ISO 22301 LA key terms

A documented management system used to establish continuity policy and objectives, and to achieve those objectives through interrelated processes for prevention, preparedness, response, and recovery.

A process that analyses activities and the effects of disruption over time, identifying time-critical activities, dependencies, and the consequences of failure so priorities and recovery objectives can be set.

A systematic process of identifying threats and vulnerabilities relevant to continuity, analysing their likelihood and consequences, and evaluating whether the resulting risk needs treatment.

The selected set of arrangements and resource commitments chosen to protect prioritized activities and meet recovery objectives, after comparing options against cost, risk, and feasibility.

Documented procedures and information that guide an organization to respond to, and recover from, a disruption and resume prioritized activities within agreed timeframes.

The target time set for resuming a prioritized activity, or restoring a resource supporting it, after a disruption occurs, expressed as a duration from a defined starting point.

The longest period that an activity can be unavailable before its disruption causes unacceptable harm to the organization, its stakeholders, or its obligations; also called maximum tolerable period of disruption.

The minimum level of products, services, or activity performance that the organization decides is acceptable to resume and sustain during and after a disruption.

An activity that has been ranked as time-critical because its disruption would cause the greatest unacceptable impact, and which therefore drives continuity strategies and recovery targets.

An event, anticipated or unanticipated, that interrupts or degrades normal operations and may prevent the organization from delivering products or services at acceptable levels.

An occurrence that has actually happened and requires an immediate operational response to prevent escalation, limit harm, or restore normal service.

A situation with high actual or potential consequences that threatens the organization's viability, reputation, or strategic objectives and requires coordinated management beyond routine response.

Top management's documented statement of intent and direction for continuity, including commitments to meet applicable requirements and to continual improvement of the management system.

The person or group that directs and controls the organization at its highest level and has authority to approve policy, provide resources, and be accountable for the effectiveness of the management system.

A planned, top-management evaluation of the management system's suitability, adequacy, and effectiveness, using defined inputs and producing decisions and actions for improvement.

A failure to meet a requirement, whether stated in the standard, the organization's own management system documentation, or an applicable legal or contractual obligation.

Action taken to eliminate the cause of a detected nonconformity or other undesirable situation so that it does not recur, including analysis of root cause and evaluation of effectiveness.

A recurring process of enhancing the management system's performance, driven by analysis of data, audit results, and management review decisions rather than one-off fixes.

The planned schedule of tests, drills, and exercises used to validate continuity arrangements, develop competence, and identify weaknesses to be corrected.

A structured evaluation after an exercise or actual incident that records what happened, assesses performance against objectives, and generates improvement actions with owners and dates.

The set of requirements, policies, or standards against which audit evidence is compared to determine conformity; they must be agreed and communicated before the audit begins.

Records, statements, observations, or other verifiable information that the auditor collects and uses to evaluate whether audit criteria are being met.

The result of evaluating collected evidence against audit criteria, classified as conforming or nonconforming, and used as the basis for reporting conclusions.

The stated boundaries of an audit, describing which activities, locations, functions, and parts of the management system are included and which are excluded.

The set of one or more audits planned for a specific timeframe and purpose, managed as a process to achieve efficient and effective coverage of the management system.

A description of the activities and arrangements for a single audit, covering objectives, criteria, scope, schedule, team roles, and sampling approach.

A short formal session at the start of an audit confirming its purpose, scope, criteria, methods, schedule, and communication channels, and resolving any last-minute questions.

A formal session at the end of an audit at which findings and conclusions are presented to the auditee, together with any agreed follow-up expectations.

The technique of selecting a representative subset of records, processes, or personnel for examination, so that conclusions can be drawn about the whole population.

The demonstrated ability to apply knowledge and skills to achieve intended results, evidenced through education, training, experience, or observed performance.

The condition in which auditors are free from bias, conflict of interest, and influence from the activity being audited, so that findings and conclusions remain objective and credible.

A designated group with defined roles and authority to coordinate strategic decisions, communications, and resource allocation during a crisis, separate from routine operational response.

The defined roles, escalation paths, and communication mechanisms used to detect, assess, and respond to an incident in a coordinated way.

A structured method for tracing a nonconformity or failure back to the underlying systemic causes that allowed it to occur, rather than to its immediate symptoms.

The process of selecting and implementing measures to modify risk, such as avoiding, reducing, transferring, or accepting it, and evaluating whether residual risk is tolerable.

The arrangements used to understand dependencies on external providers and to maintain acceptable delivery of products or services when those providers are disrupted.

An independent third-party audit, typically in two stages, that evaluates a management system's conformity to requirements and supports a decision on granting certification.