ISO 22301:2019, business continuity

Plan, implement and control the processes needed to meet BCMS requirements and to carry out the actions determined under risks and opportunities, by establishing process criteria, controlling the processes against those criteria and keeping enough documented information to be confident the processes ran as planned; control planned changes and review the consequences of unintended ones, taking mitigating action, and ensure outsourced processes and the supply chain are controlled.

Use the impact analysis process to set continuity priorities and requirements: define the impact types and criteria relevant to the organization's context, identify the activities supporting delivery of products and services, assess impacts over time from disrupting those activities, fix the point at which non resumption becomes unacceptable, set prioritized time frames within that point for resuming activities at a specified minimum acceptable capacity, identify the prioritized activities, and determine the resources, dependencies and interdependencies they rely on including partners and suppliers.

Identify candidate strategies and solutions by the extent to which they meet the requirement to continue and recover prioritized activities within the identified time frames and agreed capacity, protect those activities, reduce the likelihood of disruption, shorten its duration, limit its impact on products and services, and provide for adequate resources.

Document and maintain business continuity plans that guide teams through response and recovery, collectively containing the actions to continue or recover prioritized activities within predetermined time frames, the means of monitoring the disruption and the response, the pre defined thresholds and process for activating the response, procedures to deliver products and services at agreed capacity, and how the immediate consequences are managed with regard to individual welfare, prevention of further loss and environmental impact; each plan must state purpose, scope and objectives, the roles and responsibilities of the implementing team, the actions implementing the solutions, the supporting information needed to activate, operate, coordinate and communicate including activation criteria, internal and external interdependencies, resource requirements, reporting requirements and a stand down process, and must be usable and available at the time and place it is needed.

Maintain documented processes to restore and return business activities from the temporary measures adopted during and after a disruption.