ISO 22301 LI key terms

A documented set of interrelated policies, processes, roles and resources an organization uses to prepare for, respond to and recover from disruptive incidents, managed as a whole so it can be continually monitored and improved.

An event, whether anticipated or unanticipated, that interrupts or degrades an organization's normal delivery of products or services, potentially causing harm to people, assets, reputation or obligations.

A structured process that identifies priority activities and assesses the consequences over time of failing to deliver them, establishing recovery priorities and the time frames within which recovery must occur.

The longest time an organization can tolerate a disruption to a priority activity before the consequences become unacceptable, used as the reference point for setting recovery objectives.

The target period within which a priority activity, or the resources supporting it, must be restored after a disruption so that the maximum tolerable period of disruption is not exceeded.

The maximum acceptable amount of data, measured as time, that may be lost due to a disruption, indicating how far back an organization must be able to restore information when resuming an activity.

A process of identifying, analysing and evaluating risks to priority activities and their supporting resources, producing information used to select appropriate business continuity strategies and treatments.

The selection and application of options to modify risk, such as avoiding, reducing, transferring or accepting it, documented in a plan with owners and target dates.

An agreed approach describing how the organization will protect and restore priority activities and resources, chosen after assessing options against the recovery objectives and the organization's risk appetite.

A situation that could be, is, or has been a disruption, and which therefore requires a coordinated response using predefined roles, procedures and communication channels.

The defined roles, responsibilities, authority levels and communication paths activated when an incident occurs, enabling timely decisions, escalation and coordination with interested parties.

Documented procedures and information that guide teams through responding to a disruption and restoring priority activities within agreed time frames, including roles, contacts and resource requirements.

A planned schedule of activities, ranging from discussions to full simulations, that tests and validates business continuity arrangements, builds competence and reveals gaps requiring corrective action.

The documented boundaries of the management system, stating which activities, locations, products, services and organizational units are included and, where relevant, which are excluded and why.

The external and internal factors, including legal, regulatory, market, cultural and capability issues, that affect the organization's ability to achieve the intended outcomes of its BCMS.

A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity, whose relevant needs and expectations inform the BCMS requirements.

A top management statement of intent and direction for business continuity, providing a framework for setting objectives and committing the organization to satisfy applicable requirements and improve the BCMS.

Visible leadership and accountability from the most senior levels, demonstrated through providing resources, assigning roles, reviewing performance and integrating business continuity into the organization's processes.

A measurable result to be achieved in relation to business continuity, consistent with the policy, monitored over time and supported by plans defining what will be done, by whom and by when.

The combination of education, training, experience and skills needed by people performing business continuity work, determined for each role and addressed through provision or other actions, with records retained.

The state in which personnel understand the business continuity policy, their contribution to the effectiveness of the BCMS, and the implications of not conforming with its requirements.

Information required to be controlled and maintained by the organization, together with the medium on which it is held, covering both the documents needed to operate the BCMS and evidence of results achieved.

The systematic measurement, monitoring, analysis and evaluation of business continuity performance and the effectiveness of the management system, feeding results into review and improvement.

An independent, planned and documented examination of the BCMS against the organization's own criteria and applicable requirements, used to determine whether the system conforms and is effectively implemented.

A periodic top-management evaluation of the BCMS using defined inputs such as audit results, performance data and risk changes, producing decisions and actions on improvement, resources and system changes.

A failure to meet a requirement, whether of the standard or of the organization's own BCMS arrangements, identified through audits, exercises, monitoring or incidents and requiring documented handling.

Action taken to eliminate the cause of a nonconformity so that it does not recur, including assessing the need to act, implementing the action and reviewing its effectiveness.

The ongoing, recurring activity of enhancing the suitability, adequacy and effectiveness of the BCMS, driven by performance results, lessons learned and changing context rather than one-off fixes.

An independent third-party assessment, usually in stages, that evaluates whether the organization's BCMS conforms to the requirements of ISO 22301 and is effectively implemented and maintained.

The initial certification assessment that reviews documented information and readiness, checks the scope and understanding of requirements, and determines whether the organization is prepared for the main audit.

The main certification assessment, conducted on site, which gathers evidence of implementation and effectiveness of the BCMS, including processes, exercises, performance evaluation and management review.

A documented result of audit evaluation, recorded as a nonconformity, an observation or an opportunity for improvement, each requiring a defined response from the auditee.

A periodic third-party audit conducted after certification to confirm that the certified BCMS continues to conform and remain effective, and to check that corrective actions have been implemented.

A documented statement, used in some management system standards, listing applicable requirements and justifying inclusion or exclusion; for a BCMS its equivalent is the documented scope with justification for exclusions.

Arrangements ensuring that externally provided products, services and resources supporting priority activities remain available within recovery objectives, including monitoring suppliers and agreeing continuity expectations.