What is it?
ISO 22301 represents the reference standard for the certification of business continuity management systems. It is relevant for all types of businesses, regardless of sector or size.
This rule defines the criteria for an effective Management System for Operational Continuity (Business Continuity).
It consists of a certifiable methodology that it incorporates a series of practices aimed at preserving operational continuity in adverse conditions, reducing the effect of potential incidents on customers, stakeholders and the entire corporate ecosystem.
ISO 22301 is an effective approach to maintaining security, ensuring high-level business management and ensuring compliance, protecting the company's image and reputation and building a relationship of trust with suppliers, stakeholders and customers.
Companies that are attentive to their efficiency adopt security risk management strategies through an Information Security Management System (ISMS).
An Information Security Management System includes a set of policies and procedures that encompass all aspects of IT management, including physical, logical, organizational and legal. This system ensures that information security is a shared responsibility across all company functions.
The goal of the standard: business resilience
By implementing a resilience strategy, or “flexible resilience”, which includes recovery objectives, Business Continuity and incident management plans coordinated and integrated within holistic risk management, companies can ensure the ability to maintain operations even in difficult situations.
ISO 22301 is designed with broad objectives to be applicable to every type of organization, regardless of their size, their geographical reach (local, national or global) and their nature (public or private).
How is the rule structured?
La ISO 22301 standard is structured into 10 sections, designed to manage various aspects of the business environment and guide the different processes towards the goal of establishing an effective business continuity management system.
This system allows the company to examine a variety of emergency scenarios, evaluating the impact on its operations and identifying appropriate solutions.
The objective of this analysis is to maintain production or the provision of services in times and ways that are acceptable to customers, until normal work activities are recovered. In practice, the ISO 22301 standard provides companies with the necessary tools to ensure their operational continuity even in extraordinary situations.
Why get certified to the 22301 standard
By adopting the guidelines established by the ISO 22301 standard, the company will be able to:
- Minimize economic losses caused by unexpected business interruptions.
- Keeping operations running, even in emergency circumstances, is a crucial factor in sectors with a strong social impact.
- Gain a competitive advantage in the market.
- Promote the development of a company policy that is prepared to manage unexpected events, establishing a culture of resilience essential in periods of significant change.
The advantages of ISO 22301
Compliance with the ISO 22301 standard requires the creation of solid plans. The idea is to develop strategies to deal with and even prevent threats.
By implementing a short, actionable guide for many scenarios, you can plan for resolution of almost any incident. Your team can quickly implement strategies, reducing response times.
Most business disruptions result in a loss of revenue. With a BCMS, you can protect your bottom line by strategizing to continue serving your customers during incidents.
If you supply to other organizations, you can unlock more opportunities with ISO 22301 certification.
How your business responds to a crisis can affect your credibility
A challenge for many organizations is not knowing what to expect. They don't know what risks are possible and which ones could have the most significant impact. By engaging in a thorough risk assessment, these threats can be uncovered.
ISO 22301 requires leadership to be heavily involved in the business continuity management system.
With a comprehensive BCMS, you know what you're ready to manage. You can prevent incidents and resolve them with your internal resources.
In general, business disruptions will not suspend regulatory requirements. Business continuity strategies can help you meet regulations in challenging times and quickly implement new policies and procedures in response to changing laws.
How does the true path of ISO 22301 certification begin with Safecore
As with any ISO certification, to achieve it it is necessary to satisfy a series of requirements, both in operational, legal and administrative terms.
The process begins with a pre-audit of the Business Continuity Management System (BCMS) conducted by the professionals of Safecore, aimed at evaluating the current state of company procedures relating to operational continuity. After this initial analysis, the technicians and experts of Safecore, through a gap analysis, will define the actions necessary to undertake the path towards certification. Together with the customer, they will develop a adequate strategic plan to achieve this goal.
The various steps
- BC Policy – Determination
- Scope of the BCP – Definition
- Governance – Determination
- Roles and Responsibilities – Assignment
- BCP – Determination
- Organizational Culture – Understanding and Influencing
- Competencies and skills – Definition
BC culture needs to be communicated and involves stakeholder involvement; it is necessary to ensure the provision of adequate training and learning.
- Processes, Products & Services and Activities - Operational Impact Analysis
- Risks and Threats – Definition and Evaluation
The Analysis examines the organization to identify its objectives, functions and constraints of the environment in which it operates. The BC requirements are defined in terms of resources and skills to continue providing the products, services, processes and priority activities following an interruption and time:
- MTDP – Maximum Tolerable of Disruption Period: the maximum tolerable time that can elapse in the face of the negative impacts resulting from an accident
- RTO – Return Time Objective: period of time within which the services provided, production, support services and operational functionality must be restored after the incident that generated the discontinuity
- BC solutions – Design
- Mitigation Measures and Risks and Threats - Design
The solutions that must be implemented to continue operating following an interruption are determined, based on the Business Continuity requirements identified in the BIA and on the basis of the results of the risk and threat assessment.
- Response Structure – Definition of the necessary roles, powers and competencies required to manage an incident
- Development and Management of Plans – Implementation of the solutions agreed in Phase 3 and 4
Many outages require several response plans to be in place in order to effectively handle the same incident. It is therefore necessary, with a view to a holistic approach, that the BC Manager collaborates with other experts.
- Development of an Exercise Plan
- Development of a Tutorial
- Retention
- Inspection and Maintenance
The BCP must meet the objectives established in the policy and verify the effectiveness of the plans and procedures in force, their accuracy and completeness, with a view to continuous improvement and through exercises designed to train, test, evaluate, practice and improve the BC capacity of the organization.
Our methodology
The team Safecore is highly qualified and boasts various certifications recognized at company level, including:
- OSCP (Offensive Security Certified Professional)
- oswe extension (Offensive Security Web Expert)
- eWPT (eLearnSecurity Web application Penetration Tester)
- eMAPT (eLearnSecurity Mobile Application Penetration Tester)
- eJPT (eLearnSecurity Junior Penetration Tester)
- eCDFP (eLearnSecurity Certified Digital Forensics Professional)
- ISO 27001 Lead Auditor
- ISO 22301 Lead Auditor
Our methodology
Safecore has developed a holistic approach which consists in the periodic analysis of the risks coming from the three fundamental components within an organization such as the PEOPLE, the PROCESSES and TECHNOLOGIES.
implement security policies to protect all personnel, internal and external, involved in the provision of services
inclusion of security principles in all company processes in compliance with "Security by design"
verify the security of all the technologies adopted within the organization with particular reference to those dedicated to the provision of services
What does the certification process involve?
The process to obtain certification involves a series of crucial steps:
- Determine the goal of certification.
- Pre-audit – an initial analysis of gaps compared to the current state and an evaluation compared to standards.
- Certification audit, divided into two phases:
- Preliminary examination of the organization and its readiness for certification.
- Evaluation of the implementation of the fundamental framework of the Business Continuity Management System (for example, company policies, management impact analysis, risk management, business continuity strategies, incident management plans, compliance with laws and regulations).
- Issue of the certificate, valid for three years.
- Surveillance audit – continuous progress monitoring.
- Renewal – a full audit or ongoing evaluation at the end of three years.
The journey through time with Safecore
Safecore also offers the consultancy service in the subsequent phases, for updating personnel and maintaining the necessary requirements over time.
In particular, the services of Safecore They include:
- definition of the scope of the ISMS in the first implementation or expansion phase;
- gap analysis and definition of the intervention plan;
- consultancy in the implementation or certification phase for the resolution of any non-conformities;
- drafting of the documentary apparatus;
- risk analysis;
- support for internal audits;
- review activities;
- training;
- coaching during the audits of the certifying bodies.
Who can benefit?
ISO 22301 certification is aimed at all companies aiming to develop and grow.
The Business Continuity Management System can be seen as an evolution of the ISO 9001 Quality Management System. While ISO 9001 focuses on improving the management of daily activities, Business Continuity Management is designed to support, recover and re-establish processes following interruptions of varying degrees.
