The ISO Show: Episode 47 – Key Changes to the new Business Continuity standard ISO 22301: 2019
Join Rachel Churchman, Managing Consultant this week as she explains a the key changes to ISO 22301 :2019. Here are the show highlights:
October 2019, the ISO 22301 Standard was updated (previously ISO 22301:2012 with minor amends in 2014).
On the whole that standard is more streamlined
and a lot of repetition has been removed from the standard. In addition, it aligns far more closely with
other standards.
Structure has remained the same although it has
now been better aligned with Annex SL (previously some minor deviations).
Now takes a broader approach from strategy-based
to solution-based – The ISO 22301:2019 standard requires organisations to not
only develop high-level strategies to ensure business continuity, but also to
define solutions to handle specific risks and impacts relevant to continuity.
This is the most significant change for top
management because the identification of required resources is now related to
solutions, not strategies. Defining resources in terms of strategies is not as
precise as when you define them in terms of the solutions, which greatly
affects the budget planning for the BCMS.
Managing changes to the BCMS – is now a
mandatory clause (previously just implied throughout the Standard). This
new requirement of ISO 22301:2019 requires organizations to make changes
in the BCMS in a planned manner, which can be achieved by considering:
the purpose of the change and its consequences
how the integrity of the Business Continuity
Management System is impacted by the change
the resources available to perform the change
the definition or change of responsibilities and
authoritiesIt should be noted that in a number of areas the new standard is significantly
less detailed and prescriptive than its predecessor – (i.e. Context and
Scope clauses are now in alignment with other ISO standards where previously
these clause were very prescriptive for ISO 22301).
Clause 6.1.2 now makes it clear that the risks
(and opportunities) that need to be addressed relate to the effectiveness of
the BCMS, as opposed to the risks of disruption, which are addressed by Clause
8.2.3. The same relationship is intended in other standards (such as ISO 27001).
The requirements for conducting the business
impact analysis (BIA) are now clearer. The relationship between unacceptable
impact, maximum tolerable period of disruption and prioritized timeframes for
activity resumption is defined as well as using the BIA to identify
‘prioritized activities’. It should be noted that there is no specific
requirement with the 2019 version to document the BIA process.
Evaluation of BC documentation and capabilities
specifically requires the suitability, adequacy and effectiveness of BIAs and
risk assessments to be evaluated. This was previously only an implicit
requirement in the name of effectiveness, but points to the key role played by
BIAs and risk assessments (so having them documented is a good thing).
The concept of minimum activity levels has
shifted from the need to identify minimum levels of products and services to
minimum acceptable levels of activity, the linking of which is implicit, to the
minimum acceptable capacity of resumed activities.
One of the criticisms from users of ISO
22301:2012 was the lack of a detailed requirement around the need for an
organization to manage its supply chain’s own business continuity capabilities.
There is now a requirement to ensure that outsourced processes and the supply chain
are controlled.
From an exercise and test perspective that is
now direct reference to validating continuity strategies and solutions (rather
than simply BC arrangements)
If your organization’s currently certified to ISO 22301:2012
we anticipate you will have three years to transition to ISO 22301:2019 and
after 30 October 2022 certificate for ISO 22301:2012 will no longer be valid*.
BSI are noting that they will continue to deliver audits against ISO 22301:2012 until 30 April 2021 to allow you time to get your system updated and aligned to ISO 22301:2019.
Stitcher
