Security and resilience - Business continuity management systems - Requirements (ISO 22301:2019)

This document specifies requirements to implement, maintain and improve a management system to protect against, reduce the likelihood of the occurrence of, prepare for, respond to and recover from disruptions when they arise.
The requirements specified in this document are generic and intended to be applicable to all organizations, or parts thereof, regardless of type, size and nature of the organization. The extent of application of these requirements depends on the organization's operating environment and complexity.
This document is applicable to all types and sizes of organizations that:
a) implement, maintain and improve a BCMS;
b) seek to ensure conformity with stated business continuity policy;
c) need to be able to continue to deliver products and services at an acceptable predefined capacity during a disruption;
d) seek to enhance their resilience through the effective application of the BCMS.
This document can be used to assess an organization's ability to meet its own business continuity needs and obligations.

Sicherheit und Resilienz - Business Continuity Management System - Anforderungen (ISO 22301:2019)

Dieses Dokument legt Anforderungen fest, um ein Managementsystem zu verwirklichen, aufrechtzuerhalten und zu verbessern, um sich gegen Störungen zu schützen, die Wahrscheinlichkeit ihres Auftretens zu vermindern, sich auf diese vorzubereiten, auf diese zu reagieren und sich von diesen zu erholen, wann immer sie auftreten.
Die in diesem Dokument aufgeführten Anforderungen sind allgemeiner Art und dafür vorgesehen, für sämtliche Organisationen oder Teile dieser, unabhängig von ihrer Art, Größe oder Beschaffenheit zu gelten. Der Umfang der Anwendung dieser Anforderungen ist von der betrieblichen Umgebung und der Komplexität der jeweiligen Organisation abhängig.
Dieses Dokument gilt für sämtliche Arten und Größen von Organisationen, die:
a) ein BCMS verwirklichen, aufrechterhalten und verbessern wollen;
b) eine Übereinstimmung mit der erklärten Politik zur Aufrechterhaltung der Betriebsfähigkeit sicherstellen wollen;
c) die Fähigkeit benötigen, die Belieferung mit Produkten und Dienstleistungen mit einer akzeptablen, zuvor festgelegten Kapazität während einer Störung fortzusetzen;
d) anstreben, ihre Resilienz durch die effektive Anwendung des BCMS zu verbessern.
Dieses Dokument kann dazu genutzt werden, die Befähigung einer Organisation zur Erfüllung ihrer eigenen Erfordernissen und Verpflichtungen in Bezug auf die Aufrechterhaltung der Betriebsfähigkeit zu bewerten.

Sécurité et résilience - Systèmes de management de la continuité d'activité - Exigences (ISO 22301:2019)

Le présent document spécifie les exigences pour mettre en œuvre, maintenir et améliorer un système de management afin de se protéger contre les perturbations, réduire la vraisemblance de leur survenance, s'y préparer, y répondre et se rétablir lorsqu'elles se produisent.
Les exigences spécifiées dans le présent document sont génériques et prévues pour être applicables à tous les organismes, ou à des parties de ceux-ci, indépendamment du type, de la taille et de la nature de l'organisme. Le champ d'application de ces exigences dépend de l'environnement et de la complexité de fonctionnement de l'organisme.
Le présent document est applicable à tous les types et toutes les tailles d'organismes qui:
a) mettent en œuvre, maintiennent et améliorent un SMCA;
b) cherchent à assurer la conformité à la politique de continuité d'activité déclarée;
c) ont besoin d'être aptes à poursuivre la livraison de produits et la fourniture de services à un niveau de capacité acceptable et préalablement défini durant une perturbation;
d) cherchent à améliorer leur résilience à travers l'application efficace du SMCA.
Le présent document peut être utilisé pour apprécier l'aptitude d'un organisme à satisfaire ses propres besoins et obligations en matière de continuité d'activité.

Varnost in vzdržljivost - Sistem vodenja neprekinjenosti poslovanja - Zahteve (ISO 22301:2019)

Ta dokument določa zahteve za izvajanje, vzdrževanje in izboljševanje sistema vodenja za zaščito pred prekinitvami poslovanja, zmanjševanjem možnosti njihovega pojava, pripravo nanje, odziv nanje in obnovitev poslovanja, kadar pride do prekinitev. Zahteve, določene v tem dokumentu, so splošne in so namenjene uporabi v vseh organizacijah ali njihovih delih, in sicer ne glede na vrsto, velikost in naravo organizacije. Obseg uporabe teh zahtev je odvisen od delovnega okolja in kompleksnosti organizacije. Ta dokument se uporablja za vse vrste in velikosti organizacij, ki: a) izvajajo, vzdržujejo in izboljšujejo sistem vodenja neprekinjenosti poslovanja; b) stremijo k zagotavljanju skladnosti z veljavnim pravilnikom o neprekinjenosti poslovanja; c) morajo biti zmožne nadaljevati dobavo izdelkov in storitev na sprejemljivi predhodno določeni ravni zmogljivosti med prekinitvijo; d) iščejo priložnosti za povečanje svoje odpornosti na podlagi učinkovite uporabe sistema vodenja neprekinjenosti poslovanja. Ta dokument se lahko uporablja za oceno sposobnosti organizacije za izpolnjevanje svojih potreb in obveznosti glede neprekinjenosti poslovanja.

General Information

Status
Published
Publication Date
05-Nov-2019
Current Stage
6060 - Definitive text made available (DAV) - Publishing
Due Date
06-Nov-2019
Completion Date
06-Nov-2019

RELATIONS

Buy Standard

Standard
EN ISO 22301:2020
English language
32 pages
sale 10% off
Preview
sale 10% off
Preview

e-Library read for
1 day

Standards Content (sample)

SLOVENSKI STANDARD
SIST EN ISO 22301:2020
01-januar-2020
Nadomešča:
SIST EN ISO 22301:2014

Varnost in vzdržljivost - Sistem vodenja neprekinjenosti poslovanja - Zahteve (ISO

22301:2019)

Security and resilience - Business continuity management systems - Requirements (ISO

22301:2019)
Sicherheit und Schutz des Gemeinwesens - Business Continuity Management System -
Anforderungen (ISO 22301:2019)

écurité et résilience - Systèmes de management de la continuité d'activité - Exigences

(ISO 22301:2019)
Ta slovenski standard je istoveten z: EN ISO 22301:2019
ICS:
03.100.01 Organizacija in vodenje Company organization and
podjetja na splošno management in general
03.100.70 Sistemi vodenja Management systems
SIST EN ISO 22301:2020 en,fr,de

2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

---------------------- Page: 1 ----------------------
SIST EN ISO 22301:2020
---------------------- Page: 2 ----------------------
SIST EN ISO 22301:2020
EN ISO 22301
EUROPEAN STANDARD
NORME EUROPÉENNE
November 2019
EUROPÄISCHE NORM
ICS 03.100.01; 03.100.70 Supersedes EN ISO 22301:2014
English Version
Security and resilience - Business continuity management
systems - Requirements (ISO 22301:2019)

Sécurité et résilience - Systèmes de management de la Sicherheit und Resilienz - Business Continuity

continuité d'activité - Exigences (ISO 22301:2019) Management System - Anforderungen (ISO

22301:2019)
This European Standard was approved by CEN on 14 October 2019.

CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this

European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references

concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN

member.

This European Standard exists in three official versions (English, French, German). A version in any other language made by

translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC Management

Centre has the same status as the official versions.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,

Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway,

Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and

United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION
EUROPÄISCHES KOMITEE FÜR NORMUNG
CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels

© 2019 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN ISO 22301:2019 E

worldwide for CEN national Members.
---------------------- Page: 3 ----------------------
SIST EN ISO 22301:2020
EN ISO 22301:2019 (E)
Contents Page

European foreword ....................................................................................................................................................... 3

---------------------- Page: 4 ----------------------
SIST EN ISO 22301:2020
EN ISO 22301:2019 (E)
European foreword

This document (EN ISO 22301:2019) has been prepared by Technical Committee ISO/TC 292 "Security

and resilience" in collaboration with Technical Committee CEN/TC 391 “Societal and Citizen Security”

the secretariat of which is held by AFNOR.

This European Standard shall be given the status of a national standard, either by publication of an

identical text or by endorsement, at the latest by May 2020, and conflicting national standards shall be

withdrawn at the latest by May 2020.

Attention is drawn to the possibility that some of the elements of this document may be the subject of

patent rights. CEN shall not be held responsible for identifying any or all such patent rights.

This document supersedes EN ISO 22301:2014.

According to the CEN-CENELEC Internal Regulations, the national standards organizations of the

following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,

Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland,

Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Republic of

North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and the

United Kingdom.
Endorsement notice

The text of ISO 22301:2019 has been approved by CEN as EN ISO 22301:2019 without any modification.

---------------------- Page: 5 ----------------------
SIST EN ISO 22301:2020
---------------------- Page: 6 ----------------------
SIST EN ISO 22301:2020
INTERNATIONAL ISO
STANDARD 22301
Second edition
2019-10
Security and resilience — Business
continuity management systems —
Requirements
Sécurité et résilience — Systèmes de management de la continuité
d'activité — Exigences
Reference number
ISO 22301:2019(E)
ISO 2019
---------------------- Page: 7 ----------------------
SIST EN ISO 22301:2020
ISO 22301:2019(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO 2019

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may

be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting

on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address

below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Fax: +41 22 749 09 47
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii © ISO 2019 – All rights reserved
---------------------- Page: 8 ----------------------
SIST EN ISO 22301:2020
ISO 22301:2019(E)
Contents Page

Foreword ..........................................................................................................................................................................................................................................v

Introduction ................................................................................................................................................................................................................................vi

1 Scope ................................................................................................................................................................................................................................. 1

2 Normative references ...................................................................................................................................................................................... 1

3 Terms and definitions ..................................................................................................................................................................................... 1

4 Context of the organization ....................................................................................................................................................................... 7

4.1 Understanding the organization and its context ....................................................................................................... 7

4.2 Understanding the needs and expectations of interested parties .............................................................. 7

4.2.1 General...................................................................................................................................................................................... 7

4.2.2 Legal and regulatory requirements ................................................................................................................. 7

4.3 Determining the scope of the business continuity management system ............................................. 7

4.3.1 General...................................................................................................................................................................................... 7

4.3.2 Scope of the business continuity management system .................................................................. 8

4.4 Business continuity management system ....................................................................................................................... 8

5 Leadership .................................................................................................................................................................................................................. 8

5.1 Leadership and commitment ..................................................................................................................................................... 8

5.2 Policy ............................................................................................................................................................................................................... 8

5.2.1 Establishing the business continuity policy ............................................................................................. 8

5.2.2 Communicating the business continuity policy .................................................................................... 9

5.3 Roles, responsibilities and authorities ............................................................................................................................... 9

6 Planning ......................................................................................................................................................................................................................... 9

6.1 Actions to address risks and opportunities ................................................................................................................... 9

6.1.1 Determining risks and opportunities ............................................................................................................ 9

6.1.2 Addressing risks and opportunities ................................................................................................................ 9

6.2 Business continuity objectives and planning to achieve them ...................................................................... 9

6.2.1 Establishing business continuity objectives ............................................................................................ 9

6.2.2 Determining business continuity objectives.........................................................................................10

6.3 Planning changes to the business continuity management system .......................................................10

7 Support ........................................................................................................................................................................................................................10

7.1 Resources ..................................................................................................................................................................................................10

7.2 Competence ............................................................................................................................................................................................10

7.3 Awareness ................................................................................................................................................................................................11

7.4 Communication ...................................................................................................................................................................................11

7.5 Documented information ............................................................................................................................................................11

7.5.1 General...................................................................................................................................................................................11

7.5.2 Creating and updating ..............................................................................................................................................11

7.5.3 Control of documented information ............................................................................................................12

8 Operation ..................................................................................................................................................................................................................12

8.1 Operational planning and control .......................................................................................................................................12

8.2 Business impact analysis and risk assessment ........................................................................................................12

8.2.1 General...................................................................................................................................................................................12

8.2.2 Business impact analysis .......................................................................................................................................13

8.2.3 Risk assessment ...................................................................... .......................................................................................13

8.3 Business continuity strategies and solutions ............................................................................................................13

8.3.1 General...................................................................................................................................................................................13

8.3.2 Identification of strategies and solutions ................................................................................................13

8.3.3 Selection of strategies and solutions ...........................................................................................................14

8.3.4 Resource requirements ...........................................................................................................................................14

8.3.5 Implementation of solutions ..............................................................................................................................14

8.4 Business continuity plans and procedures ..................................................................................................................14

8.4.1 General...................................................................................................................................................................................14

© ISO 2019 – All rights reserved iii
---------------------- Page: 9 ----------------------
SIST EN ISO 22301:2020
ISO 22301:2019(E)

8.4.2 Response structure .....................................................................................................................................................15

8.4.3 Warning and communication ............................................................................................................................15

8.4.4 Business continuity plans .....................................................................................................................................16

8.4.5 Recovery ...............................................................................................................................................................................17

8.5 Exercise programme .......................................................................................................................................................................17

8.6 Evaluation of business continuity documentation and capabilities ......................................................17

9 Performance evaluation ............................................................................................................................................................................17

9.1 Monitoring, measurement, analysis and evaluation ............................................................................................17

9.2 Internal audit .........................................................................................................................................................................................18

9.2.1 General...................................................................................................................................................................................18

9.2.2 Audit programme(s) ..................................................................................................................................................18

9.3 Management review ........................................................................................................................................................................18

9.3.1 General...................................................................................................................................................................................18

9.3.2 Management review input ...................................................................................................................................18

9.3.3 Management review outputs .............................................................................................................................19

10 Improvement .........................................................................................................................................................................................................19

10.1 Nonconformity and corrective action ..............................................................................................................................19

10.2 Continual improvement ...............................................................................................................................................................20

Bibliography .............................................................................................................................................................................................................................21

iv © ISO 2019 – All rights reserved
---------------------- Page: 10 ----------------------
SIST EN ISO 22301:2020
ISO 22301:2019(E)
Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards

bodies (ISO member bodies). The work of preparing International Standards is normally carried out

through ISO technical committees. Each member body interested in a subject for which a technical

committee has been established has the right to be represented on that committee. International

organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.

ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of

electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are

described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the

different types of ISO documents should be noted. This document was drafted in accordance with the

editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject of

patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of

any patent rights identified during the development of the document will be in the Introduction and/or

on the ISO list of patent declarations received (see www .iso .org/ patents).

Any trade name used in this document is information given for the convenience of users and does not

constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and

expressions related to conformity assessment, as well as information about ISO’s adherence to the

World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www .iso .org/

iso/ foreword .html.

This document was prepared by Technical Committee ISO/TC 292, Security and resilience.

This second edition cancels and replaces the first edition (ISO 22301:2012), which has been technically

revised. The main changes compared with the previous edition are as follows:

— ISO’s requirements for management system standards, which have evolved since 2012, have been

applied;
— requirements have been clarified, with no new requirements added;

— discipline-specific business continuity requirements are now almost entirely within Clause 8;

— Clause 8 has been re-structured to provide a clearer understanding of the key requirements;

— a number of discipline-specific business continuity terms have been modified to improve clarity

and to reflect current thinking.

Any feedback or questions on this document should be directed to the user’s national standards body. A

complete listing of these bodies can be found at www .iso .org/ members .html.
© ISO 2019 – All rights reserved v
---------------------- Page: 11 ----------------------
SIST EN ISO 22301:2020
ISO 22301:2019(E)
Introduction
0.1 General

This document specifies the structure and requirements for implementing and maintaining a business

continuity management system (BCMS) that develops business continuity appropriate to the amount

and type of impact that the organization may or may not accept following a disruption.

The outcomes of maintaining a BCMS are shaped by the organization’s legal, regulatory, organizational

and industry requirements, products and services provided, processes employed, size and structure of

the organization, and the requirements of its interested parties.
A BCMS emphasizes the importance of:

— understanding the organization’s needs and the necessity for establishing business continuity

policies and objectives;

— operating and maintaining processes, capabilities and response structures for ensuring the

organization will survive disruptions;
— monitoring and reviewing the performance and effectiveness of the BCMS;
— continual improvement based on qualitative and quantitative measures.
A BCMS, like any other management system, includes the following components:
a) a policy;
b) competent people with defined responsibilities;
c) management processes relating to:
1) policy;
2) planning;
3) implementation and operation;
4) performance assessment;
5) management review;
6) continual improvement;

d) documented information supporting operational control and enabling performance evaluation.

0.2 Benefits of a business continuity management system

The purpose of a BCMS is to prepare for, provide and maintain controls and capabilities for managing

an organization’s overall ability to continue to operate during disruptions. In achieving this, the

organization is:
a) from a business perspective:
1) supporting its strategic objectives;
2) creating a competitive advantage;
3) protecting and enhancing its reputation and credibility;
vi © ISO 2019 – All rights reserved
---------------------- Page: 12 ----------------------
SIST EN ISO 22301:2020
ISO 22301:2019(E)
4) contributing to organizational resilience;
b) from a financial perspective:
1) reducing legal and financial exposure;
2) reducing direct and indirect costs of disruptions;
c) from the perspective of interested parties:
1) protecting life, property and the environment;
2) considering the expectations of interested parties;
3) providing confidence in the organization’s ability to succeed;
d) from an internal processes perspective:
1) improving its capability to remain effective during disruptions;
2) demonstrating proactive control of risks effectively and efficiently;
3) addressing operational vulnerabilities.
0.3 Plan-Do-Check-Act (PDCA) cycle

This document applies the Plan (establish), Do (implement and operate), Check (monitor and review)

and Act (maintain and improve) (PDCA) cycle to implement, maintain and continually improve the

effectiveness of an organization’s BCMS.

This ensures a degree of consistency with other management systems standards, such as ISO 9001,

ISO 14001, ISO/IEC 20000-1, ISO/IEC 27001 and ISO 28000, thereby supporting consistent and

integrated implementation and operation with related management systems.

In accordance with the PDCA cycle, Clauses 4 to 10 cover the following components.

— Clause 4 introduces the requirements necessary to establish the context of the BCMS applicable to

the organization, as well as needs, requirements and scope.

— Clause 5 summarizes the requirements specific to top management’s role in the BCMS, and how

leadership articulates its expectations to the organization via a policy statement.

— Clause 6 describes the requirements for establishing strategic objectives and guiding principles for

the BCMS as a whole.

— Clause 7 supports BCMS operations related to establishing competence and communication on a

recurring/as-needed basis with interested parties, while documenting, controlling, maintaining

and retaining required documented information.

— Clause 8 defines business continuity needs, determines how to address them and develops

procedures to manage the organization during a disruption.

— Clause 9 summarizes the requirements necessary to measure business continuity performance,

BCMS conformity with this document, and to conduct management review.

— Clause 10 identifies and acts on BCMS nonconformity and continual improvement through

corrective action.
0.5 Contents of this document

This document conforms to ISO’s requirements for management system standards. These requirements

include a high level structure, identical core text and common terms with core definitions, designed to

benefit users implementing multiple ISO management system standards.
© ISO 2019 – All rights reserved vii
---------------------- Page: 13 ----------------------
SIST EN ISO 22301:2020
ISO 22301:2019(E)

This document does not include requirements specific to other management systems, though its

elements can be aligned or integrated with those of other management systems.

This document contains requirements that can be used by an organization to implement a BCMS and to

assess conformity. An organization that wishes to demonstrate conformity to this document can do so by:

— making a self-determination and self-declaration; or

— seeking confirmation of its conformity by parties having an interest in the organization, such as

customers; or

— seeking confirmation of its self-declaration by a party external to the organization; or

— seeking certification/registration of its BCMS by an external organization.

Clauses 1 to 3 in this document set out the scope, normative references and terms and definitions

that apply to the use of this document. Clauses 4 to 10 contain the requirements to be used to assess

conformity to this document.
In this document, the following verbal forms are used:
a) “shall” indicates a requirement;
b) “should” indicates a recommendation;
c) “may” indicates a permission;
d) “can” indicates a possibility or a capability.

Information marked as “NOTE” is for guidance in understanding or clarifying the associated

requirement. “Notes to entry” used in Clause 3 provide additional information that supplements the

terminological data and can contain provisions relating to the use of a term.
viii © ISO 2019 – All rights reserved
---------------------- Page: 14 ----------------------
SIST EN ISO 22301:2020
INTERNATIONAL STANDARD ISO 22301:2019(E)
Security and resilience — Business continuity
management systems — Requirements
1 Scope

This document specifies requirements to implement, maintain and improve a management system to

protect against, reduce the likelihood of the occurrence of, prepare for, respond to and recover from

disruptions when they arise.

The requirements specified in this document are generic and intended to be applicable to all

organizations, or parts thereof, regardless of type, size and nature of the organization. The extent of

application of these requirements depends on the organization’s operating environment and complexity.

This document is applicable to all types and sizes of organizations that:
a) implement, maintain and improve a BCMS;
b) seek to ensure conformity with stated business continuity policy;

c) need to be able to continue to deliver products and services at an acceptable predefined capacity

during a disruption;

d) seek to enhance their resilience through the effective application of the BCMS.

This document can be used to assess an organization’s ability to meet its own business continuity needs

and obligations.
2 Normative references

The following documents are referred to in the text in such a way that some or all of their content

constitutes requirements of this document. For dated references, only the edition cited applies. For

undated references, the latest edition of the referenced document (including any amendments) applies.

ISO 22300, Security and resilience — Vocabulary
3 Terms and definitions

For the purposes of this document, the terms and definitions given in ISO 22300 and th

...

Questions, Comments and Discussion

Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.