What is ISO 22301? How it Works, Terms, Framework, Benefits

Introduction 

ISO regulations and certifications specify that the company is following the standard operating procedures in its workplace. There are different types of ISO certifications to evaluate the performance of various areas of the company. Today, we’ll discuss what is ISO 22301; its certificates, how it works, mandatory documentation, terms, framework, implementation, and benefits.

What is ISO 22301?

The complete name of ISO 22301 is ISO 22301:2019 Security and Resilience Business Continuity Management Systems, requirements. International organization of standardization (ISO) has published this standard, and it outlines how businesses and companies should manage business continuity in their workplaces. The world’s leading business continuity professional has developed these standards, and they offer a practical framework to manage business continuity in your company.

The differentiating feature between this standard and the business continuity framework is that an accredited certified body certifies the company. That’s how it meets the regulatory compliance of owners, partners, customers, and other company’s stakeholders.

ISO 22301 Certificates & its Benefits 

The certification proves that a certified body has audited the business continuity management system and it complies with the regulatory requirements of the ISO 22301. Many businesses and companies have earned the ISO 22301:2012 certification and they should now upgrade it to the latest version ISO 22301:2019. The certification makes sure that the company has the capability to deal with the disruption. Some of the main benefits of having the certification are as follows;

• Earning global acknowledgment as a reputable supplier
• Has the capability to win more business contracts
• Certifies business credentials
• Making improvements in Risk management
• Complying legally
• Business resilience
• Satisfying the needs of customers

Relationship with ISO 22301:2012

ISO 22301:2012 is the older version and it follows the British standards of BS 25999-2. The latest version ISO 22301:2019 hasn’t brought any significant changes. However, it offers more value to the customers, company, lower prescriptiveness, and more flexibility.  

How ISO 22301 Works 

The objective of ISO 22301 is to make sure that the company is following the BCM in terms of delivering the products/services after a disruptive incident like human error, natural disaster, cyber-attacks, etc.

When it happens, the company performs business impact analysis in order to find out its BCM priorities; and also conducts risk management analysis to know how it would impact the company’s operations. It would help you to define what prevention measures you should take so that you know that how you can recover in a short time.

The philosophy of ISO 22301 is to study the impact of disruption and manage the risk. It’s to know what types of activities are significant for your business and how they would impact, and then deal with the risk factor systematically.

You should implement the solution and strategies in terms of technical, physical, procedures, and policy implementation like equipment, software, and facilities. Companies usually don’t have the proper software, hardware, and facility available to them.

That’s why the focus of ISO 22301 doesn’t only offer written rules and standards to prevent disruptive incidents but also requires creating plans and allocating both physical and technical resources to make prevention and recovery happen. The implement would require you to manage assets, people, procedures, and policies the way the standard has described.

Mandatory Documentation 

If a company wants to implement the ISO regulations, then it should have the following mandatory documentation;

• Procedure for recovery
• Measurement and monitoring results
• Internal audit result
• Management review result
• Corrective action result
• Business continuity plans and incident response structure
• Recording the detail of disruptive incidents, taken actions, and decisions made
• Keeping a record of communication with the interested parties
• Communication procedure with interested stakeholders
• Proof of company’s personal capabilities
• Objectives of business continuity
• The policy of business continuity
• BCMS scope
• Regulatory and legal applicable requirements

Terms in the Standard 

MBCO (Minimum Business Continuity Objectives)

After resuming the business operations, the minimum products/services that the company should manufacture in order to reach its predefined objectives

RPO (Recovery Point Objectives)

The minimum data needed for the recovery activity in order to restore in case of losing maximum data

RTO (Recovery Time Objectives)

Setting a precise time for resuming product, service, or activity in order to recover resources

MAO (Maximum Acceptable Outage)

Or you can say MTPD (Maximum Tolerable Period of Disruption), it’s the maximum time for disrupting an activity without causing any damage

BCMS (Business Continuity Management System)

It’s the system that ensures that the company is planning, implementing, maintaining, and making improvements continuously

The framework of ISO 22301

ISO 22301 has eleven sections. Out of which 0 to 3 are introductory, and 4 to 10 are mandatory sections that the company should implement its requirements in order to comply with the standards. The section details are as follows;

Introduction

It outlines the objective of ISO 22301 and the company’s compatibility relevant to the management standards. It comprises of four elements;

• General
• BCMS Benefits
• The cycle of PDCA (plan-do-check-act)
• Content detail of the document

Scope

It describes that the international standards are applicable in various types of businesses and companies

References

It points to the standards of ISO 22300 that offers definition to some of the terms used in ISO 22301

Terms & Definitions

It points to the standards of ISO 22300

Context

It comprises of PDCA cycle and outlines the requirement for internal/external issues, requirements of interested parties, and defining BCMS scope.

• Comprehending the context of the company
• Needs and wants of interested parties
• Outlining the scope of BCMS
• BCMS

Leadership

It comprises of explaining the responsibilities of top management, their roles, content, and authority in terms of business continuity.

• Commitment and leadership
• Policy
• Authority, role, and responsibility

Planning

It comprises of explaining the opportunities and risk assessment requirements, goal setting of BCM, and change in the planning of BCM.

• Taking actions for opportunities and addressing risks
• Objectives of BCM and plans to reach them
• Change in the planning of BCMS

Support

It consists of describing the availability of resources requirements, record management, and control of resources, communication, awareness, and competencies.

• Document information
• Communication
• Awareness
• Competence
• Resources

Operation

• Checking the capabilities and documentation of BCM
• Exercise program
• Procedures and business continuity plan
• Solution and strategies of business continuity
• Risk assessment and impact analysis of the company
• Control and operational planning

Performance Evaluation

• Management review
• Internal audit
• Evaluation, analysis, measurement, monitoring

Improvement

• Bibliography and continuous improvement
• Corrective actions and nonconformity

How to Implement ISO 22301

When it comes to implementing the standards of ISO 22301, follow these main steps;

• Support management
• Recognizing the requirements
• Goals and business continuity policy
• Supportive documentation for management system
• Treatment and analyzing risk
• Impact analysis of the company
• Continuity strategy of the business
• Continuity plan of the company
• Awareness and training
• Documentation maintenance
• Testing and exercising
• Reviews of post-incident
• Communicating with the interested stakeholders
• Evaluation and measurement
• Internal audit
• Corrective actions
• Review of management

 Benefits of ISO 22301

Some of the main benefits are as follows;

• Keep Functions Running during Crisis
• Show Resilient Performance to the Suppliers & Customers
• Recognizing & Managing Threats
• Minimizing the Impact of Disruption

Conclusion: What is ISO 22301? How it Works, Terms, Framework, Benefits

After an in-depth study of what is ISO 22301; its mandatory documentation, main terms, benefits, framework, implementation steps, and how it works; we’ve realized that standards deal with the business continuity issues during the crisis. If you’re planning to implement it in your company, then make sure to keep in the abovementioned guidelines.