ISO 22313-2020 pdf free download.Security and resilience – Business continuity management systems – Guidance on the use of ISO 22301.
This document gives guidance and recommendations for applying the requirements of the business continuity management system (BCMS) given in ISO 22301. The guidance and recommendations are based on good international practice.
This document is applicable to organizations that:
a) implement, maintain and improve a BCMS;
b) seek to ensure conformity with stated business continuity policy;
c) need to be able to continue to deliver products and services at an acceptable predefined capacity during a disruption;
d) seek to enhance their resilience through the effective application of the BCMS.
The guidance and recommendations are applicable to all sizes and types of organizations, including large, medium and small organizations operating in industrial, commercial, public and not-for-profit sectors. The approach adopted depends on the organization’s operating environment and complexity.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content constitutes requirements of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.
ISO 22300, Security and resilience — Vocabulary
ISO 22301, Security and resilience — Business continuity management systems — Requirements
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO 22300, ISO 22301 and the following apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https://www.iso.org/obp
— IEC Electropedia: available at http://wwwe!ectropedia.org/
3.1 business continuity management
4 Context of the organization
4.1 Understanding the organization and its context
This clause provides recommendations for understanding the context of the organization in relation to the BCMS. Recommendations for establishing and maintaining business continuity are addressed in &1..
The organization should evaluate and understand the external and internal issues (including positive and negative factors or conditions for consideration) that are relevant to its overall objectives, its products and services, and the amount and type of risk that it may or may not take. This information should be taken into account when implementing and maintaining the organization’s BCMS and assigning priorities.
The organization’s external context includes, where relevant, the following:
— the political, legal and regulatory environment, whether international, national, regional or local;
— social and cultural aspects;
— the financial, technological, economic, natural and competitive environment, whether international, national, regional or local;
— supply chain commitments and relationships (see also ISO/TS 22318);
— drivers (e.g. risk, technology) and trends having impact on the objectives and operation of the organization;
— relationships with, and perceptions and values of, interested parties outside the organization;
— communication channels, including social media, used for ascertaining and forming such relationships.
The organization’s internal context includes, where relevant, the following:
— products and services, activities, resources, supply chains and relationships with interested parties;
— capabilities in terms of resources and knowledge (e.g. capital, time, people, processes, systems, technologies);
— existing management systems;
— information and data (stored in physical or electronic form) and decision-making processes (formal and otherwise);
— interested parties within the organization, including internal suppliers [consideration of service level agreements (SLAs), assessed resiliency and recovery arrangements], see ISO/TS 22318;
— policies and objectives, and the business strategies that are in place to achieve them;
— future opportunities and business priorities;
— perceptions, values and culture;
— standards and reference models adopted by the organization;
— structures (e.g. governance, roles, accountabilities);
— internal communication channels used for the exchange of information within the workforce (e.g. social media).ISO 22313 pdf download.