Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Updated broken link in BC-DR-14


Page Properties


IDS24
Version1.1.0
TypeOverarching Standard
StatusEffective
Effective Date 




Description

Excerpt

Ensures that suppliers Solutions are supported by robust business continuity plans and disaster recovery measures.


Business Continuity and Disaster Recovery is a mandatory technical standard. This standard is in place to ensure that services can be maintained in the event of disruptions to normal business. Suppliers will need to ensure that they have taken appropriate steps to remove, reduce, or mitigate the likelihood of events detrimentally impacting the levels of services that are provided. 

NHS Digital’s Business Continuity and Disaster Recovery standards have been developed to help Suppliers understand the minimum expectations that NHS Digital have for the maturity, scope and context of an organisation’s Business Continuity Management System (BCMS).

The BCMS is a management process that establishes, implements, operates, monitors, reviews, maintains and improves the organisation’s business continuity and should include organisational structure, policies and planning activities, responsibilities, procedures, processes and resources within its framework. This can be demonstrated by providing current ISO certifications or satisfactory audit reports.

Following receipt of the draft BCDR Plan (see standards BD-DR-17 and BC-DR-18) from the Supplier, NHS Digital shall:

  • Review and comment on the draft BCDR Plan as soon as reasonably practicable; and
  • Notify the Supplier in writing that it approves or rejects their draft BCDR Plan no later than twenty (20) Working Days after the date on which the draft BCDR Plan is first delivered to NHS Digital.



Requirements

Requirement IDRequirement TextLevel
BC-DR-1

Business Continuity Management System (BCMS)

The Supplier’s organisation and the services provided will be underpinned by a robust Business Continuity Management System (BCMS). 

The Supplier must meet or exceed its recovery time objective, be fully accountable and responsible for its BCMS operational business continuity and IT Service continuity management plans and supporting procedures for all services delivered to its Service Recipients.

Status
colourRed
titleMUST
BC-DR-2

BCMS  - methodology

A valid ISO 27001:2013 Certificate is required from a UKAS accredited and registered certification organisation.

Status
colourYellow
titleSHOULD
BC-DR-3

BCMS - Maintenance

Adequate staffing, facilities and technology resource will be deployed to establish, maintain and improve the organisation’s BCMS. This will need to be detailed as part of the BCMS submission.

Status
colourRed
titleMUST
BC-DR-4

BCMS - Management

Staff responsible for managing the BCMS will be able to demonstrate professional competence via recognised accreditation to professional bodies such as the Business Continuity Institute and industry forums

Status
colourGreen
titlemay
BC-DR-5

BCMS - Governance, Escalation and Direction

Leadership at senior level and in other relevant management roles will be identified to enable the necessary governance, escalation and direction for the BCMS.

Status
colourRed
titleMUST
BC-DR-6

BCMS - Protection

The BCMS will be able to protect against, reduce the likelihood of occurrence, prepare for, respond to and recover from the full range of incidents, up to and including a potential or actual crisis.

See the Business Continuity Institute for the Good Practice Guidelines

Status
colourRed
titleMUST
BC-DR-7

Business Continuity (BC) Plans - Recognise external threats

The Supplier shall create and maintain Business Continuity (BC) plans in accordance with BC-DR-2. The BC plans shall recognise external threats such as those in the National Risk Register, and organisation specific threats identified through horizon scanning and internal threat assessments.

Status
colourGreen
titlemay
BC-DR-8

Business Continuity (BC) Plans Infrastructure & Service-based Threat Assessments

Infrastructure and service-based threat assessments will be undertaken on a regular basis to proactively identify risks to delivery of services within or across organisation and service location boundaries.

Status
colourRed
titlemust
BC-DR-9

Business Continuity (BC) Plans Process to Identify Emerging Threats & Risks

There will be a process to identify emerging threats and risks in day to day operations.

Status
colourRed
titlemust
BC-DR-10

Business Continuity (BC) Plans - Identify interdependencies between stakeholders

Interdependencies between stakeholders, including outside organisations and third parties, will be identified within the BC plan and have appropriate plans in place to cover disruption to the supply chain.

Status
colourRed
titleMUST
BC-DR-11

Business Continuity (BC) Plans - Supply chain continuity

There will be processes in place to manage and assure supply chain continuity.

Status
colourRed
titlemust
BC-DR-12

Business Continuity (BC) Plans - Principles

The principles of business continuity will be embedded within the organisation through training, exercising and raising staff awareness.  

See the Business Continuity Institute for the Good Practice Guidelines

Status
colourRed
titlemust
BC-DR-13

Business Continuity (BC) Plans - Impact analysis

Organisation-wide business impact analysis will be undertaken and maintained to ensure that in the event of disruption, there are defined recovery time and recovery point objectives in place for all activities, including any internal business operations that could impact the continued delivery of services.

Status
colourRed
titlemust
BC-DR-14

Business Continuity (BC) Plans - Regular updates & testing

The Supplier will ensure that Business continuity plans and their associated documents are kept up to date and tested annually to confirm that business continuity and disaster recovery Solutions function as designed.

See BC-DR-16 and BC-DR-16A for Business Continuity and Disaster Recovery (BCDR) testing

Status
colourRed
titleMUST
BC-DR-15

Business Continuity & Disaster Recovery (BCDR) Plans - Scheduled testing

Testing will be undertaken according to a defined schedule to confirm Business Continuity and Disaster Recovery (BCDR) plans will achieve their objectives and where deficiencies or inaccuracies are identified, the plans will be updated, and where appropriate retested.

Status
colourRed
titleMUST
Anchor
DR16
DR16

BC-DR-16

Annual Business Continuity Test

The Supplier will undertake a Business Continuity test at least annually. The scope of the Business Continuity test shall be a scenario test to exercise the end to end process. NHS Digital may wish to witness the test.
If requested, the supplier must comply and provide full access and visibility of the execution of the test, including access to documentation and the execution of procedures throughout the whole test.

Status
colourRed
titleMUST

Anchor
DR16A
DR16A
BC-DR-16A

Annual Disaster Recovery Test

The Supplier will undertake a Disaster Recovery test at least annually. NHS Digital may wish to witness the test. If requested, the supplier must comply and provide full access and visibility of the execution of the test, including access to documentation and the execution of procedures throughout the whole test and the resolution of any issues that occur during the Testing window.
The scope of the disaster recovery test shall be a full failover of the service(s).

Status
colourRed
titleMUST
BC-DR-17

BCDR Plan

Within thirty (30) Working Days from the Call Off Commencement Date the Supplier shall prepare and deliver to NHS Digital their BCDR Plan and associated Business Continuity Management System methodology which shall detail the processes and arrangements that the Supplier shall follow to:

  • Ensure continuity of the business processes and operations provided by the Supplier in connection with the Call-Off Contract following any failure or disruption of any element of the Services; and
  • The recovery of the Services in the event of a Disaster. 
  • NHS Digital may wish to provide feedback to the Supplier.
Status
colourRed
titleMUST
BC-DR-18

BCM & IT Service Continuity Management (ITSCM) Coverage

The BCDR Plan can be developed as separate or combined BCM and IT Service Continuity Management (ITSCM) plans. Throughout the Schedule, the references to the BCDR Plan applies whether BCM and ITSCM are separate plans or programmes or are a single, combined set of plans or programmes. However, the Supplier will make a clear statement as to how their BCDR Plan covers both BCM and ITSCM. The documentation of the BCDR Plan shall:

  • Include a full description and overview of the Supplier’s BCM and ITSCM programme describing how it has been designed; how it will operate and be maintained; how business continuity and disaster recovery will be tested, how it is kept up to date and how it will deliver the expected recovery targets outlined including recovery time and recovery point objectives; this will include an overview and description of all sites, functions and key delivery partners/third parties that are involved in the delivery of the service
Status
colourRed
titleMUST
BC-DR-19

BCM & IT Service Continuity Management (ITSCM) Coverage

The BCDR plan must contain identification of all potential disaster scenarios, the technical design and specification of the disaster recovery system, backup methodology including details of the data backup and data verification strategy, details of all relevant data networks and communication links, invocation process, service recovery procedures, and steps to be taken upon resumption of the services to address any prevailing effect of the failure or disruption to services. 
Status
colourRed
titleMUST
BC-DR-20

BCM & IT Service Continuity Management (ITSCM) Coverage

The BCDR plan must set out the method(s) of recovering or updating data collected, or which ought to have been collected, during a failure or disruption to ensure that there is no more than the accepted amount of data loss and to preserve data integrity.
Status
colourRed
titleMUST
BC-DR-21

BCM & IT Service Continuity Management (ITSCM) Coverage

The BCDR plan must detail how the Supplier ensures compliance with security standards  ensuring that compliance is maintained for any period during which the BCDR plan is invoked.
Status
colourRed
titleMUST
BC-DR-22

Liaison

The Supplier must liaise with NHS Digital and at NHS Digital’s request with any Related Service Provider with respect to issues concerning business continuity and disaster recovery where applicable.
Status
colourRed
titleMUST
BC-DR-23

Plan review

The supplier shall review the BCDR plan and the risk analysis on which it is based on a regular basis and as a minimum once every 12 months. Upon update, the BCDR Plan shall be re-issued to NHS Digital. 

NHS Digital may wish to provide feedback to the Supplier.

Status
colourRed
titleMUST
BC-DR-24

Data centre inspection

The supplier will, at the request of NHS Digital, facilitate an inspection of the data centre(s) hosting the services to validate that the hosting arrangements described in their BCDR plans are consistent with the configuration and capability of the data centre(s). Repeat inspections will be determined based on the outcome of the inspection.
Status
colourRed
titleMUST



Capabilities

Panel
titleBGColor#ABC8E2
borderStylesolid
titleApplicable Capabilities

All suppliers Solutions delivering any Capabilities will need to meet this Standard.



Roadmap

Panel
titleBGColor#E1E6FA
borderStylesolid
titleItems on the Roadmap which impact or relate to this Standard

Suppliers will not be assessed or assured on these Roadmap Items as part of Onboarding

Page Properties Report
firstcolumnRoadmap Item
headingsStandards and Capabilities, Status, Effective Date, Description, Change Type, Change Route
pageSize300
sortByEffective Date
cqllabel = "S24" and space = "GPITF"