Get started Bring yourself up to speed with our introductory content.

How does the ISO 22316 standard cover resilience?

Definitions for business continuity and resilience sometimes clash, but both processes help an organization stay on its feet. A new ISO standard tackles the latter.

The International Organization for Standardization has published an ongoing series of standards for business continuity...

and resilience. The most recent addition to the ISO 223xx series is ISO 22316:2017, Security and resilience -- Organizational resilience -- Principles and attributes.

ISO approved and released the new standard in 2017. ISO 22316 provides guidance to enhance organizational resilience for any size or type of public or private organization. While it is not specific to any industry or vertical market, it can be applied throughout the lifecycle of an organization. Resilience is defined in ISO 22316 as "the ability of an organization to absorb and adapt in a changing environment."

The Business Continuity Institute's Statement on Organizational Resilience describes resilience as "a quality within organizations [that] allows them to manage crises and disruption to operations, resist sudden shocks and adapt to changes." Other definitions include having resources to effectively recover and restore operations, a plan for responding to an unplanned event and employees who are trained and ready to respond to an event.

Resilience is often juxtaposed with business continuity, and there has been considerable debate in recent years whether BC results in resilience or vice versa. The traditional view is that each addresses the organization's ability to recover and restore operations following a disruptive event. Some feel BC is the process and resilience is the end state.

Resilience and business continuity
One approach to the relationship between BC and resilience.

ISO 22316 helps clarify the nature and scope of resilience, itself a somewhat difficult condition to evaluate. The standard identifies key components so that an organization can assess its resilience; define, implement and measure improvements; and identify and recommend good practices for ensuring resilience based on existing standards and disciplines. This is where an organization may make reference to ISO 22301:2012 (Societal security -- Business continuity management systems -- Requirements) and ISO 22313:2012 (Societal security -- Business continuity management systems -- Guidance).

Additional reference standards to complement ISO 22316 can include ISO 27001 (information security) and ISO 31000 (risk management). In addition, one relevant non-ISO standard is ASIS SPC.1-2009, Organizational Resilience: Security, Preparedness and Continuity Management Systems -- Requirements with Guidance for Use.

Dig Deeper on Disaster recovery planning - management

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

How do you incorporate ISO standards like 22316:2017 into your business continuity planning?