PECB ISO 22301 Foundation key terms

A documented management system that an organization establishes to protect against disruption and to keep critical activities running at acceptable levels during and after an incident.

The capability of an organization to continue delivering products and services at acceptable predefined levels after a disruptive incident, and to recover normal operations within agreed timeframes.

An event, whether anticipated or unanticipated, that causes unplanned interruption or degradation of services and requires the organization to respond to protect its critical activities.

An activity or process whose interruption would cause unacceptable harm to the organization, its stakeholders, or its ability to deliver products and services at agreed levels.

A structured process that identifies critical activities and quantifies the operational and financial consequences of their disruption over time, producing recovery priorities and time objectives.

A process that identifies threats and vulnerabilities relevant to business continuity, analyses their likelihood and impact, and evaluates which risks need treatment.

The selection and implementation of measures that modify identified risks, such as avoiding, reducing, transferring, or accepting them, with continuity options chosen accordingly.

A potential cause of an incident that could harm assets, people, or operations, such as fire, flood, cyberattack, supplier failure, or loss of key staff.

A weakness in controls, processes, facilities, or dependencies that increases the likelihood or severity of a threat affecting critical activities.

The longest period that a critical activity may be unavailable before its disruption causes unacceptable consequences, often used to set recovery time objectives.

The target time within which a product, service, or activity must be restored after disruption so that the maximum acceptable outage is not exceeded.

The maximum acceptable amount of data, measured in time, that may be lost due to an incident, defining how far back recovery must restore information.

The set of chosen options and resources, such as alternate sites, backup arrangements, or staff cross-training, that enable recovery of prioritized activities within agreed objectives.

Documented procedures that guide an organization's response to disruption, including activation criteria, roles, communications, and recovery steps for prioritized activities.

The defined roles, responsibilities, authority, and coordination arrangements that an organization uses to manage a disruptive incident from detection through recovery.

A sudden, unexpected event requiring immediate action to protect people, property, or the environment, typically handled by life-safety and emergency-response procedures.

A situation that threatens strategic objectives, reputation, or viability, requires executive-level decisions, and often extends beyond the scope of routine emergency response.

A planned schedule of tests, drills, and simulations used to validate continuity arrangements, develop competence, and identify improvements before a real disruption occurs.

The documented boundaries of the management system, stating which activities, locations, products, services, and organizational units are included and any exclusions with justification.

The external and internal factors, including legal, regulatory, market, and cultural conditions, that affect how an organization establishes and operates its BCMS.

A person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity related to business continuity, such as customers, regulators, or suppliers.

Top management's active commitment to the BCMS, demonstrated through policy-setting, resource provision, assignment of responsibilities, and integration with business processes.

A top-level statement of the organization's commitment to continuity, defining principles, objectives, and responsibility for the BCMS and providing a framework for setting objectives.

A measurable outcome the organization intends to achieve for continuity, consistent with the continuity policy and relevant to delivering products and services at acceptable levels.

Information that must be controlled and maintained by the organization, including the continuity policy, plans, risk assessments, and records, along with the media that carry it.

The combination of education, training, and experience that enables personnel performing continuity work to carry out their roles effectively and consistently.

The state in which personnel understand the continuity policy, their contribution to its effectiveness, and the implications of not conforming with BCMS requirements.

The planned internal and external exchange of continuity information, including with interested parties, media, and authorities, during normal operations and disruptions.

The systematic monitoring, measurement, analysis, and review of BCMS performance and effectiveness, including internal audit and management review activities.

An independent, systematic examination of the BCMS against planned arrangements and standard requirements, used to determine conformity and effectiveness.

A periodic top-management evaluation of the BCMS's suitability, adequacy, and effectiveness, considering performance information and deciding on improvement actions.

A failure to meet a requirement of the standard or of the organization's own BCMS arrangements, which must be corrected and investigated for its cause.

Action taken to eliminate the cause of a detected nonconformity so that it does not recur, including root-cause analysis and verification of effectiveness.

The ongoing process of enhancing BCMS performance and maturity through repeated evaluation, corrective action, and adaptation to changing risks and business conditions.

A stated need or expectation that the organization must fulfil, whether mandated by the standard, by law, or by its own internal continuity arrangements.

A cyclical improvement model in which continuity arrangements are planned, implemented, monitored, and adjusted, providing the structure used by ISO 22301.

The process of restoring critical activities, systems, and supporting resources to agreed operating levels after a disruption, guided by the continuity plan and recovery objectives.

Arrangements that protect the delivery of products and services when external suppliers or partners fail, including dependency analysis, contractual requirements, and alternate sourcing.