ISO 22301:2012
Societal Security Business Continuity Management System
WHITE PAPER

ISO 22301 specifies requirements to plan, establish, implement, operate, monitor, review, maintain and continually improve a documented management system to prepare for, respond to and recover from disruptive events when they arise

The requirements specified in ISO 22301 are generic and intended to be applicable to all organizations (or parts thereof), regardless of type, size and nature of the organization. The extent of application of these requirements depends on the organization’s operating environment and complexity

ISO 22031 covers every phase of the implementation and operation of a business continuity management system, and provides a framework that can help organisations accomplish the following:

• Develop an organisation policy for an effective recovery of key business functions
• Establish targets and objectives to achieve the goals of the policy
• Identify business / operations risks and associated business impacts (Perform Risk Assessment (RA) and Business Impact Analysis (BIA))
• Determine Business Continuity Strategy and develop Business Continuity Plan(s)(based on the result of RA and BIA and aligning to BC Policy and Objectives)
• Establish and implement business continuity procedures
• Determine the resource required to ensure emergency preparedness and appropriate responses
• Perform test and exercise on BC Plans to determine that the business continuity procedures and plans address the intended recovery objectives
• Monitor, measure and analyse key characteristics that affect the recovery plan
• Review the suitability, adequacy and effectiveness of the business continuity management system
• Continually improve an organisation’s business continuity capabilities and performance

 

A growing number of organizations are integrating business continuity with other risk management disciplines, which demonstrates that the industry is maturing and becoming more accepted by executive management. As a management systems standard, ISO 22301 can help organizations appropriately coordinate risk management efforts, with the end objective of mitigating a broad range of risks in the most efficient manner possible.

ISO 22301 is obviously useful as part of a certification process to ISO/IEC 27001:2005. ISO 22301 can be used to directly comply with the objective of clause A.14- Business continuity management. Additionally, regarding the implementation and execution of a risk assessment in the context of ISMS compliance, an organization could always refer to ISO/IEC 27005:2011 or, in a broader context, to ISO 31000:2009 - Risk management - Principles and guidelines or, to execute the assessment itself, to ISO 31010:2009 - Risk management - Risk assessment techniques.

In general, the effort to align management system standards has been well received from all quarters. It’s a combination of the popular Plan Do Check Act (PDCA) method used in standards such as ISO 14000 on Environment and ISO 27000 on IT Security - and the “Process Approach” used in ISO 9000 on quality. The headings in ISO 22301 include: Terminology; Understanding the organization (and its context); Leadership; Planning; Support; Operation; Performance evaluation; and Improvement. The common text accompanying the headings is clear and succinct. Because all management system standards eventually need to use this format, by being one of the first standards to adopt it, ISO 22301 can easily integrate with other standards.

ISO 22301 : 2012 specifies requirements to plan, establish, implement, operate, monitor, review, maintain and continually improve a documented management system to protect against, reduce the likelihood of occurrence, prepare for, respond to, and recover from disruptive incidents when they arise.

Some of the key business benefits of adopting the ISO 22301:

• Improving your resilience against disruption
• Maintaining an ability to manage uninsurable risks
• Developing a capability to manage business disruption
• Minimising consequences of unexpected disruptions
• Providing a method of restoring your ability to supply key products and services
• Protecting and enhancing your reputation and brand
• Gaining a competitive advantage by demonstrating the ability to maintain delivery of your products and services

The usual path for an organization that wishes to be certified against ISO 22301 is the following:

1. Implementation of the management system:

Before being audited, a management system must be in operation for some time. Usually, the minimum time required by the certification bodies is 3 months.

2. Internal audit and review by top management:

Before a management system can be certified, it must have had at least one internal audit report and one management review.

3. Selection of the certification body (registrar):

Each organization can select the certification body (registrar) of its choice

4. Pre-assessment audit (optional):

An organization can choose to perform a pre-audit to identify any possible gap between its current management system and the requirements of the standard

5. Stage 1 audit:

A conformity review of the design of the management system. The main objective is to verify that the management system is designed to meet the requirements of the standard(s) and the objectives of the organization. It is recommended that at least some portion of the Stage 1 audit should be performed on-site at the organization’s premises.

6. Stage 2 audit (On-site visit):

The Stage 2 audit objective is to evaluate whether the declared manage - ment system conforms to all requirements of the standard, is actually being implemented in the organi - zation and can support the organization in achieving its objectives. Stage 2 takes place at the site(s) of the organization’s sites(s) where the management system is implemented.

7. Follow-up audit (optional):

If the auditee has non-conformities that require additional audit before be - ing certified, the auditor will perform a follow-up visit to validate only the action plans linked to the non- conformities (usually one day).

8. Confirmation of registration:

If the organization is compliant with the conditions of the standard, the Registrar confirms the registration and publishes the certificate.

9. Continual improvement and surveillance audits:

Once an organization is registered, surveillance activi - ties are conducted by the Certification Body to ensure that the management system still complies with the standard. The surveillance activities must include on-site visits (at least 1 per year) that allow veri - fying the conformity of the certified client’s management system and can also include: investigations following a complaint, review of a website, a written request for follow-up, etc