GB/Z 270-2026 安全与韧性 业务连续性管理体系 业务连续性策略指南

ICS03.100.01；13.200

CCSA90

中华人民共和国国家标准化指导性技术文件

GB/Z270—2026/ISO/TS22331：2018

安全与韧性业务连续性管理体系

业务连续性策略指南

Securityandresilience—Businesscontinuitymanagementsystems—

Guidelinesforbusinesscontinuitystrategy

（ISO/TS22331：2018，IDT）

2026⁃09⁃24发布

国家市场监督管理总局

国家标准化管理委员会发布

GB/Z270—2026/ISO/TS22331:2018

目次

前言··························································································································Ⅲ

引言··························································································································Ⅳ

1范围·······················································································································1

2规范性引用文件········································································································1

3术语和定义··············································································································1

4前提条件·················································································································1

4.1概述·················································································································1

4.2组织环境···········································································································1

4.3相关方··············································································································2

4.4业务连续性角色、权限和能力··················································································2

4.5最高管理者承诺··································································································3

4.6业务连续性策略所需的资源···················································································3

4.7业务影响分析和风险评估······················································································3

5执行业务连续性策略的确定和选择················································································3

5.1概述·················································································································3

5.2原则·················································································································3

5.3规划和管理········································································································5

5.4业务连续性策略差距分析······················································································5

5.5确定业务连续性策略····························································································6

5.6选择业务连续性策略···························································································12

6确定和选择业务连续性策略后的步骤···········································································15

6.1实施业务连续性策略···························································································15

6.2制定和实施业务连续性程序··················································································16

7监视和评审业务连续性策略·······················································································16

7.1绩效评审··········································································································16

7.2管理评审··········································································································16

附录A（资料性）ISO22301业务连续性管理体系中的业务连续性策略···································17

参考文献····················································································································18

Ⅰ

GB/Z270—2026/ISO/TS22331:2018

前言

本文件为规范类指导性技术文件。

本文件按照GB/T1.1—2020《标准化工作导则第1部分：标准化文件的结构和起草规则》的规定

起草。

本文件等同采用ISO/TS22331：2018《安全与韧性业务连续性管理体系业务连续性策略指

南》，文件类型由ISO的技术规范调整为我国的国家指导性技术文件。

本文件做了下列最小限度的编辑性改动：

——用ISO31073替代了已废止的ISOGuide73；

——更改了图1中相关内容，用GB/T31595—2025（ISO22313：2020，IDT）代替了已废止的ISO22313：

2012；

——将4.6和4.7中的段更改为条，以方便阅读；

——附录A中用ISO22301：2019替代了已废止的ISO22301：2012，并对表A.1中的内容进行了

更新。

请注意本文件的某些内容可能涉及专利。本文件的发布机构不承担识别专利的责任。

本文件由全国公共安全基础标准化技术委员会（SAC/TC351）提出并归口。

本文件起草单位：国网四川省电力公司、北京市科学技术研究院、中国标准化研究院、中国科学技

术大学、应急管理部国家自然灾害防治研究院、江西理工大学、江西电信信息产业有限公司、浙江省质

量科学研究院、中国质量认证中心有限公司、北京趋势引领信息咨询有限公司、中质协质量保证中心。

本文件主要起草人：秦川、周佩玲、赵兴昊、朱伟、杨思全、彭频、刘勇、秦挺鑫、王亚飞、郭锐、周倩、

付艳云、陈群、滕男、周昕、谭虎、黄帅、张诠坤、张晓磊、曾梓恒、张怡珩、姜雅硕、孙煌、吕晓思、方华明、

柴剑俊、石雅婷。

Ⅲ

GB/Z270—2026/ISO/TS22331:2018

引言

本文件为业务连续性策略的确定和选择提供了详细指南。

本文件符合ISO22301的要求，适用于任何组织业务连续性策略的确定和选择工作，无论该工作

是业务连续性管理体系（BCMS）的一部分还是业务连续性计划的一部分。后文中“业务连续性方案”

指代BCMS或业务连续性计划。业务连续性策略的确定和选择宜包含以下策略选项：

——保护优先活动；

——稳定、继续、恢复和复原优先活动；

——减轻、响应和管理影响（见ISO22301：2019，8.3）。

注1：本文件中，“业务连续性策略选项”“业务连续性解决方案”和“业务连续性能力”含义相同。

注2：GB/T30146—2023等同采用了ISO22301：2019。

图1说明了业务连续性策略的确定和选择过程与业务连续性计划之间的关系。业务影响分析和

风险评估为一系列业务连续性策略提供了要求，业务连续性策略的确定和选择是制定有效的业务连续

性程序的基础。

注：来源：GB/T31595—2025。

图1业务连续性管理要素

业务影响分析确定了产品/服务交付要求以及活动和资源恢复的优先时间表。组织通过业务影响

分析能够确定执行优先活动所需的资源（如设施、人员、设备、信息、通信和技术资产、物资和资金）。业

务影响分析还确定了活动之间的相互依赖关系，以及对供应链、合作伙伴和其他相关方的依赖关系。

风险评估可以识别、分析和评价冲扰的风险，并确定风险处置措施。

业务连续性策略旨在应对业务影响分析和风险评估的结果，决定了组织如何变得更有韧性，更有

能力应对更大范围的冲扰事件。本文件旨在为组织提供指导，使其能够：

——确定一系列业务连续性策略的选项；

Ⅳ

GB/Z270—2026/ISO/TS22331:2018

——基于业务连续性要求选择合适的能力；

——确保业务连续性策略持续适用；

——在整体业务连续性方案中有效协调业务连续性策略的确定和选择。

确定和选择业务连续性策略所产生的成果包括：

——降低冲扰事件发生频率及其相关影响的措施；

——明确应对冲扰事件所需的财务资源；

——有效的内外部通信能力；

——应对工作场所损失或无法进入的备用工作区能力；

——应对人员不足问题的安排；

——在丢失资源的情况下，维持、修复和替换资源以开展活动的备用方法；

——恢复丢失的信息通信技术（ICT）资产（包括数据）的能力；

——当面临供应链冲扰时，可提供产品和服务的备用方法。

图2展示了业务连续性策略的确定和选择过程、前提条件以及该过程与创建业务连续性程序之间

的关系。

图2业务连续性策略的确定、选择和执行方法

Ⅴ

GB/Z270—2026/ISO/TS22331:2018

安全与韧性业务连续性管理体系

业务连续性策略指南

1范围

本文件提供了业务连续性策略的确定和选择的指导。

本文件适用于各种类型、规模和性质的企业、公共机构和非营利组织的业务连续性策略的确定和

选择，供负责或参与业务连续性策略确定和选择的人员使用。

2规范性引用文件

下列文件中的内容通过文中的规范性引用而构成本文件必不可少的条款。其中，注日期的引用文

件，仅该日期对应的版本适用于本文件；不注日期的引用文件，其最新版本（包括所有的修改单）适用于

本文件。

ISO22300安全与韧性术语（Securityandresilience—Vocabulary）

注：GB/T44483—2024安全与韧性术语（ISO22300：2021，MOD）

ISO31073风险管理术语（Riskmanagement—Vocabulary）

注：GB/T23694—2024风险管理术语（ISO31073：2022，MOD）

3术语和定义

ISO22300和ISO31073界定的术语和定义适用于本文件。

4前提条件

4.1概述

本文件与ISO22301保持一致，也能根据需要遵循其他标准、义务或法规要求，开展业务连续性策

略的确定和选择。无论采取何种方法，组织均宜满足以下前提条件：

在开始业务连续性策略的确定和选择过程之前，组织宜：

——明确所处的环境和适用范围（见4.2）；

——理解相关方的需求与期望（见4.3）；

——明确并沟通角色和职责（见4.4）；

——获得领导层与管理层的承诺（见4.5）；

——分配足够的资源（见4.6）；

——完成业务影响分析（见4.7）；

——完成风险评估（见4.7）。

注：了解每项策略确定和选择过程的前提条件或任务与ISO22301的对应关系见附录A。

4.2组织环境

与业务连续性策略密切相关的环境因素包括：

1