PECB ISO 22301 Foundation flashcards
PECB ISO 22301 Foundation · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Business continuity
- The capability of an organization to continue delivering products or services at acceptable predefined levels following a disruptive incident, supported by a management system of policies, processes and resources.
- BCMS
- A business continuity management system: the set of interrelated policies, objectives, processes, roles and documented information an organization uses to establish, implement, operate, monitor and improve business continuity.
- Disruptive incident
- An event, whether anticipated or unanticipated, that causes an unplanned negative deviation from expected delivery of products or services and requires the organization to respond using its continuity capabilities.
- Crisis
- An unstable condition with broad, potentially strategic consequences that requires urgent, coordinated action and often exceeds the normal decision-making capacity of routine operational management.
- PDCA cycle
- Plan-Do-Check-Act: the continual improvement model underlying ISO 22301, where continuity is established, implemented and operated, monitored and reviewed, then maintained and improved.
- Business impact analysis
- A process that identifies activities supporting products and services and assesses the consequences over time of their disruption, yielding prioritized activities, impact tolerances and recovery priorities.
- Recovery time objective
- The target time set for resuming an activity or restoring a resource after a disruption; it must be shorter than the maximum acceptable outage to remain viable.
- Maximum acceptable outage
- The maximum time an activity can be unavailable before its impacts become unacceptable to the organization, customers or interested parties; also called maximum tolerable period of disruption.
- Risk assessment in BC
- A process estimating the likelihood and consequences of threats exploiting vulnerabilities of prioritized activities and their dependencies, used to select risk treatment and continuity strategies.
- Continuity strategy
- A selected approach or set of solutions, such as resource redundancy, alternate sites or manual workarounds, chosen to protect prioritized activities and meet their recovery objectives.
- Prioritized activity
- An activity identified through business impact analysis as time-critical because its disruption would cause unacceptable impact, and therefore requiring prioritized recovery and continuity arrangements.
- ISO 22313
- A guidance standard providing non-certifiable advice on implementing a business continuity management system; it complements but does not replace the certifiable requirements of ISO 22301.
- Interested party
- A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity, such as customers, regulators, suppliers or employees.
- Harmonized Structure
- The common clause framework used by ISO management system standards: Clauses 4 to 10 cover context, leadership, planning, support, operation, performance evaluation and improvement.
- BCMS scope
- The documented boundaries and applicability of the business continuity management system, reflecting external and internal issues and interested party requirements, within which all requirements apply.
- Top management leadership
- Demonstration by senior management that continuity is integrated into business processes through policy, objectives, resources, communication and assignment of responsibilities and authorities.
- BC policy
- A documented statement established by top management that provides the framework for setting continuity objectives and commits the organization to satisfying applicable requirements and continual improvement.
- BC objectives
- Measurable goals set at relevant functions and levels, consistent with the continuity policy, that are monitored, communicated, updated and supported by plans of what will be done and by whom.
- Competence requirement
- Clause 7 requires determining necessary competence for persons doing continuity work, ensuring they are competent through education, training or experience, and retaining documented evidence.
- Awareness requirement
- Persons doing work under the organization's control must be aware of the continuity policy, their contribution to BCMS effectiveness, and the implications of not conforming to requirements.
- Documented information
- Information required to be controlled and maintained, including its creation, update, identification, format, review, approval, distribution, storage, protection, retention and disposition.
- Clause 8.2 sequence
- Business impact analysis and risk assessment must be systematic and updated at planned intervals or on significant change, with results retained as documented information.
- Continuity plans and procedures
- Documented arrangements covering roles, responsibilities, escalation, communication and recovery steps for prioritized activities, reviewed and exercised at planned intervals.
- Exercise programme
- A planned schedule of exercises and tests that validates continuity strategies, plans and procedures, builds competence, and produces results retained as documented information.
- Evaluation of BC documentation
- Clause 8.6 requires evaluating the adequacy and effectiveness of continuity plans and capabilities after exercises, changes or incidents, and acting on the findings.
- Internal audit
- A planned, interval-based, independent review of BCMS conformity to the organization's own requirements and to ISO 22301, with results reported to management and retained.
- Management review
- A top-management evaluation of BCMS suitability, adequacy and effectiveness, considering audit results, exercise outcomes, risks and nonconformities, and deciding on improvement and resources.
- Nonconformity
- Failure to meet a requirement; the organization must react, evaluate causes, implement corrective action, review effectiveness and retain documented information of the actions.
- Corrective action
- Action taken to eliminate the cause of a nonconformity and prevent recurrence, including updating risks and opportunities where the continuity management system is affected.
- Continual improvement
- Clause 10 requires the organization to continually improve the suitability, adequacy and effectiveness of the BCMS, using audit, review and nonconformity outputs as inputs.
- Significant change trigger
- A change in the organization, its context, dependencies or interested party requirements that requires review and update of the business impact analysis, risk assessment and continuity arrangements.
- Supply chain continuity
- Consideration of external providers and partners as dependencies of prioritized activities, including their recovery capabilities, contractual requirements and alternative sourcing arrangements.