The Business Continuity Institute has issued a new guide to Business Continuity "from BSI". This is, indeed, the British Standards Institute. Does this mean you have to comply, as with ISO 9000, or you will be frozen out of business supply relationships?
According to a BSI spokesperson PAS stands for publicly-available standard: "It's an informal standard." PAS 56 is a set of best practices to achieve a good level of business continuity and a checklist to see how you are currently doing. It is about establishing a BCM process, and having a framework for incident anticipation and response, we were told. However, there is no certification process.
The BSI spokesperson said: "BSI is a sort of petri dish. We are not the bacteria." The BSI provides the conditions for growth but the growth has to come from industry, the analogy runs. "PAS 56 is a very good start. There is no [formal] certification at the moment, only self-certification. The BSI is trying to see if there can be a certification process put in place. There are plans to make this a formal British Standard."
The BSI is looking to see if there is industry consensus for this. It thinks that "insurance, finance and IT companies are the big players" from which a consensus might come. A true BSI standard would have formal certification from an accredited checking body associated with it.
The Business Continuity Institute is a part supplier-funded body or the ilk that represent themselves as encouraging business and organisations in general to adopt the ideas and practices it espouses because it helps businesses be "better businesses" or "gain competitive advantage" or some other well-meaning but hard to quantify phrase.
In this particular instance, BCI says it "provides an internationally recognised status in relation to the individual's experience as a continuity practitioner." There are 1450 members in 41 countries and its mission is "to promote the art and science of business continuity management". Which is nice.
By gaining the co-operation of the BSI, the Business Continuity Institute has certainly been given a stage to its members. Datafort has knocked out a press release saying that its remote backup system will help companies comply with "the new government-backed PAS 56 standard", for example.
No companies will be forced into adopting PAS 56 at the risk of losing business. At least, not until a formal BSI standard comes into being.