The creators of isology®

Join Rachel Churchman, Managing Consultant this week as she explains a the key changes to ISO 22301 :2019. Here are the show highlights:

October 2019, the ISO 22301 Standard was updated (previously ISO 22301:2012 with minor amends in 2014).

• On the whole that standard is more streamlined and a lot of repetition has been removed from the standard.  In addition, it aligns far more closely with other standards.

• Structure has remained the same although it has now been better aligned with Annex SL (previously some minor deviations).

• Now takes a broader approach from strategy-based to solution-based – The ISO 22301:2019 standard requires organisations to not only develop high-level strategies to ensure business continuity, but also to define solutions to handle specific risks and impacts relevant to continuity.

• This is the most significant change for top management because the identification of required resources is now related to solutions, not strategies. Defining resources in terms of strategies is not as precise as when you define them in terms of the solutions, which greatly affects the budget planning for the BCMS.
• Managing changes to the BCMS – is now a mandatory clause (previously just implied throughout the Standard).   This  new requirement of ISO 22301:2019 requires organizations to make changes in the BCMS in a planned manner, which can be achieved by considering:
  • the purpose of the change and its consequences
  • how the integrity of the Business Continuity Management System is impacted by the change
  • the resources available to perform the change
• the definition or change of responsibilities and authoritiesIt should be noted that in a number of areas the new standard is significantly less detailed and prescriptive than its predecessor – (i.e. Context and Scope clauses are now in alignment with other ISO standards where previously these clause were very prescriptive for ISO 22301).

• Clause 6.1.2 now makes it clear that the risks (and opportunities) that need to be addressed relate to the effectiveness of the BCMS, as opposed to the risks of disruption, which are addressed by Clause 8.2.3. The same relationship is intended in other standards (such as ISO 27001).
• The requirements for conducting the business impact analysis (BIA) are now clearer. The relationship between unacceptable impact, maximum tolerable period of disruption and prioritized timeframes for activity resumption is defined as well as using the BIA to identify ‘prioritized activities’. It should be noted that there is no specific requirement with the 2019 version to document the BIA process.
• Evaluation of BC documentation and capabilities specifically requires the suitability, adequacy and effectiveness of BIAs and risk assessments to be evaluated. This was previously only an implicit requirement in the name of effectiveness, but points to the key role played by BIAs and risk assessments (so having them documented is a good thing).

• The concept of minimum activity levels has shifted from the need to identify minimum levels of products and services to minimum acceptable levels of activity, the linking of which is implicit, to the minimum acceptable capacity of resumed activities.

• One of the criticisms from users of ISO 22301:2012 was the lack of a detailed requirement around the need for an organization to manage its supply chain’s own business continuity capabilities. There is now a requirement to ensure that outsourced processes and the supply chain are controlled.

• From an exercise and test perspective that is now direct reference to validating continuity strategies and solutions (rather than simply BC arrangements)

If your organization’s currently certified to ISO 22301:2012 we anticipate you will have three years to transition to ISO 22301:2019 and after 30 October 2022 certificate for ISO 22301:2012 will no longer be valid*.

BSI are noting that they  will continue to deliver audits against ISO 22301:2012 until 30 April 2021 to allow you time to get your system updated and aligned to ISO 22301:2019.

Further resources:

Free standards available from BSI HERE

Need assistance with ISO 22301? We’d be happy to help

We also have an Introduction to ISO 22301 E-learning course available HERE. Use discount code: ISO2230110 for 10% until the end of July 2020.

We’d love to hear your views and comments about the ISO Show, here’s how:

• Share the ISO Show on twitter or Linkedin
• Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube |iTunes | Soundcloud

As anyone who has experience of business continuity – i.e. the current Covid-19 pandemic – will understand is that effective communication is absolutely vital to ensure an effective response.

Planning for how you will communicate, who will communicate, when you will communicate and pre-drafted message for reasonably foreseeable events can make or break an effective BCP response. 

Awareness of the BCP and the part they play within the plan is critical for your staff.  Therefore, there’s a requirement to undertake awareness training for staff -both those that have a role to play, and those that are simply required to follow orders given.

And we mustn’t forget the additional training that may be required for ‘deputies’ within a response plan. 

People can react differently to that expected in an emergency situation, so it’s vital that staff are aware of how they will be made aware of a BCP event, and what role they play within in.  If they have a role to play, they need to have additional training on the specific response plan so that it’s followed should it ever be invoked. 

Part of this awareness training and reinforcement can be supported by ‘exercising’ and ‘testing’ the plan as a team.  This is an effective way of walking through the theoretical, taking the time to consider various scenarios and making informed decisions within a calm environment.  This can prevent knee-jerk or incorrect decisions being made during the time of an actual response.  Exercising and testing can and should also involve any key interested parties outside of the organisation in order to stress-test their ability to support the business in times of crisis.  Any lessons learnt from exercises, tests or actual BCP events should always be followed up from a lessons learnt point of view to ensure that response plans are updated in line with any changes or issues not previously considered – and then they need to be re-communicated in the business.

Join us next week as we discuss how to engage staff with your BCP effectively.

Need assistance with ISO 22301? We’d be happy to help

We also have an Introduction to ISO 22301 E-learning course available HERE. Use discount code: ISO2230110 for 10% until the end of July 2020.

We’d love to hear your views and comments about the ISO Show, here’s how:

• Share the ISO Show on twitter or Linkedin
• Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube |iTunes | Soundcloud