ISO/TS 22332 Security and resilience - Business continuity management systems - Guidelines for developing business continuity plans and procedures
This Technical Specification for business continuity management systems provides guidance for establishing and documenting business continuity plans and procedures enabling the implementation of recovery strategies (determined during business continuity strategy determination and selection). This is a requirement of ISO 22301 (clause 8.4). It is intended to be applicable to all organizations, regardless of type, location, size and nature of the organization.
This Technical Specification is complementary to ISO 22301, but is not in itself a business continuity management system standard. It will make supplements, but does not replace, existing management systems within an organisation and it is not intended to be used for certification purposes (but assists with meeting requirements notes in ISO 22301, and will be consistent with guidance in ISO 22313).
Bill DiMartini (USA), the project leader responsible for the development of ISO 22332, explain the justification of this project:
"Business continuity procedural development and documentation is designed to implement management-approved business continuity strategies. ISO 22301, Section 8.4, requires organisations to establish, implement and maintain business continuity procedures to manage a disruptive incident and continue its activities based on recovery objectives identified in the business impact analysis. However, neither ISO 22301 nor ISO 22313 provide sufficient detail regarding the methods to create such procedures, how to organize the procedures (in the form of plans), the intent of such procedures describing how to recover an activity (which may include operating in an alternate manner until returning to normal), how to create awareness regarding such procedures, and how to maintain (and continually improve) these procedures over time"
ISO/TS 22331:2018, Security and resilience - Business continuity management systems - Guidelines for developing business continuity plans and procedures, is available from ISO national member institutes. It may also be obtained directly from the ISO Central Secretariat, respectively through the ISO Store or by contacting the Marketing, Communication & Information department.
ISO/TS 22332 is due to be published in April 2021