The International Organization for Standardization has published an ongoing series of standards for business continuity...
and resilience. The most recent addition to the ISO 223xx series is ISO 22316:2017, Security and resilience -- Organizational resilience -- Principles and attributes.
ISO approved and released the new standard in 2017. ISO 22316 provides guidance to enhance organizational resilience for any size or type of public or private organization. While it is not specific to any industry or vertical market, it can be applied throughout the lifecycle of an organization. Resilience is defined in ISO 22316 as "the ability of an organization to absorb and adapt in a changing environment."
The Business Continuity Institute's Statement on Organizational Resilience describes resilience as "a quality within organizations [that] allows them to manage crises and disruption to operations, resist sudden shocks and adapt to changes." Other definitions include having resources to effectively recover and restore operations, a plan for responding to an unplanned event and employees who are trained and ready to respond to an event.
Resilience is often juxtaposed with business continuity, and there has been considerable debate in recent years whether BC results in resilience or vice versa. The traditional view is that each addresses the organization's ability to recover and restore operations following a disruptive event. Some feel BC is the process and resilience is the end state.
ISO 22316 helps clarify the nature and scope of resilience, itself a somewhat difficult condition to evaluate. The standard identifies key components so that an organization can assess its resilience; define, implement and measure improvements; and identify and recommend good practices for ensuring resilience based on existing standards and disciplines. This is where an organization may make reference to ISO 22301:2012 (Societal security -- Business continuity management systems -- Requirements) and ISO 22313:2012 (Societal security -- Business continuity management systems -- Guidance).
Additional reference standards to complement ISO 22316 can include ISO 27001 (information security) and ISO 31000 (risk management). In addition, one relevant non-ISO standard is ASIS SPC.1-2009, Organizational Resilience: Security, Preparedness and Continuity Management Systems -- Requirements with Guidance for Use.
Dig Deeper on Disaster recovery planning - management
Related Q&A from Paul Kirvan
With ISO/TS 22330, the International Organization for Standardization covers the issues related to the people involved in BC/DR incident response. Continue Reading
Emergency response planning needs to be specific and varied enough that it will enable an organization to recover in the event of many different ... Continue Reading
From mainframes to the cloud, the business continuity profession has seen a lot over the decades. How did we get to the business continuity process ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.