Rethinking Business Continuity: Applying ISO 22301 to improve resiliency, manage risk, and drive profitability in your organization

Rethinking Business Continuity:
Applying ISO 22301 to improve resiliency, manage risk, and drive profitability in your organization
Bryan Strawser, MBCP, MBCI, CEM, CPP, CISSP, PMP
Principal Consultant & CEO, Bryghtpath LLC

2
Bryghtpath LLC
We are a strategic advisory firm that specializes in global risk, business continuity,
emergency management, crisis communications, and public affairs

3
Bryan Strawser
CEO, Bryghtpath LLC
• ISO 22301 Lead Implementer / Instructor
• Master Business Continuity Professional (MBCP)
• Member, Business Continuity Institute

• Formerly BS25999
• Adopted globally in 2012
• Intersects with other ISO
Standards
– Ex: ISO 27001
• Establish and maintain a
Business Continuity
Management System
• Accreditation
• Certification
– Implementer / Lead
– Auditor / Lead
4
ISO 22301:2012
Societal Security – Business Continuity Management Systems
Copyright © 2015 by Bryghtpath LLC | bryghtpath.com | +1-612-235-6435 | bryan@bryghtpath.com

• Scope
• Terms and definition
• Organizational Context
• Leadership
• Planning
• Support
• Operation
• Performance Evaluation
• Improvement
5
ISO 22301 Content
Structure and Content of ISO 22301

“Setting up and managing an effective Business Continuity
Management System (BCMS)”
A BCMS emphasizes the importance of:
• The necessity for establishing a BCM policy & objectives
• Implementing and operating controls and measures for managing
an organization’s overall capability to manage disruptive incidents
• Monitoring & reviewing the peformanceand effectiveness of the
BCMS
• Continual improvement based on objective measurement
6
ISO 22301: 0.1
What is a BCMS?

a) A policy
b) People with defined responsibilities
c) Management processes relating to
1. Policy
2. Planning
3. Implementation & operation
4. Performance assessment
5. Management review
6. Improvement
d) Documentation providing auditable evidence
e) Any business continuity management processes
relevant to the organization
7
ISO 22301: 0.1
A BCMS has several key components

8
ISO 22301: 0.2
The Plan-Do-Check-Act (PDCA) Model

“… specifies requirements to plan, establish,
implement, operate, monitor, review, maintain, and
continually improve a documented management
system to protect against, reduce the likelihood of
occurrence, prepare for, respond to, and recover from
disruptive incidents when they arise...
9
ISO 22301: Clause 1
Scope of ISO 22301

This International Standard is applicable to all types and sizes of
organizations that wish to:
a) Establish, implement, and improve a BCMS
b) Ensure conformity with stated business continuity policy
c) Demonstrate conformity to others
d) Seek certification / registration of its BCMS by an accredited third
party certification body
e) Make a self-determination and self-declaration of conformity
with this International Standard
10
ISO 22301: Clause 1
Applicability

Business Continuity
Capability of the organization to continue delivery of products or services at acceptable predefined levels following a disruptive incident
Business Continuity Plan
Documented procedures that guide organizations to respond, recover, resume, and restore to a pre-defined level of operation following a disruption
Business Impact Analysis
Process of analyzing activities and the effect that a business disruption might have upon them
11
ISO 22301: Clause 3
Key Definitions

Exercise
Process to train for, assess, practice, and
improve performance in an organization
Incident
Situation that might be, or could lead to,
a disruption, loss, emergency, or crisis
12
ISO 22301: Clause 3
Key Definitions

The organization shall identify and document:
• The organization’s activities, functions, services, products,
partnerships, supply chains, relationships with interested
parties, and the potential impact related to a disruptive
incident
• Links between the business continuity policy and the
organization's objectives and other policies, including its
overall risk management strategy
• The organization’s risk appetite
13
ISO 22301: Clause 4
The Organization and its context

In establishing the context, the organization shall:
1) Articulate its objectives, including those concerned with
business continuity
2) Define the external and internal factors that create the
uncertainty that gives rise to risk
3) Set risk criteria taking into account the risk appetite
4) Define the purpose of the BCMS
14
ISO 22301: Clause 4
The Organization and its context

Primarily focuses on legal & regulatory requirements:
• Maintain procedures to review & understand regulatory
requirements
• Understand the interest of other relevant third parties
This is an area that is becoming more of a focus in recent years
15
ISO 22301: Clause 4
The Needs & Expectations of Interested Parties

5.1: Persons in top management and other relevant
management roles throughout the organization shall
demonstrate leadership with respect to the BCMS.
5.2: Top management shall demonstrate commitment with
respect to the BCMS by:
• Ensuring that policies and objectives are established…
• Ensuring the integration of the BCMS...
• Ensuring the resources needed [...] are available
• Ensuring the BCMS achieves its intended outcomes
16
ISO 22301: Clause 5
Leadership, Management, and Commitment

5.3: Policy
a) Is appropriate to the purpose of the organization
b) Provides a framework for setting business continuity objectives
c) Includes a commitment to satisfy applicable requirements
d) Includes a commitment to continual improvement of the BCMS
5.4: Organizational roles, responsibilities, and authorities
Top management shall ensure that the responsibilities and authorities
for relevant roles are assigned and communicated within the
organization
17
ISO 22301: Clause 5
Policy & Roles, Responsibilities, and Authorities

6.1: Actions to address risks and opportunities
• Organization shall determine the risks and opportunities to
– Ensure the BCMS can achieve its intended outcomes(s)
– Prevent or reduce undesired effects
– Achieve continual improvement
6.2: Business continuity objectives and plans to meet them
• Top management shall ensure that objectives are established and
communicated for relevant functions and levels
– Must take account of the minimum level of products and services that are
acceptable to the organization to achieve its objectives
– Must be measurable
– Must take into account applicable requirement
– Must be monitored and updated as appropriate
18
ISO 22301: Clause 6
Planning

Again:
• Who will be responsible
• What will be done
• What resources will be required
• When it will be completed
• How the results will be evaluated
19
ISO 22301: Clause 6
Planning

Clause 7 contains a number of statements related to providing
support through resources, competence, and awareness.
• Providing the resources needed for the establishment,
implementation, maintenance, and continual improvement of the
BCMS
• Ensuring the competence of each person involved in doing BCMS
work (training, mentoring, or outsourcing)
• Awareness of the BCMS at all levels of the organization
• Internal and external communications
20
ISO 22301: Clause 7
Support

7.5: Documented Information
• The organization’s BCMS shall include:
– Documented information required by this International Standard
– Documented information determined by the organization as being
necessary for the effectiveness of the BCMS
• Information shall be controlled to ensure:
– It is available and suitable for use, where and when it is needed
– It is adequately protected (e.g. from loss of confidentiality, improper
use, or loss of integrity)
21
ISO 22301: Clause 7
Documentation

8.2: Business Impact Analysis (BIA) and Risk Assessment
• 8.2.2 Business Impact Analysis
– Identifying activities that support the provision of products and services
– Assessing the impacts over time of not performing these activities
– Setting prioritized timeframes for resuming these activities
– Identifying dependencies and supporting resources
• 8.2.3 Risk Assessment
– Identify risks of disruption to the organization’s prioritized activities
– Systematically analyze risk
– Evaluate which disruption related risks requirement treatment
– Identify treatments commensurate with business continuity objectives
and in accordance with the organization’s risk appetite
22
ISO 22301: Clause 8
Operations

8.3: Business Continuity Strategy
• The organization shall determine an appropriate business continuity
strategy for
– Protecting prioritized activities
– Recovering prioritized activities
– Mitigating, responding to, and managing impacts
• The organization shall determine the resource requirements to
implement the selected strategies (people, information, data, facilities,
technology, finance, partners, third parties)
• For identified risks requiring treatment, the organization shall consider
proactive measures
23
ISO 22301: Clause 8
Business Continuity Strategy

8.4: Establish and implement business continuity procedures
Procedures to manage a disruptive incident and continue its activities
based on recovery objectives as identified in the business impact analysis
• Incident response structure
• Warning & communicating
• Business continuity plans
– Documented procedures for responding to a disruptive incident
– How prioritized activities will be recovered within a predetermined timeframe
• Recovery
– Documented procedures to restore and return business activities from the temporary
measures adopted to support normal business requirements after an incident
24
ISO 22301: Clause 8
Business Continuity Procedures

Crisis Management Framework
25
Situational Awareness
Executive Crisis Team
(C-Suite & CEO Directs)
Cross-Functional Crisis Team
(Business lines & support teams)
Crisis Management Team
Strategic Decision Making
Day to day operations
Recommendations to Executives
Horizontal Communication
Subject matter experts
Situational awareness upstream
Full-time / volunteer

Crisis Management Framework
26
Routine Incident
HOLY S$@!
What just happened?!
Protocols & Processes
Incident Specific Plans
Preparedness Steps
Collaborative cross-
functional discussion
Strategic view
Framework for
collaborative decision
making & communication

Crisis Leadership
27
• What’s happening?
• What do we know about it?
• What impact is it having on our business?
• What don’t we know what we need to know?

• All plans should be exercised
at least annually:
– Notification
– Table Top
– Recovery
– Fully integrated
• Disaster Recovery
– Testing DR plans and strategies
• Defined process for capturing
lessons learned and applying
to plans and strategies
28
ISO 22301 – Clause 8: Exercise, Testing, & Maturing
How will I exercise and test my plans? Based on those results, how will I improve?

• Clause 9 covers the need for the organization to have a performance
evaluation (or metrics) strategy
– What is monitored?
– How will it be monitored?
– How / when will it be analyzed and evaluated?
• Regular evaluation of procedures and capabilities
• Periodic reviews
• Compliance evaluation to policy, standards, and industry best practices
• Evaluations shall be conducted at planned intervals and when significant
changes in the organization occur
29
ISO 22301: Clause 9
Performance Evaluation

• 9.2: Internal Audit
– The organization shall have an audit program
– Internal Audits shall be conducted at planned intervals to ensure that the BCMS
conforms to the requirements of this standard – and to the organization’s requirements
for BCMS
• 9.3: Management Review
– Top management shall review the organization’s BCMS at planned intervals to ensure
its continuing suitability, adequacy, and effectiveness
– Typically, the BCMS is briefed at lease once annually to the Board of Directors or the
Board’s Audit Committee.
30
ISO 22301: Clause 9
Internal Audits & Management Review

• 10.1: Non-Conformity
– Identify and react
– Evaluate the need for action
– Implement actions
– Make changes to the BCMS if needed
• 10.2: Continual Improvement
– The organization shall continually improve the suitability, adequacy, or effectiveness of
the BCMS
31
ISO 22301: Clause 10
Improvement

32
Case Study: Hurricane Sandy (2012)

Hurricane Sandy Timeline
34
October – November 2012
October 24th
• First
warnings
are issued
October 29th
• Storm
makes
landfall in
New Jersey
October 30th
• Storm
fades away

Crisis Management as a Competitive Advantage
37
Source: 2012 Hurricane Sandy RILA Survey
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
10/29 10/30 10/31 11/1 11/2 11/3
Target (195) Sears/K-Mart (236) Macy's (200) Walmart (294) Best Buy (125)

Reputation Impact of a Crisis
38
Hurricane Sandy - 2012
International Business Times –11/3

Global Standards
Business Continuity
• ISO 22301 (formerly BS25999)
• NFPA 1600
• ASIS Business Continuity Management Standard
• ASIS SPC.1: Organizational Resilience
US Government
• Federal Continuity Directives (FCD 1 / FCD 2)
• Continuity Guidance Circulators (CGC 1 / CGC 2)
39
Business Continuity and Emergency Management

Professional Certifications
Business Continuity
• Disaster Recovery Institute International
– Associate Business Continuity Professional (ABCP)
– Certified Business Continuity Professional (CBCP)
– Master Business Continuity Professional (MBCP)
• Business Continuity Institute
– Member, Business Continuity Institute (MBCI)
– Fellow, Business Continuity Institute (FBCI)
• Business Continuity Management Institute (Singapore)
– Multiple certifications
Emergency Management
• International Association of Emergency Managers
– Associate Emergency Manager (AEM)
– Certified Emergency Manager (CEM)
40
Business Continuity and Emergency Management

Contact Information
Contact Bryan:
Bryan Strawser
Principal Consultant & CEO
Phone: +1-612-235-6435
E-Mail: bryan@bryghtpath.com
Twitter: @bryanstrawser
Learn more about Bryghtpath LLC
Website: www.bryghtpath.com
Twitter: @bryghtpath
Facebook: /bryghtpathllc
41
Bryghtpath LLC
Our Consulting Services Include:
Business Continuity
Crisis / Emergency Management
Enterprise Risk Management
Exercise Design & Facilitation
Global Intelligence & Security
ISO Training & Certification
Project & Program Management
Travel Risk & Security

Rethinking Business Continuity: Applying ISO 22301 to improve resiliency, manage risk, and drive profitability in your organization

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (13)

Similar to Rethinking Business Continuity: Applying ISO 22301 to improve resiliency, manage risk, and drive profitability in your organization

Similar to Rethinking Business Continuity: Applying ISO 22301 to improve resiliency, manage risk, and drive profitability in your organization (20)

More from Bryghtpath LLC

More from Bryghtpath LLC (7)

Recently uploaded

Recently uploaded (18)

Rethinking Business Continuity: Applying ISO 22301 to improve resiliency, manage risk, and drive profitability in your organization