Business Continuity ISO 22301

Emergency planning and disaster recovery were initially primarily driven by information technologies aimed at addressing natural disasters and terrorist threats that affected businesses in the 1980s and early 1990s.

However, it has become increasingly clear that the process to be put in place in this area should be managed by the company and encompass ways to guard against multiple forms of disruption. As a result, a new discipline, known as “Business Continuity Management” (BCM).

As they began to recognize the value of this discipline in mitigating the effects of disruptive incidents on society, governments and regulatory bodies sought assurance that key players were equipped with appropriate mechanisms to ensure business continuity. At the same time, aware of their interdependence, companies also wanted to ensure that their main suppliers and partners were always able to provide essential products and services even in the event of an incident.

It was therefore necessary to have a recognized reference for good practices in BCM, and several countries, including Australia, the United States, the United Kingdom, and Singapore, established national standards on this issue. For example, the objective of the British standard BS 25999 was to help establish a business continuity management system and was the first to serve as a reference for accredited certification purposes.

When internationally active organizations began to push for the introduction of a single international standard, ISO/TC 223 Technical Committee, Social Security, began work on ISO 22301: 2012, Social Security - Business Continuity Management - Requirements. This new standard, resulting from significant global interest, is the culmination of collaborative work and contributions from around the world.

ISO 22301 is a management system standard for BCM that can be used by organizations of all sizes and types. Once their BCM system is in place, organizations have the option to seek accredited certification of compliance with the standard to demonstrate compliance with BCM best practices to legislative and regulatory bodies, potential customers, and other interested parties. At the corporate level, the person responsible for BCM can, through ISO 22301, show their management that a recognized standard is in place.

Given that ISO 22301 is usable for certification purposes, the requirements it specifies describe the essential elements of BCM in a relatively short and concise manner. A more comprehensive guidance standard (ISO 22313) providing more details for each requirement of ISO 22301 is under preparation.

ISO 22301 can also serve as a reference for the company to assess its situation with regard to best practices and for auditors to report to management. The interest of this standard is, by far, not limited to obtaining a certificate of conformity.

Understand and prioritize threats to your business under the International Business Continuity Standard. ISO 22301 specifies the requirements for a management system to protect the business from disruptive incidents, reduce their probabilities, and ensure recovery.

• Identify and manage current and future threats to your business.
• Adopt a proactive approach to minimize the impact of incidents.
• Maintain critical functions during times of crisis.
• Minimize downtime during incidents and improve recovery times.
• Demonstrate resilience to customers, suppliers, and bids.