ISO 22301
Standard for a Business Continuity Management System (BCMS). How to keep critical processes running when something goes wrong.
ISO 22301 describes how to build a Business Continuity Management System (BCMS). The goal is to ensure that after an outage, attack, or loss of a critical supplier, the organisation knows what is critical, how quickly it must recover, and who does what.
Implementation starts with a Business Impact Analysis (BIA), not with writing plans. The BIA produces the RTO (Recovery Time Objective) and RPO (Recovery Point Objective) parameters per process. Only then do you write the BCP and DRP.
A plan that has never been tested is a wish, not a plan. Exercises such as tabletop drills reveal that the contact number for a key person is out of date and that a backup does not restore as quickly as assumed. It is better to find that out in an exercise than during a real incident.
In practice: see the relevant RealSec module.
Business Impact Analysis: an assessment of which processes are critical and how quickly they must be restored after a disruption.
The maximum time within which a process or system must be restored to operation after a disruption.
The maximum amount of data that can be lost after a disruption, expressed as a time interval (e.g., the last hour of data).
Compliance that connects.
Terms are the map. RealSec ties them to processes, systems and vendors in one engine.