ISO 22301:2012 and BS 25999-2:2007 Comparison

When news of an ISO standard for BCM emerged, business continuity managers expressed concern that they might have to radically rework their BCM procedures and processes once ISO 22301 was introduced. BS 25999-2 had been, and continues to be, used by many organizations across the world as the basis of their BCM procedures and processes. The good news is that BS 25999-2 has provided the main foundation of the new ISO standard. There are some important additions and a few elements that have been omitted. The additions have added greater depth and clarity while the omissions do not detract from the overall good BCM practices and principles.

 

The new standard is entitled ‘Societal security – Business continuity management systems – Requirements.’ This is one of a suite of standards being developed by ISO/TC 223 designed to achieve greater societal security. Societal security can be defined as providing protection of society from, and the ability to respond to, incidents, emergencies and disasters caused by intentional and unintentional human acts, natural hazards, and technical failures.

 

The way in which ISO 22301 can be used is detailed in Clause 1 Scope It states that the standard is applicable to all types and sizes of organizations that wish to:

 

• Establish, implement, maintain and improve a BCMS.
• Ensure conformity with stated business continuity policy
• Demonstrate conformity to others
• Seek certification/registration of its BCMS by an accredited third party certification body
• Make a self-determination and self-declaration of conformity with this International Standard [ISO 22301:2012].

 

The standard can also be used by an organization to assess its suppliers’ ability to meet continuity needs and obligations.