ISO 22301 - BUSINESS CONTINUITY MANAGEMENT SYSTEM

ISO 22301 Requirements

ISO 22301 specifies requirements for an effective Business Continuity Management System (BCMS).

ISO 22301 emphasizes the requirements related to:

• understanding the organization’s needs and the necessity for establishing business continuity management policy and objectives,
• implementing and operating controls and measures for managing an organization’s overall capability to manage disruptive incidents,
• monitoring and reviewing the performance and effectiveness of the BCMS, and continual improvement based on objective measurement.

A BCMS, like any other management system, has the following key required components:

• Business Continuity Policy ;
• People with defined responsibilities;
• management processes relating to
  • policy,
  • planning,
  • implementation and operation,
  • performance assessment,
  • management review, and
  • improvement;
• Documented information to support effective implementation

ISO 22301 Documentation Requirements

The organization shall determine external and internal issues that are relevant to its purpose and that affectits ability to achieve the intended outcome(s) of its BCMS.

These issues shall be taken into account when establishing, implementing and maintaining the organization’s BCMS.

The organization shall identify and document the following:

• Scope of the BCMS (Business Continuity Management System)
• Business continuity policy & objectives
• Training & Awareness plan
• Framework for business impact analysis and risk assessment
• Process for risk assessment & Risk Management
• Business continuity Strategy
• Business continuity Plans & procedures
• Disaster Recovery Plans & Procedures
• Incident reporting & Response procedures
• Business continuity Exercise (Mock) Procedures and plans
• Procedure for internal audit & Management review
• Procedure for correctives actions and improvements

• Business perspective:
  • Meeting its strategic objectives;
  • Gaining competitive advantage;
  • Increase reputation and credibility;
  • Improves operation, supply chain and information resilience.
  • improving its capability to remain effective during disruptions;
  • addressing operational vulnerabilities.

• Financial perspective:
  • reducing direct and indirect costs of disruptions;
  • reducing legal and financial risk;
• interested parties’ perspectives:
  • build confidence and trust
  • protecting life, property and environment;