ISO 22301 LI flashcards
ISO 22301 LI · Build recall with a focused review session.
34 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Business continuity
- The capability of an organization to continue delivery of products or services at acceptable predefined capacities during a disruption.
- BCMS
- A management system that establishes policy, objectives and processes to protect prioritized activities, and to prepare for, respond to and recover from disruptions.
- Disruption
- An anticipated or unanticipated event that causes an unplanned negative deviation from expected delivery of products or services at acceptable predefined capacity.
- MTPD
- Maximum Tolerable Period of Disruption: the time within which a product, service or activity must be resumed to avoid unacceptable impacts.
- RTO
- Recovery Time Objective: the target time to restore a product, service or resource after a disruption; it must not exceed the MTPD.
- RPO
- Recovery Point Objective: the maximum acceptable amount of data loss measured in time, defining the required backup frequency.
- MBCO
- Minimum Business Continuity Objective: the minimum level of products or services acceptable to the organization during a disruption.
- BIA
- Business impact analysis: a process that identifies prioritized activities and quantifies the impact over time of their disruption, including dependencies and resources.
- Risk assessment
- A process to identify threats and vulnerabilities, analyze likelihood and impact, and evaluate risk against criteria to determine treatment.
- BCMS scope
- The documented boundaries of the BCMS: products, services, locations, activities and organizational units covered, with justified exclusions.
- Gap analysis
- A comparison of current organizational practices against ISO 22301 requirements, used to plan and prioritize implementation activities.
- BC policy
- A top-management statement of commitment to business continuity, defining principles, objectives and responsibilities for the BCMS.
- Interested parties
- Persons or organizations that can affect, be affected by, or perceive themselves affected by a decision or activity, whose requirements inform the BCMS.
- Steering committee
- A governance group with authority to allocate resources and oversee BCMS implementation, including progress, risks and decisions.
- Context of the organization
- Internal and external issues, interested parties and their requirements that are relevant to the BCMS purpose and scope.
- BC objectives
- Measurable targets for continuity capability, set consistent with policy, monitored, communicated and updated, with plans to achieve them.
- BC strategy
- The selected approach to protect prioritized activities before, during and after disruption, considering cost, risk and resource requirements.
- BC plan
- Documented procedures for responding to disruption, including activation criteria, roles, resources, communication and interdependencies.
- Exercise programme
- A planned schedule of exercises and tests with defined scope, objectives and review, used to validate plans and build competence.
- Documented information
- Information required to be controlled and maintained, and the medium on which it is contained, including records as evidence.
- Activation criteria
- Predefined conditions or thresholds that trigger invocation of the business continuity plan and incident response structure.
- Incident response structure
- The defined roles and reporting lines, such as crisis team and incident manager, used to manage a disruption.
- Tabletop exercise
- A discussion-based exercise in which participants walk through a scenario to test plans, roles and decision-making without operational deployment.
- Competence
- The ability to apply knowledge and skills to achieve intended results, evidenced by education, training or experience records.
- Crisis communication
- Planned internal and external communication, including media and stakeholder messaging, during and after a disruptive incident.
- Internal audit
- A systematic, independent and documented process for obtaining evidence and evaluating the BCMS against defined criteria.
- Management review
- A top-management evaluation of the BCMS at planned intervals, using defined inputs, to decide on changes, resources and improvements.
- Monitoring and measurement
- Determining what is measured, the methods, timing, responsibility and analysis used to evaluate BCMS performance and effectiveness.
- Nonconformity
- A failure to meet a requirement; it requires reaction, root cause analysis, corrective action and verification of effectiveness.
- Corrective action
- Action taken to eliminate the cause of a nonconformity so it does not recur, with review of the action's effectiveness.
- Continual improvement
- An ongoing process to enhance the suitability, adequacy and effectiveness of the BCMS, driven by evaluation, review and lessons learned.
- Stage 1 audit
- A certification audit phase that reviews documented information, scope and readiness to determine if Stage 2 can proceed.
- Stage 2 audit
- A certification audit phase that evaluates implementation and effectiveness of the BCMS against ISO 22301 requirements.
- Surveillance audit
- A periodic audit after certification, typically annual, to confirm the BCMS continues to conform and improve.