Business continuity can be integrated into two levels of the organization’s activities: management and processes. According to the ISO 22301 Auditing eBook, "Business continuity integration is the process of embedding business continuity principles and practices into the organization’s culture, values, and operations. Business continuity integration aims to ensure that business continuity is not seen as a separate function or project, but as an integral part of the organization’s management and processes."1
Business continuity integration at the management level involves the following aspects1:
Leadership and commitment: The top management of the organization should demonstrate leadership and commitment to the business continuity management system (BCMS) by establishing the business continuity policy, objectives, and roles, as well as providing the necessary resources and support for the BCMS.
Planning and strategy: The organization should plan and develop its business continuity strategy and objectives based on the results of the business impact analysis and risk assessment, as well as the needs and expectations of the interested parties. The organization should also plan the actions to address the risks and opportunities related to the BCMS, as well as the changes that may affect the BCMS.
Monitoring and evaluation: The organization should monitor and measure the performance and effectiveness of the BCMS, as well as the compliance with the requirements and expectations of the interested parties. The organization should also conduct internal and external audits, management reviews, and corrective actions to evaluate and improve the BCMS.
Continual improvement: The organization should continually improve the suitability, adequacy, and effectiveness of the BCMS by identifying and implementing opportunities for enhancement and innovation.
Business continuity integration at the process level involves the following aspects1:
Process identification and analysis: The organization should identify and analyze its processes and their interactions, as well as their criticality, dependencies, and recovery priorities. The organization should also determine the minimum business continuity objectives (MBCOs), recovery time objectives (RTOs), and recovery point objectives (RPOs) for each process.
Process design and implementation: The organization should design and implement its processes in accordance with the business continuity strategy and objectives, as well as the requirements and expectations of the interested parties. The organization should also establish and maintain the business continuity plans and procedures that specify the actions and responsibilities for responding to and recovering from disruptive incidents.
Process control and operation: The organization should control and operate its processes in a consistent and effective manner, as well as ensure the availability and reliability of the resources and assets that support the processes. The organization should also conduct exercises and tests to verify and validate the functionality and operability of the processes and the business continuity plans and procedures.
Process improvement and optimization: The organization should improve and optimize its processes by applying the PDCA cycle and the process approach principles. The organization should also seek to enhance the resilience and adaptability of its processes to cope with changing circumstances and needs.
References:
ISO 22301 Auditing eBook, Chapter 3: Business Continuity Integration, Section 3.1: Business Continuity Integration Levels1
ISO 22301:2019 - Security and resilience — Business continuity management systems — Requirements2
