forward becomes quite complicated.

2007년에 BCP체계에 대한 인증이 처음 개발되었고, 제3자에 의한 BCP체계 평가(external validation)는 경영진뿐 아니라 주주, 고객 등 조직, 기업의 이해관계자들에게 신뢰를 줄 수 있다는 점에서 긍정적인 효과를 가져올 수 있다. 이러한 인증평가 도입은 아직 초기단계이지만 이미 품질관리(quality), 보안(security)와 안전(safety) 프로세스에 대한 관리체계 관련 다양한 표준인증평가체계가 이미 보편화되어 있어 시간이 지남에 따라 이러한 인증평가체계는 그 가치(business value)를 인정받기 시작하고 있다.
But what could be a promising new development took place beginning in 2007 - the introduction of organizational business continuity certification. External validation of a business continuity process could offer credibility to executive management, shareholders and customers - as well as much needed focus and visibility. Although business continuity certification is new, some businesses are already familiar with certifications for a wide variety of disciplines, including quality, security and safety processes. These efforts all evolved over time and have been accepted by industry because they provide business value.

여기서는 BCM 영국표준인 BS 25999와 대비(준비상태) (voluntary preparedness)에 대한 인증 프로세스를 정의한 법령 제9조(타이틀 나인, Title IX)을 비교해보았다. (이 글을 쓰는 저자의 의도는 인증프로세스와 표준 (예로, NFPA 1600, DRII가 제시하는 10가지 BCP 모범실천기준)의 도입, 적용이 기업, 조직의 비즈니스연속성 역량확보와 준비상태를 성숙화, 고도화하는데 도움이 된다는 것을 전제로 한 것이다.)
This article explores two emerging business continuity certifications ? British Standard (BS) 25999 and the Title IX voluntary preparedness certification process. Perhaps even more important, it is the author’s intent to make the case for using certification processes and standards (any standard that makes business sense, such as National Fire Protection Association Standard 1600 and Disaster Recovery Institute International’s Ten Professional Practices) to “do something” and advance business continuity readiness ? even if certification isn’t right for your organization today.

BS 25999란 무엇인가?
조직 내에 리스크관리 관련 프로세스와 실천사항을 비즈니스연속성과 통합, 개발하고 이를 구현하는 기반을 제공하며 궁극적으로 이해관계자에게 신뢰를 주는 표준이다. 실행지침(the code of practice)인 part 1과 인증규격(the specification)인 part 2로 구성되어 있으며, part 2는 2007년11월에 규격이 최종 발표되었다. Part 2의 발표로 인해 조직, 기업의 비즈니스연속성체계에 대한 제3자 심사 및 인증이 가능해졌다.
What is BS 25999?
Authored by the British Standard Institution, BS 25999 replaces PAS 56 as an “umbrella” standard providing a basis for understanding, developing and implementing business continuity within an organization, to integrate risk management disciplines and processes with business continuity, and to provide confidence in business-to-business and business-to-customer dealings. BS 25999 is written in two parts. Part 1, the Code of Practice (published November 2006), outlines the standard’s overall objectives, guidance and recommendations. Part 2, the Specification (published November 2007), details the activities that should be completed in order to meet business continuity objectives within the context of an organization’s view of business risk. Part 2 is also designed to be “auditable,” meaning only objective, measurable concepts are included in the Specification.

BCP 분야에서 처음으로 표준으로 발표된 BS 25999는 여타 국제적인 인증규격과 마찬가지로 표준에서 정의하고 있는 BCM체계의 구성요소와 문서화의 충실성과 일관되고 효과적인 운영을 문서심사와 실제(현장)심사를 통해 총괄적으로 제3자의 평가와 감사를 요구하고 있다.
A first of its kind in the business continuity industry due to the all-encompassing nature of the standard and the accompanying certification effort, BS 25999 compliance certification is demonstrated by independent assessment against BS 25999-2 (the Specification). Like all other certifiable international standards, BS 25999 certification requires a thorough assessment process to ensure the organization has properly documented and addressed all the elements of the standard and that the Business Continuity Management System (BCMS) is operating effectively and consistently.

법령 제9조(타이틀 나인, Title IX)이란 무엇인가?
9/11 진상조사위원회(9/11 commission)의 권고사항이 민간 기업/조직을 대상으로 한 자발적 대비(준비상태)에 대한 표준과 인증프로세스를 제시하고 있는 공법(public law) 110-53로 발전하였으며, 2007년 8월에 대통령 승인으로 법안이 통과, 제정되었다. 법령 제9조는 다음의 목적을 가지고 있다. 민간부문에 대한 자문, 권고사항과 가이드 개발, 모범 실천사례 확보, 자발적 표준 활용, 자발적으로 필요에 의해 원하는 민간부문의 준비상태를 인증하는 프로그램의 개발, 인증프로그램의 관리와 구현, 민간부문을 인증 평가하는 역량 제시, 표준 인증에 대한 대비와 적용의 비즈니스적 필요성 제시 등이다.
What is Title IX?
The 9/11 commission recommendations evolved into Public Law 110-53, which provides for a voluntary preparedness standard and certification process for private sector organizations. This legislation was passed in the House (371-40), in the Senate (85-8), and signed into law by President Bush on August 3, 2007. Title IX, a section of Public Law 110-53, refers to the “voluntary” private sector preparedness certification and accreditation program. Title IX’s goals included the following:
ㆍConsultation with the private sector
ㆍDevelop guidance or recommendations
ㆍIdentify best practices
ㆍUse voluntary consensus standards
ㆍDevelop and promote a program to certify the preparedness of private sector entities that voluntarily choose to seek certification
ㆍManage and implement accreditation and certification programs
ㆍDemonstrate ability to certify private sector entities
ㆍProvide business justification for preparedness and adoption of voluntary preparedness standards

민간부문에 실질적인 효과를 가져올 수 있는 표준, 인증체계를 개발, 선정하기 위해서 관계당국은 주의를 기울여야 한다. 법령 제9조에서 필요한 것은 (저자의 주장) 성숙도모델 개념을 도입해야 하고 대내외적으로 조직간 비교(benchmark)뿐 아니라 지속적인 개선이 이루어질 수 있는 계획, 체계 개발을 가능케 해야 한다.
A great deal of caution is being exercised by authorities to develop/select a standard(s) and an associated certification process capturing the right recommendations that truly benefits U.S. business and in turn, their customers, employees, investors and all Americans. It is the author’s contention that the Title IX process should be developed with maturity model concepts so that organizations can not only benchmark themselves internally and externally, but also develop a plan ensuring continuous improvement is being made.

실제로 2007년 10월23일 슬로안 재단(Sloan Foundation) 주최로 BCP, 보안, 위기관리, 비상계획, 리스크관리 분야의 15명의 전문가가 미국 국토안보부에 권고안을 제시하기 위해 모였고, NFPA, DRII(미국 BCP 협회, www.drii.org) RIMS(리스크관리협회 www.rims.org) 등 주요 협회도 참여하였으며 중소기업에까지 이러한 인증평가를 적용할 수 있도록 노력을 기울이자는 내용이 논의되었다.
In order to provide private sector recommendations to the Department of Homeland Security, the Sloan Foundation convened a cross functional group of fifteen subject matter experts on October 23, 2007. Participant backgrounds included business continuity, security, crisis management, emergency management and risk management. The National Fire Protection Association (NFPA), the Disaster Recovery Institute International (DRII), the American Society for Industrial Security (ASIS) and the Risk and Insurance Management Society (RIMS) also reviewed and provided input. The Sloan Foundation supports a decision being made on this effort which will move the U.S. toward voluntary certification ? fully realizing the importance of providing assistance to small and medium size organizations, which may or may not have the same resources to implement all of the necessary components of full compliance.

인증이 가능한가(certifiable)
BS 25999와 법령 제9조 간의 유사점, 차이점, 현재 인증평가가 가능한 규격인지 여부 등에 대한 궁금증이 실무자 간에 팽배해 있다. 가장 최근에는 미국표준협회(ANSI), 미국품질협회(ASQ), 미국인정원(ANAB)가 모여 인증기관, 인증심사 팀, 인증심사원 그리고 인증기관으로 등록하기 위한 신청프로세스 관련 요건을 정의하는 것을 포함하여 인증평가 활동 제공을 가능케 하려는 움직임을 진행 중이다.
Certifiable
A tremendous amount of time is being spent discussing multiple important developments in the business continuity field - the release of the BS 25999 standard and its accompanying certification offering, and the US government’s Title IX legislation (the proposed private sector voluntary certification effort). Are there similarities between these initiatives? Are they at odds with one another? Is one European and one American? Are they available now? This article’s objective is to answer many of the most pressing questions being asked by executive managers and business continuity professionals, and offer insights as to how these initiatives may contribute to the continuing maturation of business continuity and risk management in general.

Most recently, a Committee of Experts was also convened by the American National Standards Institute’s (ANSI) American Society for Quality (ASQ) National Accreditation Board (ANAB) to assist in offering accreditation activity recommendations. Their recommendations include defining requirement criteria for the certification bodies, the audit teams, oversight assessors and an application process to be accredited by ANAB.

NFPA 1600과 DRII
BS 25999와 법령 제9조 이외에도 준거성 자가점검(self-assess compliance)을 위해 기준으로 많이 삼고 있는 여러 산업표준, 규준 또는 특정 산업분야에 국한되지 않는 비즈니스연속성 관련 표준 (아래 [표 1] 참조)이 존재하고 있다. 비즈니스연속성 즉 BCP가 중심이고 특화된 지침, 가이드라인이 있는 가 하면 일부는 광범위하게 리스크관리가 중심이 되어 비즈니스연속성을 기술하고 있는 표준도 있다.
NFPA 1600 and DRI International
Beyond the two certification offerings outlined thus far in this article, many other standards exist that are available for consultation and may be used to self-assess compliance. Some are industry-specific, others industry independent. Even industry-specific standards and requirements are often useful since many of the tenets contained can apply to others. The following table lists a number of standards and regulatory requirements for consideration ? some specific to business continuity or its related sub-disciplines, others that are more broadly associated with risk management. Following this table, two key efforts are described further, NFPA 1600 and DRI International’s Professional Practices.

이 중 NFPA 16000은 재난/비상관리와 비즈니스연속성 프로그램에 대한 표준으로 1991년에 수립되었고, 미국 국토안전부(DHS)와 재난관리청(FEMA) 그리고 9/11 진상조사위원회 주도로 17년간 계속 발전되어 온 미국 표준으로 인식되어 왔다. 각종 인적(human), 자연(natural) 및 기술적(technological) 재해와 사고에 대비하는 것을 강조하고 있고, 강력한 경영진의 참여와 지원 하에 대응, 복원 그리고 복구 준비를 위한 팀 기반 접근방법(team-based approach)에 중심을 두고 있다.
NFPA 1600: Standard on Disaster/Emergency Management and Business Continuity Programs is a consensus standard, which had its origin in 1991 and as such, has matured and evolved over the past seventeen years. Many improvements have come about and it is already recognized as a leading standard by DHS, FEMA and the 9/11 Commission. Since it was originally published in the United States, a number of international versions were issued. NFPA 1600 advocates that organizations take an “all hazards approach” to prepare for any incident, including human, natural or technological events. NFPA 1600 also advocates a team-based approach to response, restoration and recovery preparation with strong senior management support and involvement.

한편 DRII의 10가지 BCP 모범실천기준은 비즈니스연속성 실무자와 전문가 역량과 요구되는 기술이 어떤 것인지를 기술하고 있고, 이를 받아들이는 조직, 기업에서는 이를 BCP체계 요건으로 해석하여 체계운영과 수준측정에 활용하고 있다. DRII의 기준은 라이프사이클을 기반으로 한 프로세스를 강조하고 있으며, 요구사항 도출 및 분석, 전략 설정, 계획 수립 및 모의훈련, 그리고 대내외 이해관계자간의 인식, 문화확산을 구성요소로 보고 있다. 추가적으로 프로세스 개발, 거버넌스, 준거성 확보와 지속적인 개선에 대한 가이드도 포함되어 있다.
The DRI International Ten Professional Practices (applicable to international entities and business continuity professionals) were designed to establish necessary skills and competencies for individuals focused on business continuity. However, a number of organizations translated these people-focused requirements into organizational business continuity program characteristics. DRI International’s Ten Professional Practices focus on life-cycle oriented processes designed to establish requirements, define strategies, document plans, exercise strategies and advance awareness amongst all stakeholders. Additionally, DRI International content also provides guidance on process development, governance, compliance and continuous improvement.

BS 25999와 법령 제9조(Title IX) 비교
Title IX가 25999에 비해 아직 체계나 내용이 완성되지 않았기 때문에 두 표준을 일방적으로 비교하는 것에는 아직 무리가 있으나, 예비적 수준에서 목적, 범위, 접근방법, 기반이 되는 관련 표준 등 관점에서 비교하면 [표 2]와 같이 정리할 수 있다.
Comparing BS 25999 and Title IX
Although premature to compare BS 25999 to Title IX (given the latter continues to take shape) the following table seeks to clarify key points as executive management, risk managers and business continuity professionals evaluate both initiatives.

두 표준 모두 비즈니스연속성을 가시화(visibility)하고 역량확보 및 준비상태(readiness)를 강화하는데 가치를 제공하는 것으로 보이고 서로 특정 관점에서 충돌되는 거나 경쟁하고 있다고는 보여지지 않는다. 유사한 가치를 제공하면서 보다 성숙된 그리고 고도화된 수준을 향한 지속적 개선을 강조하고 있다.
This table demonstrates that both add value to business continuity visibility and readiness, even though a number of unknowns remain specific to Title IX. But are they in competition? A section dedicated to comparing BS 25999 and Title IX must conclude with the point that these two initiatives ? although appearing similar ? are not competing with one another. Both offer (or will offer) similar value propositions and emphasize continuous improvement toward higher levels of readiness.

인증평가체계 자체도 중요하지만 현존하는 표준이나 관련기관이 요구하고 있는 규정요건에 대한 활용 역시 중요하다. BS 25999 규격을 보면 해당 조직의 특수한 요구사항들을 잘 이해하고 대응하기 위해서 BS 25999 작성에 참고하고 있는 여타 표준과 규준들을 참고하기 쉽도록 배열, 기술하고 있다. 이러한 장점을 Title X도 역시 받아들여 NFPA 1600 과 같은 기반이 되는 표준들을 잘 활용하여야 하겠다.
Lastly, since this article not only touches on certification but also the use of other standards and regulatory requirements, it’s important to note that BS 25999 references the need to leverage the entire body of standards and requirements to define a program that fits the organization’s unique needs. It is expected that Title IX will do the same, recognizing standards such as NFPA 1600 as a baseline to follow for effective business continuity strategies.

비즈니스 가치를 제공하는 인증
앞서 언급한 것과 같이 비즈니스연속성 분야는 아직까지 미완성으로 단편화되어 있는 여러 가이드라인, 규정, 규칙, 권고사항 등으로 혼재되어 있고, BS 25999와 같이 분야에서 검증된 표준을 기반으로 한 인증은 조직의 BCP 체계수준을 객관적으로 평가할 수 있는 측정방법을 제공할 수 있다. 크게는 다음의 5가지 방향으로 이를 도입하는 조직에 가치를 줄 수 있을 것이다.
Certification Offers Business Value
Beyond a comparison between BS 25999 and Title IX, both efforts intrinsically offer business value to organizations electing to pursue organizational certification. As pointed out earlier, business continuity remains a fragmented discipline, with programs implemented based on numerous standards containing varying degrees of depth and rigor. Certification to an accepted standard provides an objective measure of an organization’s program. Certification may add value to your organization in the following five ways:

첫째로는 BCP 역량과 성과에 대해 조직, 회사 간 비교, 평가 (기존에는 불가능했던) 를 가능케 한다. 둘째로는 매년 또는 주기적으로 여러 산업에 대해 광범위하게 산발적으로 진행했던 BCP 벤치마킹 설문조사를 대체해주어 시장참가자, 주주 등 투자자, 규제기관 등 이해관계자에게 보다 확실하고 정확한 대상 조직, 회사, 산업에 대한 정보를 제공한다. 셋째로는 인증평가체계로 도입으로 인해 라이프사이클1)기반의 프로그램으로 비즈니스연속성체계를 운영할 수 있다. 넷째로는 내부적으로 경영진 및 임직원의 궁금증, 예를 들어 현재 우리회사의 비즈니스연속성체계 수준은 어느 정도이고, 취약점과 부적합사항(nonconformities)은 어떤 것들이 있는 지와 같은 사항을 쉽게 파악, 관리할 수 있다. 마지막 다섯째로는 비즈니스연속성 즉 BCP에 특화된 표준이 아니라 회사 전사적인, 전 조직차원의 리스크관리(enterprise risk management framework)와 통합을 기반으로 하는 표준이 도입되어 실행방법론, 체계, 용어 등이 일관되어 궁극적으로는 조직적으로 최적화된 리스크관리를 확보할 수 있다.
ㆍBusiness continuity capability and performance provides competitive differentiation. With that said, it is traditionally difficult to make a solid comparison between organizations. However, certification can provide a straightforward means of comparison for potential customers. For existing customers, certification can provide a degree of assurance, which is critically important if your organization is operating as a single or sole source provider of a critical product or service and your customers have expressed concern and are evaluating secondary sources.
ㆍRelated to competitive differentiation, certification will provide a convenient and time-saving answer to frequent business continuity program surveys and inquiries from customers, as well as regulators, investors and insurance carriers. With the existence of a third-party registered certification, there is no longer a need to share proprietary planning information to satisfy continuity inquires and concerns. As well, certification may begin to offer direct cost-savings opportunities on a recurring basis. Industry associations are in the process of debating the direct benefits of “viable” business continuity programs on credit ratings and business interruption insurance premiums.
ㆍThe organizational certification process also introduces discipline, holding the organization accountable to consistent focus and participation in a life-cycle oriented business continuity management system. With employee turnover always a concern, organizational certification (and the inherent requirements that mandate system documentation, accountability, repeatability, continual improvement and evidence) will enable an effective knowledge transfer process.
ㆍAlso from an internal perspective, developing a business continuity program in accordance with a standard provides the program owner with the ability to easily and confidently answer management questions regarding the state of the program. Questions such as “What’s everyone else doing?” or “Are we doing everything we should be?” can be clearly quantified and answered through reference to the standard. Program weaknesses and non-conformities will be highlighted during initial and continuing certification audits, which can then be built upon to show progress. As well, for organizations with decentralized business continuity efforts, audits will encourage compliance, ensure conformity across the organization and act as a catalyst for continuous improvement.
ㆍSome standards, in particular BS 25999 and NFPA 1600, provide guidance specific to planning strategies, operational risk management methodologies and risk treatment concepts that offer program optimization opportunities. These structures can assist organizations working to integrate business continuity into a larger enterprise risk management framework or those struggling to align many disjointed elements of a business continuity management system. This value alone - whether the organization is interested in certification or not - demands that organization’s utilize a structure that shares terminology and processes across a multitude of risk management disciplines.

BS 25999 또는 법령 제9조를 통한 비즈니스연속성 인증평가를 도입, 적용하는 것이 조직에 도움이 되는지 아니면 효과가 없을지를 반드시 고려해보아야 할 것이다.
Conclusions
Each organization must consider whether choosing organizational certification ? through BS 25999 or via the Title IX initiative ? is of benefit to them. Incentives to comply, although not formalized as of yet, are promising. However, even if organizational certification isn’t for your organization now (or ever), develop an understanding of the many standards available ? including NFPA 1600 and DRII’s Professional Practices. Find one or more that works for your organization ? build and/or mature your program based on one or more of the standards that aligns best with your business.

인증평가가 도입된지 아직 초기단계이지만 잠재적인 혜택(앞에서 언급한 5가지 방향과 같은)을 계속적으로 알아보고 점검해보아야 할 것이다. 관련 협회, 표준, 가이드라인이 계속해서 나오는 상황에서 혼란스러워할 것 없이 면밀한 검토와 이해도를 높여, 조직의 성숙도 수준을 지속적으로 개선, 고도화할 수 있는, 그리고 조직의 특별한 업무환경, 프랙티스 요건을 가장 잘 반영, 평가할 수 있는 표준을 기준으로 하여 도입과 적용을 정하는 것이 가장 중요하다.
Overall, organizational certification is new, with its potential benefits continuing to come into focus. The recommendations are rather simple:
ㆍStay informed and evaluate the business benefit of organizational certification
ㆍSelect one or more standards that contribute to the maturation of your organization’s business continuity program and continuously measure your compliance with standards as a catalyst for continuous improvement
ㆍAbove all else, do something ? don’t get frustrated with the growing body of standards and the growing number of professional associations getting involved

Harness the unique perspectives offered by each business continuity standard (and the authoring entities) to enable your organization to increase response and recovery readiness. Focus on the business value of your business continuity program and meeting the needs of your customers.

기고자 : 브라이언 자와다, MBCP
번역 : 유종기, 영국 BCI(Business Continuity Institute) 한국대표, Deloitte 안진회계법인 기업리스크자문본부 매니저, BS 25999 Technical Expert (registered by BSI)
Brian Zawada, MBCP, co-founder and director of consulting services for Avalution, focuses exclusively on business continuity management solution design and development. In addition to having served as both a consultant and an internal business continuity professional, Zawada is a frequent author and speaker.