Information Security Matters: Cybersecurity and Business Continuity—A New Standard

On May 6 of this year I wrote in a report to a client, “The relevant standard is silent regarding accountability for disaster recovery.” The standard was International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 27031 Information technology—Security techniques—Guidelines for information and telecommunication technology¹ readiness for business continuity. It had been published in 2012. On the day I wrote that sentence it was true. Ten days later that was no longer the case. On May 16, the 2025 version of the standard was issued with a somewhat modified name: Cybersecurity—Information and communication technology readiness for business continuity.²

Cybersecurity Instead of Information Technology

Let’s parse the title and its revision. It is no longer about disruptions to information technology in general but only about those caused by cyberevents specifically. No one is questioning the potential impact of denial of service attacks or ransomware, but they are not the only causes of IT interruptions. To be fair, the (unnamed) authors do say, “The need for business continuity management (BCM), including incident preparedness, disaster recovery planning, and emergency response and management, has been recognized and supported with the development and endorsement of specific domains of knowledge, expertise, and standards.”³

Nonetheless, the appreciation that cyberattacks necessitate a business continuity response says a great deal about how such attacks are viewed. It is a common line of thinking (or ought to be) that cybersecurity is a business matter, not only a technical one. The changed title is a recognition of the consequential damage that cyberattacks can cause. I am a bit surprised it took the thirteen years between the two versions of this standard to realize that cyber-related events cause business disruptions. To my memory, there was no shortage of such events in 2012.⁴

Readiness

Both the old and new versions of the standard have readiness in their titles. Much is said these days about cyberresilience, and the term IT disaster recovery⁵ has never gone out of fashion. I cannot say that I am familiar with any organization with an IT readiness department, though the publication of this revised standard has me thinking that there ought to be.

We have come a long way from thinking all that was necessary for the secure use of IT was that it be backed up and be capable of recovery if anything ever went wrong. Still, readiness to recover systems and data is a necessity if organizations are to be ready for…well, what, exactly?

The glossary in the newly issued standard provides some insight. Information and telecommunication technology readiness is defined as:

[The] state of an information and communication technology (ICT) function in which it has the knowledge, skills, processes, architecture, infrastructure, and the related technologies in preparation for a potential event that would lead to either an intolerable disruption of ICT or an intolerable data loss.⁶

Note that the state of readiness is not solely for cyberattacks but for any potential event that might disrupt IT or lose an intolerable amount of data. Importantly, readiness is attributed to IT functions and not to organizations as a whole.

The New Version

I was never very impressed with the original version of ISO/IEC 27031. It extolled the virtues of preparedness, but it was not very specific. To my mind, it contained little if any specific guidance at all. Hence my comment in the report I wrote on May 6. Version 2 is a great deal better, offering much detail about governance, risk management, and the integration of business continuity and IT readiness. It actually tells practitioners what to do. Who are those practitioners? I doubt that many call themselves IT readiness business continuity specialists. Although the abbreviation IRBC⁷ is used throughout the standard, I believe the most interested followers of this new standard would refer to themselves as disaster recovery professionals.

Though the 2025 version of ISO/IEC 27031 is a significant improvement over its predecessor, I am disturbed that by the time it was finally issued, it was out of date. I have previously written that this is the fate of all standards or at least those dealing with information security. As I wrote in 2013, “Put bluntly, best practice will always outrun standard practice. The spread between the two will increase over time as technology, risk and culture change while standards remain the same. When the discrepancy becomes so great that the standard cannot be justifiably defended, the time comes to issue a new version of the standard.”⁸

Thus, the new standard speaks to readiness of the IT function at a time when more and more systems are being acquired by businesspeople, not technicians. And fewer and fewer systems are actually being run in data centers under the control of the IT function. The new standard does not address software as a service (SaaS), managed services, Agile development, or systems bought from and implemented by third-party vendors. The days are long past of business users requesting IT to develop a system for them, waiting months or years until they can use it. Consideration of recoverability has to be a part of system design and implementation, whoever the developer may be. As I see it, this is a responsibility of the business owner, who sets the parameters for recovery (acceptable downtime and data loss) with the developers meeting these requirements.

My advice is that security professionals, IT auditors, and developers adhere to the new ISO/IEC 27031. At the same time, they should all be looking ahead to what Version 3 should contain.

Endnotes

¹ The term information and telecommunication technology and its abbreviation, ICT, are used globally but are not in general use in North America. Since I am in North America, I will stick with information technology and IT, except in direct quotations.
² International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC), Joint Technical Committee on Information Technology (ISO/IEC JTC 1), ISO/IEC 27031 Cybersecurity—Information and communication technology readiness for business continuity, Edition 2, 2025
³ ISO/IEC JTC 1, ISO/IEC 27031 Cybersecurity
⁴ What sticks in my mind the most, since I was working in that part of the world that year, was the Shamoon attack on Saudi Aramco and RasGas; Council on Foreign Relations, “Compromise of Saudi Aramco and RasGas,” August 2012
⁵ I have searched in vain for a first reference to “IT disaster recovery.” I know that it was in use in the 1970s; J.D. Fox Exec, “History of Disaster Recovery and Business Continuity,” 2017
⁶ ISO/IEC JTC 1, ISO/IEC 27031 Cybersecurity
⁷ IT or ITC Readiness for Business Continuity
⁸ Ross, S.; “Just Okay Practice,” ISACA^® Journal, vol. 2, 2013

STEVEN J. ROSS | CISA, CDPSE, AFBCI, MBCP

Is executive principal of Risk Masters International LLC. He has been writing one of the Journal’s most popular columns since 1998. Ross was inducted into the ISACA^® Hall of Fame in 2022. He can be reached at stross@riskmastersintl.com.