What is the difference between a Business Continuity Plan and a Disaster Recovery Plan?

A Business Continuity Plan guides the continuation and resumption of prioritised activities, products and services. A Disaster Recovery Plan focuses on recovering the infrastructure, data and technology services required by the business. They are complementary components; the need for a standalone DRP and the way the documents are linked depend on the organisation’s scope and reliance on technology.

What is the difference between a BIA and a risk assessment?

A BIA examines how the impacts of a disruption develop over time, identifies prioritised activities and supports the definition of MTPD, RTO, MBCO and, where applicable, RPO. A risk assessment identifies scenarios that could cause disruption, analyses likelihood and consequences, and guides treatment measures. Put simply, the BIA asks what impact a disruption would have and how long it can be tolerated; the risk assessment asks what could cause the disruption and how exposure can be reduced.

What is the difference between ISO 22301 Lead Implementer and Lead Auditor?

Lead Implementer prepares professionals to support the design, implementation, operation and improvement of a BCMS. Lead Auditor develops the capability to plan and conduct first-, second- or third-party audits, according to the professional’s role and competence. Completing the training does not, by itself, confer authority to issue third-party certification.

iso 22301 Archives

Training in risk management, business continuity and information security: how to choose?

A team may need training because it is about to start implementing ISO 27001. Another may already have the system in place but need to review responsibilities and records. The course may be the same, even though the work to be carried out afterwards is different.

⏱️ Estimated reading time: 4 minutes

When choosing training in risk management, business continuity or information security, the enrolment request should specify that work. This allows business unit management and HR to assess the course programme, select participants and plan when they will apply what they have learnt.

ISO 22301: practical guide to business continuity

How to prepare your organisation, structure evidence and build capability.

⏱️ Estimated reading time: 8 minutes

This practical guide to ISO 22301 and business continuity explains how to prepare your organisation, define recovery priorities and objectives, test plans and compile audit evidence.

ISO 22301 and business continuity: what is it and who does it apply to?

ISO 22301 specifies the requirements for establishing, implementing, maintaining and improving a Business Continuity Management System (BCMS). It can be applied by organisations of any size or sector that need to ensure the delivery of prioritised products and services during a disruption.

The standard is voluntary as a management system and certification framework. Nevertheless, legal, sector-specific or contractual requirements may require specific continuity, recovery and evidence capabilities. Certification is one way to demonstrate conformity with the standard, but it does not replace obligations applicable to the organisation.

Select your language

Articles tagged with: iso 22301

Training in risk management, business continuity and information security: how to choose?

ISO 22301: practical guide to business continuity

ISO 22301 and business continuity: what is it and who does it apply to?