By bringing together separate Business Continuity, Information Security, and Risk Management functions, organizations can improve their response to threats. Combining these groups allows them to share information, standards, and tools to more efficiently defend against Advanced Persistent Threats, natural disasters, and other business failures. Integrating these functions can reduce costs by 10-30% by eliminating redundant software, roles, and office spaces. Management support is needed to establish overarching risk policies that the combined group can implement cohesively.

1. Joseph Sukhbir
BUSINESS CONTINUITY
CONVERGENCE

2. ABSTRACT:
As new and unusual threats continue to target your company as a whole, the
mechanisms that are used for defending the company and responding to incidents need
to be aligned. Most companies will have separate Business Continuity, Information
Security and Risk Management functions, each of these will have responsibility is
responding to the threats. By bringing these three groups together they can share a
common ground and set of standards. Their combination will result in cost savings and
efficiency improvements. You will be able to do more with less, integrate tools and
analysis.

3. Threats
Advanced Persistent Threats
Natural Disasters
Business Failure

4. Different Standards – Complementary or Competing?
ISO 27001 and 27002 are being updated this year (2013). Number of controls is down
from 133 to 113 but extra guidance is provided. There will be more emphasis on
accountability and consistency. Number of security categories now increased to 14 and
will now include Cryptography, Operations Security and Supplier Relations.
ISO 27031 - Guidelines for ICT readiness for business continuity
BS 25999 / ISO 22301 Business Continuity Management Systems
ISO 31000 Risk Management Principles and Guidelines
ISO 31010 Risk Management Risk Assessment Techniques.

5. Tools
Risk Management will use a Governance, Risk and Compliance tool.
Information Security will use a Security Information and Event Management tool.
Business Continuity will use Impact Analysis, Incident Management and Response tools.

6. How to combine these business functions
Must have support for top management.
Start with Risk Management Policies and Standards.
Will be some overlap with BCP and InfoSec.
Implement the specific BCP and InfoSec policies and standards that are not effectively
covered

7. Cost savings
Cost savings will range from 10% to 30%
Achieved by cutting out unnecessary software packages.
Reducing redundant roles.
Moving to the same office space.