The International Organization for Standardization has published an ongoing series of standards for business continuity...
and resilience. The most recent addition to the ISO 223xx series is ISO 22316:2017, Security and resilience -- Organizational resilience -- Principles and attributes.
ISO approved and released the new standard in 2017. ISO 22316 provides guidance to enhance organizational resilience for any size or type of public or private organization. While it is not specific to any industry or vertical market, it can be applied throughout the lifecycle of an organization. Resilience is defined in ISO 22316 as "the ability of an organization to absorb and adapt in a changing environment."
The Business Continuity Institute's Statement on Organizational Resilience describes resilience as "a quality within organizations [that] allows them to manage crises and disruption to operations, resist sudden shocks and adapt to changes." Other definitions include having resources to effectively recover and restore operations, a plan for responding to an unplanned event and employees who are trained and ready to respond to an event.
Resilience is often juxtaposed with business continuity, and there has been considerable debate in recent years whether BC results in resilience or vice versa. The traditional view is that each addresses the organization's ability to recover and restore operations following a disruptive event. Some feel BC is the process and resilience is the end state.
ISO 22316 helps clarify the nature and scope of resilience, itself a somewhat difficult condition to evaluate. The standard identifies key components so that an organization can assess its resilience; define, implement and measure improvements; and identify and recommend good practices for ensuring resilience based on existing standards and disciplines. This is where an organization may make reference to ISO 22301:2012 (Societal security -- Business continuity management systems -- Requirements) and ISO 22313:2012 (Societal security -- Business continuity management systems -- Guidance).
Additional reference standards to complement ISO 22316 can include ISO 27001 (information security) and ISO 31000 (risk management). In addition, one relevant non-ISO standard is ASIS SPC.1-2009, Organizational Resilience: Security, Preparedness and Continuity Management Systems -- Requirements with Guidance for Use.
Dig Deeper on Disaster recovery planning - management
Related Q&A from Paul Kirvan
Thinking of activating disaster recovery as a service? As you start this important process, consider these best practices that will help protect your... Continue Reading
As the remote workforce increases, network managers and users might opt to set up two concurrent VPN connections from the same remote device. But ... Continue Reading
It's time to review your strategy for ransomware backup and recovery. While there are standard ways to protect your organization, newer technologies ... Continue Reading