The ISO22301 international standard for “Societal Security – Business Continuity Management Systems (BCMS) – Requirements” was published by ISO in 2012 and is based upon the earlier British standard BS25999-2.
ISO22301 specifies the requirements that your BCMS will need to meet in order for your organization to become certified to the standard. The requirements in ISO22301 are supplemented by guidance contained in ISO22313 which was also published in 2012. ISO22313 is well worth reading as it fills in some of the gaps in understanding how the requirements in ISO22301 should be met and gives more clues about what the auditor may be looking for. Even if you don’t want to certify to the Standard, it is recommended to implement some of the best practise requirements into your business to prepare for unforeseen events, and to minimise the impact it has on your business.
A new version of the ISO22301 standard was released by ISO on 31st October 2019 which, although not introducing any new requirements, has been restructured to better follow ISO’s layout for a management system, and to provide clarification of some of the existing requirements.
Complying to the ISO22301 standard prepares your business for the unexpected. Most importantly, it can reduce the impact and frequency of disruptions and incidents by identifying potential risks and creating contingency plans.
Other benefits include:
When looking at business continuity the emphasis is usually on “The Plan”. This is the document (or documents) that will tell everyone what to do in an emergency, how to handle a crisis and keep the business running. And it’s right that this should be the main focus; it is, after all, the main deliverable of the whole business continuity idea.
The function of the BCMS is to wrap itself around the plan and ensure (among other things) that:
The ISO22301 standard consists of a number of major headings which are:
As with many of the standards, sections 1-3 are for reference and are well worth a read to understand the standard in more detail. Section 0 is the introduction to the standard.
Sections 4 to 10 set out the requirements of the standard and are compulsory if an organization is to be compliant. So, the (internal and external) auditing process checks whether the requirements are being met by the organization. Requirements are not optional and if they are not being met then a nonconformity will be raised by the auditor and the organization will need to address it to gain or keep their certification to the standard.
The steps to becoming ISO22301 certified are like that of other ISO standards and include the following steps:
Not all companies will choose to certify to the Standard, you may just use the requirements within the ISO22301 standard as a guide to help your business prepare for the unforeseen and limit the impact in case of an event. The Standard can be used to help create a complete Business Continuity Plan. You can read more about the importance of planning ahead in our article: Planning for a pandemic.
The ISO standards are about continual improvement and include annual reviews and audits to ensure your business is conforming to the standard and has corrected any nonconformities highlighted at audit. ISO22301 is recommended for businesses of any size and industry that want to put a business continuity plan in place. CertiKit’s ISO22301 toolkit will help make complying to the standard simpler. Why not download a free sample document to start your journey to certification today.