To support the implementation of the latest international requirements standard for business continuity management systems, this guide has been designed to make it easier for you to meet the requirements of the new BS ISO 22301 BS ISO 22301 specifies the requirements for setting up and managing an effective business continuity management system (BCMS) for any organization, regardless of type or size. BSI recommends that every business has a plan in place to avoid excessive downtime and reduced productivity in the event of an interruption Meeting the requirements of the new international standard has never been easier. This presentation helps and supports organizations to implement BS ISO 22301, which will supersede BS 25999-2. It consists of an extract from John Sharp’s latest book ‘The Route Map to Business Continuity Management’ which provides practical guidance on how to meet the requirements of BS ISO 22301 and is available for purchase through the BSI shop This transition guide will help you understand your organization’s needs and obligations and how to implement an effective BCMS. Whether you are planning to certify against the new standard or simply want to benefit from BCM best practice, this guide will help you put in place the necessary requirements

1. Business Development
BSI CIS ACP
Moving from BS 25999-2 to ISO 22301
The new international standard for business continuity
management systems

2. 2
That’s why organizations need strong
business continuity planning
To support the implementation of the latest international requirements standard for business
continuity management systems, this guide has been designed to make it easier for you to
meet the requirements of the new BS ISO 22301
BS ISO 22301 specifies the requirements for setting up and managing an effective business
continuity management system (BCMS) for any organization, regardless of type or size. BSI
recommends that every business has a plan in place to avoid excessive downtime and
reduced productivity in the event of an interruption
Meeting the requirements of the new international standard has never been easier. This
presentation helps and supports organizations to implement BS ISO 22301, which will
supersede BS 25999-2. It consists of an extract from John Sharp’s latest book ‘The Route
Map to Business Continuity Management’ which provides practical guidance on how to meet
the requirements of BS ISO 22301 and is available for purchase through the BSI shop
This transition guide will help you understand your organization’s needs and obligations and
how to implement an effective BCMS. Whether you are planning to certify against the new
standard or simply want to benefit from BCM best practice, this guide will help you put in
place the necessary requirements

3. 3
Why adopt a business continuity
standard?
As business continuity management (BCM) has developed worldwide, there has
been a convergence in the methodologies being promoted. It became apparent
following the Year 2000 problem or ‘millennium bug’, when organizations were
deluged with requests for compliance statements from their customers and clients,
that there was a need for a uniform approach to BCM
It is undesirable for major customers to enforce their own approach to BCM down
their supply chains, as happened with other management systems, notably quality.
While a supplier can run different quality systems to meet the requirements of its
customer base, it cannot run different, and possibly conflicting, BCM systems,
which will be used during a disruption at a time when tensions are high. This was
one of the principal drivers for establishing BCM standards In the UK

4. 4
Why adopt a business continuity
standard?
BS 25999 was created to set out a uniform benchmark in good practice, satisfying
the needs of customers, clients, government, regulators and all other interested
parties. BS 25999 has been accepted worldwide and has formed the basis of many
other BCM standards, including the US ASIS/BSI BCM.01 standard adopted by
ANSI. BS 25999 and other BCM standards from across the globe provided the
source material for the creation of two new international standards: ISO 22301
(requirements) and ISO 22313 (guidance)
By adopting a standard approach to BCM as set out in ISO 22301, organizations
can offer their customers and clients greater assurance that they will be capable of
maintaining continuity of operations if they suffer disruptive incidents
For those already certified to BS 25999-2 there will be a transition period to allow
them to update their BCM systems to ISO 22301. For those certified, and those
organizations working towards certification, the additional requirements are not
onerous

5. 5
Implementing ISO 22301
The international standard for BCM, ISO 22301:2012
specifies requirements for setting up and managing an
effective business continuity management system (BCMS). It
is for use by internal and external parties, including
certification bodies, to assess the organization’s ability to
meet regulatory and customer requirements as well as the
organization’s own requirements. ISO 22301 contains only
those requirements that can be objectively audited and a
demonstration of successful implementation can therefore be
used by an organization to assure interested parties that an
appropriate BCMS is in place.
During the latter part of 2012 or early in 2013, ISO will issue a
guidance document ISO 22313. This document will take the
form of good practice guidance and
recommendations, indicating what practices an organization
should, or may, undertake to implement effective BCM.
Organizations may choose to follow all or part of the
guidance, which may be used for self-assessment or between
organizations. The guidance is not a specification for BCM.

6. 6
Comparing ISO 22301:2012
with BS 25999-2:2007
When news of an ISO standard for BCM emerged, business continuity managers
expressed concern that they might have to radically rework their BCM procedures and
processes once ISO 22301 was introduced. BS 25999-2 had been, and continues to be,
used by many organizations across the world as the basis of their BCM procedures and
processes. The good news is that BS 25999-2 has provided the main foundation of the
new ISO standard. There are some important additions and a few elements that have
been omitted. The additions have added greater depth and clarity while the omissions do
not detract from the overall good BCM practices and principles.
The new standard is entitled ‘Societal security – Business continuity management
systems – Requirements.’ This is one of a suite of standards being developed by ISO/TC
223 designed to achieve greater societal security. Societal security can be defined as
providing protection of society from, and the ability to respond to, incidents, emergencies
and disasters caused by intentional and unintentional human acts, natural hazards, and
technical failures.

7. 7
Comparing ISO 22301:2012 with
BS 25999-2:2007
The way in which ISO 22301 can be used is detailed in Clause 1 Scope. It
states that the standard is applicable to all types and sizes of organizations
that wish to
• establish, implement, maintain and improve a BCMS
• ensure conformity with stated business continuity policy
• demonstrate conformity to others
• seek certification/registration of its BCMS by an accredited third party
certification body
• make a self-determination and self-declaration of conformity with this
International Standard [ISO 22301:2012].
The standard can also be used by an organization to assess its suppliers’
ability to meet continuity needs and obligations.

8. 8
New concepts and activities …
New Concept Explanation
Context of the organization The environment in which the organization operates
Interested parties Replaces «stakeholders»
Leadership Requirements specific to top management
Maximum acceptable outage (MAO) «time it would take for adverse impacts, which might arise as a result of
not providing a product/service or performing an activity, to become
unacceptable»
This is the same as «maximum tolerable period of disruption (MTPD)»
Minimum business continuity «minimum level of services and/or products that is acceptable to the
objective (MBCO) organization to achieve its business objectives during a disruption»
Performance evaluation Covers the measurement of BCMS and BCM effectiveness
Prioritized timeframes Order and timing of recovery for critical activities
Warning and communication Activities undertaken during an incident
There have been many other additions and some slight alterations to the terms and
definitions listed in the standard. The additions and changes reflect terms and definitions
commonly used by BCM practitioners today

9. 9
The major additions to ISO 22301:2012

10. 10

11. 11
Sergey Romanovsky
Certification & Partner Programme Director, CIS
Lead Auditor | ACP Manager
British Standards Institution
24/2 Radio Str. 105005 Moscow Russia
T: +7 495 9816507
F: +7 495 9816508
E: sergey.romanovsky@bsigroup.com
W: www.bsigroup.com | www.bsi-russia.ru