News on the ISO 22301 standard version 2019 - Business continuity management systems

 01/31/2024

• reduce financial losses in the event of unforeseen events
• create a competitive advantage
• protect personnel and the environment

1. NEWS COMPARED TO THE 2012 EDITION

• evolution of management system requirements
• clarification of certain requirements
• no new requirements
• addition of business continuity requirements linked to specific disciplines in clause 8
• restructuring of clause 8
• modification of certain specific terms

2. ARTICLES ARE 10 ACCORDING TO TOP LEVEL STRUCTURE:

1. Scope
2. Normative references
3. Terms and definitions
4. Context of the organization
5. Leadership
6. Planning
7. Support
8. Operation
9. Performance evaluation
10. Improvement

3. REQUIRED PROCEDURES (*MANDATORY)

• procedures (documented):  
  • legal requirements (§ 4.2.2)
  • document management (§ 7.5)
  • backup (§ 8.1)
  • business continuity (§ 8.4.1) *
  • response to disturbances (§ 8.4.2)
  • warning and communication (§ 8.4.3) *
  • business continuity plan (§ 8.4.4) *
  • internal audit (§ 9.2.2)
  • corrective actions (§ 10.1.3)

4. RECORDS REQUIRED (*MANDATORY)

• recordings: 
  • business context (§ 4.1)
  • list of legal requirements (§ 4.2.2) *
  • field of application (§ 4.3) *
  • responsibilities and authorities (§ 5.3)
  • business continuity objectives (§ 6.2) *
  • plan to achieve the objectives (§ 6.2)
  • skills (§ 7.2) *
  • training program (§ 7.3)
  • communications plan (§ 7.4)
  • list of documents of external origin (§ 7.5.3.2)
  • operational control (§ 8.1)
  • changes (§ 8.1)
  • outsourced processes (§ 8.1)
  • impact assessment, analysis, results (§ 8.2.2)
  • risk treatment (§ 8.2.3)
  • strategies and solutions (§ 8.3.3)
  • risk communication (§ 8.4.3) *
  • disturbances, actions and decisions (8.4.3.1) *
  • business continuity plans (§ 8.4.4) *
  • exercise program (§ 8.5)
  • incident scenarios (§ 8.5)
  • exercise results (§ 8.5)
  • review of business continuity capabilities (§ 8.6)
  • performance evaluation (§ 9.1) *
  • methods and results of inspection, analysis and evaluation (§ 9.1)
  • SMCA maintenance plan (§ 9.1)
  • internal audit, program (§ 9.2.2) *
  • internal audit, report (§ 9.2.2) *
  • management review, results (§ 9.3.3.2) *
  • non-conformities and corrective actions (§ 10.1)
  • improvement report (§ 10.2)

5. REQUIRED PROCESSES (*MANDATORY)

• process: 
  • identify legal requirements (§ 4.2.2) *
  • analyze the impact assessment (§ 8.2.1) *
  • assess the risk (§ 8.2.3) *
  • restore activities (§ 8.4.5) *
  • audit internally (§ 9.2.2) *

6. REQUIRED POLICY (*MANDATORY)

• policy: 
  • continuity of activity (§ 5.2.1) *

7. THE VERB SHALL IS USED 242 TIMES

8. DETAILS OF ARTICLES AND PARAGRAPHS