ISO 22301

ISO 22301:2019 (BDS EN ISO 22301:2020) Security of society. Business continuity management systems. Requirements

ISO 22301

ISO 22301 is an international standard that specifies the requirements for the establishment and management of an efficient business continuity management system (BSMS).

ISO 22301 describes the main elements of business continuity management: planning, development, implementation, operation, monitoring, review, analysis and continuous improvement. The requirements of the standard are designed to contribute to: the continuity of the organization's activities, to protect and reduce the likelihood of incidents, to prepare for response and recovery in the event of destructive incidents.

The business continuity management system underlines the importance of:„

• understanding the needs of the organisation and the need to establish a business continuity management policy and objectives;
  • the implementation and implementation of control mechanisms and measures to manage the overall ability of the organization to manage continuity in disruptive incidents;
  • monitoring and verification of the effectiveness of the NDS;
  • the continuous improvement of the basis of objective measurements.

The IMS, like any other management system, includes the following main elements:
a) politics;
(b) personnel with defined responsibilities;
(c) management processes related to:              •politics; 
•planning;
• implementation and action;
• performance evaluation;
• management review;
•improvement;
(d) documentation providing credible audit evidence;
(e) all business continuity management processes applicable to the organisation.

The international standard ISO 22301 applies the "Plan-Do-Check-Act" model typical of most ISO standards. This model allows the IMMS to be integrated with other management system standards, e.g. ISO 9001 Quality Management Systems, ISO 14001 Environmental Management Systems, ISO/IEC 27001 Information Security Management Systems, ISO/IEC 20000-1 IT Service Management Systems and ISO 28000 Supply Chain Security Management Systems,  thus contributing to the efficient functioning of the processes in the organization and those for auditing the management systems implemented by it.

 The requirements set out in ISO 22301 are general and are intended to be applied by different organizations, or parts thereof, regardless of the type, size and nature of the organization's work. The degree of application of these requirements depends on the specific conditions and context of the organisation.
The application of the ISO 22301 standard in business continuity management is of particular importance for organizations that operate in high-risk environments, such as manufacturing plants with branches located in different regions, in the public sector, finance, transport, telecommunications, where the ability to ensure business continuity is essential both for the organization itself,  and for its customers, stakeholders and society as a whole.

ISO 22301 is applicable to organisations wishing to:
• establish, implement, maintain and improve the LMS;
• ensure compliance with their announced business continuity policy;
• demonstrate their compliance with the applicable requirements of stakeholders;
• to obtain approval (certification/registration) of their RMS by an independent third party; 
• declare on their own responsibility and commitment to comply with this International Standard.

Benefits for the organization of implementation and certification according to ISO 22301:
• the fastest possible restoration of the normal operation of the organization in the event of force majeure or crisis situation,
• crisis preparedness based on a reliable and representative risk analysis,
• constant commitment and readiness of the staff to work in cases of force majeure,
• development of procedures based on good international practices enshrined in the requirements of the standard,
• Through the implementation and certification of the RMS, confidence in the organization's ability to maintain business continuity and increase the trust of users, governmental, non-governmental and other stakeholders in the activity is guaranteed,
• Increasing the competitiveness of the organization by increasing its credibility.