ISO 22301 LA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Business continuity

The capability of an organization to continue delivering products or services at acceptable predefined levels following a disruptive incident, achieved through prevention, preparedness, response and recovery arrangements.

Recovery time objective

The target duration within which an activity, resource or system must be restored after disruption, set shorter than the maximum acceptable outage so a recovery buffer remains.

Recovery point objective

The maximum acceptable amount of data, expressed as time before the incident, that may be lost when an activity resumes, driving backup and replication frequency decisions.

Maximum acceptable outage

The time by which the impact of failing to resume an activity becomes unacceptable to the organization, stakeholders or legal obligations, and the upper bound for recovery targets.

Minimum business continuity objective

The minimum level of products or services, expressed in measurable terms such as volume, geography or service tier, that the organization accepts during a disruption.

Business impact analysis

A process that identifies time-critical activities, their dependencies and the consequences of disruption over time, producing prioritized activities, maximum acceptable outages and recovery objectives.

Disruptive incident

An event, anticipated or unanticipated, that causes an unplanned negative deviation from expected delivery of products or services and triggers incident response and continuity arrangements.

Plan-Do-Check-Act

The continual improvement cycle underpinning ISO 22301: establish the BCMS, implement and operate it, monitor and review performance, then maintain and improve through corrective action.

BCMS scope statement

A documented statement of the organizational units, locations, processes and boundaries covered by the business continuity management system, including justification for any exclusions.

Business continuity policy

A top-management statement of commitment that establishes the BCMS purpose, framework, objectives and commitment to continual improvement and to satisfying applicable requirements.

Continuity strategies and solutions

Arrangements selected to protect prioritized activities and resources after disruption, chosen by evaluating options against BIA and risk outputs and documented with selection rationale.

Incident response structure

The documented roles, authorities, escalation thresholds and communication lines that determine who activates plans, who decides and who communicates during a disruptive incident.

Exercise and test programme

Planned activities at defined intervals and after significant change that validate continuity plans and procedures, with documented results and follow-up actions for identified issues.

Management review

A top-management evaluation at planned intervals of BCMS suitability, adequacy and effectiveness, covering audit results, performance, changes, risks and improvement opportunities.

Documented information

Information the organization must control and maintain, including the BC policy, scope, BIA and risk results, strategies, plans, exercise records and audit evidence.

Audit

A systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria to determine the extent of conformity.

Audit criteria

The set of policies, procedures, requirements or standards used as a reference against which audit evidence is compared to determine conformity.

Objective evidence

Verifiable information such as records, statements of fact or observations that supports an audit finding and can be traced to its source.

Major nonconformity

A nonconformity indicating systemic failure, absence of a required process or failure to correct a previous finding, affecting the capability of the management system.

Minor nonconformity

An isolated or non-systemic lapse against a requirement that does not by itself undermine the overall effectiveness of the management system.

Audit programme

A set of one or more audits planned for a specific time frame and purpose, including arrangements, resources and schedules for their conduct.

Auditor independence

The condition in which auditors are free from bias and conflict of interest, in particular never auditing their own work or activities they are responsible for.

Audit plan

A description of the activities and arrangements for a single audit, including objectives, scope, criteria, schedule, team, methods and reporting arrangements.

Document review

Pre-fieldwork examination of BCMS documentation such as policy, scope, BIA, risk assessment, plans and audit results to identify areas requiring on-site verification.

Risk-based audit sampling

Selection of sites, processes, shifts and personnel for examination based on risk and impact, ensuring representative coverage of the audit scope.

Opening meeting

The meeting at audit start confirming objectives, scope, criteria, schedule, methods, confidentiality and reporting, and allowing the auditee to ask questions.

Evidence triangulation

Corroborating interview statements with records and direct observation so that audit findings rest on verifiable facts rather than opinion or single sources.

Nonconformity report

A record stating the requirement not met, the objective evidence found and the resulting gap, without prescribing the specific corrective solution.

Corrective action verification

Follow-up confirming that action addressed the root cause of a nonconformity and is effective, not merely that the immediate symptom was corrected.

Audit conclusion

The professional judgement in the audit report on the extent of conformity with criteria and the effectiveness of the management system, including limitations on coverage.

Closing meeting

The meeting at audit end presenting findings, conclusions and opinion, explaining nonconformity grading, confirming agreed facts and stating report and follow-up timelines.

Audit programme review

Periodic evaluation of audit programme performance and design using indicators such as completion, nonconformity trends and closure times, adjusting plans for risk and change.