1

Introducing ISO 22301

 2

Background

How was the ISO22301 formed?

 3
Contributors
 4
Context

• Source documents included

– BS25999-2
– NFPA 1600
– ASIS OR standard
– Singapore standards
– ISO 27031
– ISO Guide 73
– ISOPAS22399

• So ISO 22301 is not simply an international version of

BS25999
 Publication Timeline…
5

Q1 Q2 Q3 Q4 Q1 Q2 Q3 Q4 Q1
2011 2011 2011 2011 2012 2012 2012 2012 2013

ISO 22301 BCM DIS Public Commenting FDIS FDIS Final ISO
– Requirements Period Development Published Publication

Document out for public

ISO 22313 BCM comment
Publication
– Guidelines ???
 6
Summary of ISO FDIS 22301:2012

• ISO is currently developing a high level structure

(Guide 83) and standardised text suitable for all ISO
management system standards, ISO 22301 is the first
to be developed to this new structure.
• The intention is standardise terminology and
requirements for essentially what are the fundamental
elements of a management system.
• As ISO 22301 will be the first “new” ISO management
system standard it will be the vanguard for all new and
revised versions of existing ISO standards
 7

ISO 22301 Key Points

(Societal Security – BCMS)
"...standardization in the area of
societal security, aimed at
increasing crisis management and
business continuity capabilities, i.e.
through improved technical, human,
organizational, and functional
interoperability as well as shared
situational awareness, amongst all
interested parties."
 8
ISO22301

0 Introduction 4 Context of the organisation

5 Leadership
1 Scope
6 Planning

7 Support
2 Normative References
-Guide 73: Risk mgmt. vocab.
-ISO 22300 Terminology 8 Operation
*
9 Performance
Evaluation
3 Terms and Definitions

10 Improvement
 9

BS25999
3 Planning the BCMS
4 Context of the organisation -Scope, Objectives, Policy
-Resources
5 Leadership -Competency
-Embedding
6 Planning -Documentation

4 Implementing and Operating the

7 Support BCMS
-BIA
-Risk and Risk Choices*
8 Operation * -Strategy
-Incident response, IMP, BCP
-Exercising, Review
9 Performance
Evaluation 5 Monitoring and Reviewing the BCMS
Internal Audit
Management Review
10 Improvement 6 Maintaining and Improving the BCMS
-Preventive*, Corrective &
Improvement Actions
Key Changes / Aspects…
10

Notable shifts in emphasis from BS25999-2:2007:

• Change in the way an organisation may be defined.
• Top Management leadership shall be more demonstrable
and active.
• Preventive action has been replaced with “actions to address
risks and opportunities” and features earlier.
• ISO 22301 puts a much greater emphasis on setting the
objectives, monitoring performance and metrics – aligning
BC to top management strategic thinking.
Key Changes / Aspects…
11

• Strong emphasis on performance evaluation & metrics.

• Communication elements more demanding and there is a
responsibility to the wider community defined.
• BIA similar but with some changes to terminology.
• There is a stronger link to the organisations approach to risk.
• To reflect the Societal security approach some new
terminology has been introduced, see ISO 22300.
Benefit of BCM – sudden disruption
12

1
2
Benefit of BCM – gradual disruption
13

1
3
3. Terms & Definitions…
14

• Business continuity plan

• Correction
• Corrective action
• Interested party
• Maximum acceptable
outage (MAO)
• Maximum tolerable period
of disruption (MTPD)
• Minimum business
continuity objective
(MBCO)
 15
Context - Interested Parties
1
5
 16
Context

• Requirement for documenting:

• links between the business continuity policy and the
organization’s objectives and other policies, including
its overall risk management strategy; and
• the organization’s risk appetite.
• The requirement to have procedures which identify
legal and regulatory requirements. There is also a
requirement to keep this information up to date which
must tie in with maintenance.
 17
6. Planning

• Section 6.1 talks about risks and 6.2 about objectives

• Standardized text but might confuse
– Having fully understood the context of the organisation,
planning activities are introduced to address the risks
and opportunities of the business.
– This proactive approach, if carried out properly, will
ensure a resilient BCM system as it will focus on
planning for successfully achieving BCM objectives and
realising opportunities for improvement. Ownership and
accountability of BC objectives will be allocated and a
clear direction to accomplishing these objectives will be
agreed.
 18
7. Support

7.2 Competence
• The organisation (generally acknowledged to be
through its Top Management) has a responsibility to
ensure that sufficient and appropriate resource is
available for the BCMS. Appropriateness is often
determined through competency analysis
• It is people who take action when an incident occurs
– Competence relates both to operating the BCMS AND
to performing following an incident
– Note also 7.3 d) – everyone has to be aware of their role
during disruptive incidents
 19
Communication

• external communication with customers, partner entities, local

community, and other interested parties, including the media,
• receiving, documenting, and responding to communication
from interested parties,
• adapting and integrating a national or regional threat advisory
system, or equivalent, into planning and operational use, if
appropriate,
• ensuring availability of the means of communication during a
disruptive incident, facilitating structured communication with
appropriate authorities and ensuring the interoperability of
multiple responding organizations and personnel, where
appropriate, and
• operating and testing of communications capabilities intended
for use during disruption of normal communications.
 20
BIA
2
• a) identifying activities that support the provision of 0
products and services;
• b) assessing the impacts over time of not performing
these activities;
• c) setting prioritized timeframes for resuming these
activities at a specified minimum acceptable level,
taking into consideration the time within which the
impacts of not resuming them would become
unacceptable; and
• d) identifying dependencies and supporting resources
for these activities, including suppliers, outsource
partners and other relevant interested parties.
 21
Risk Assessment
2
• The organization shall establish, implement, and maintain a 1
formal documented risk assessment process that
systematically identifies, analyses, and evaluates the risk of
disruptive incidents to the organization.
• NOTE This process could be made in accordance with ISO
31000.
• The organization shall
• identify risks of disruption to the organization’s prioritized
activities and the processes, systems, information, people,
assets, outsource partners and other resources that support
them, analyse them, evaluate and treat them.
 22
Strategy

• BS25999-2 had 4.1.3 Determining Choices and 4.2

Determining business continuity strategy
• ISO 22301 better defined
– Decide what you are going to do to reduce the likelihood
and impact as well as how to respond (these are not
alternative approaches)
– Set RTOs
– Work out the resource requirements
– Act on the protection and mitigation needed
– Evaluate business continuity capability of suppliers
 23
Incident Response Structure

8.4.2 broadly equivalent to 4.3.2 in BS25999

– “Impact thresholds” is new
– Personnel to assess the incident
– Communication mentions “authorities” and “media”
explicitly
– External communications a new requirement. Life safety
explicitly mentioned.
 24
Warning and Communication

• The organization shall establish, implement and maintain

procedures for
• a) detecting an incident,
• b) regular monitoring of an incident,
• c) internal communication within the organization
• d) receiving, documenting and responding to any national or
regional risk advisory system or equivalent,
• e) assuring availability of the means of communication
during a disruptive incident,
• f) facilitating structured communication with emergency
responders,
• g) recording of vital information about the incident, actions
taken and decisions made,
 25
Recovery

• The organization shall have documented

procedures to restore and return business
activities from the temporary measures adopted
to support normal business requirements after an
incident
 26
Exercising and Testing

• Covers pretty much the same ground as BS25999-2

• It talks about exercises and tests.
• Expect to see a programme – point is that over time these
should provide objective assurance that the arrangements
made will work as anticipated and when required: so does
the programme really do this?
Performance Evaluation… 27

• As with all management system standards there is a

need to look back at what has been achieved. ISO
22301 also requires that this analysis is evaluated and
conclusions drawn by the organisation.
• Performance metrics (to be selected by the business)
are required in ISO 22301. Whilst this is a new
requirement it is likely that organisations will already
produce certain metrics and these may be able to be
tailored to cover the BCMS performance.
Performance Evaluation…
28

• Internal audits and

management
review continue to
be key methods of
reviewing the
performance of the
BCMS and tools for
its continual
improvement.
Transition…
29

2
9
• Organizations who are currently certified to BS25999-2:2007
will be provided with:
– A transition guideline
– A transition timescale

• Widely expected that transitions will be conducted during a

CAV visit.
• Guidelines and timescales dependent upon UKAS. Certified
organisations have 12 to 18 months to transition although
could be up to 3 years
30

3
0