DarkSkope has extensive experience working in the BCM field. We have assisted a number of high profile clients to achieve full ISO accreditation.
What Is ISO 22301?
ISO 22301:2019, Security and resilience – Business continuity management systems – Requirements, is a management system standard published by International Organization for Standardization that specifies requirements to plan, establish, implement, operate, monitor, review, maintain and continually improve a documented management system to protect against, reduce the likelihood of occurrence, prepare for, respond to, and recover from disruptive incidents when they arise [1]. It is intended to be applicable to all organizations, or parts thereof, regardless of type, size and nature of the organization
What Are The Benefits of ISO22301 Accreditation?
- Protect assets, turnover and profits: Effective business continuity management (BCM) enables organisations to protect their income steam following an incident or disaster, while reducing the risk of further losses.
- Ensure continuity of business operations: A BCMS helps maintain an organisation’s service levels to its customers. It also helps business leaders to assess the potential impacts of an operational disruption, make the right decisions quickly, deploy an effective response and minimise the overall impact.
- Increase competitive advantage and enhance corporate reputation: Organisations with an ISO 22301-compliant BCMS can improve customer confidence in the organisation’s ability to respond to incidents.
- Meet legal and regulatory requirements: We recommend ISO 22301 compliance as a useful tool for implementing a well-defined incident response and reporting structure, so organisations can demonstrate they are taking steps to comply with regulatory requirements, such as the and the the EU General Data Protection Regulation (GDPR) and the NIS Directive.
- Obtain an independent assessment of your security posture:
Accredited certification involves regular reviews and internal audits that provide an expert opinion as to whether the BCMS is functioning properly and provides the level of security needed to protect the organisation’s products and services.
What Is The Process?
A typical engagement to prepare a client for Stage 1 audit would involve the following:
Phase 1 – Strategic Business Continuity Plan Development
- Senior Management Training - DarkSkope will train your senior management in their role conducting a Strategic Business Impact Analysis.
- Strategic Business Impact Analysis Preparation - DarkSkope will assist you draw up the appropriate methodologies and benchmarks to be used during the conduct of the Strategic Business Impact Analysis.
- Strategic Business Impact Analysis Conduct - DarkSkope will facilitate the senior management team in conducting a Strategic Business Impact Analysis (BIA). The purpose of the BIA is to enable the identification of priority product/services, the rating of potential impacts and the clarification of recovery times and objectives.
- Risk Assessment - DarkSkope will assist you to identify appropriate strategic risks and to assess these against the critical products/services identified within the Strategic BIA. DarkSkope will advise you in the selection of an appropriate Risk Appetite, so as to guide the selection of appropriate BCM Strategies.
- BCM Scope - DarkSkope will assist you to decide on the scope of the BCM programme, including the areas to be covered within the Business Continuity Management System.
- BCM Strategy Selection - DarkSkope will assist you in the selection of appropriate BCM Strategies that are inline with the BIA, prevailing culture and Risk Appetite. Such BCM Strategies (normally required for Premises, People, ICT, Information, Suppliers & Stakeholders) will include the identification of mitigation measures to be taken in advance of any incident as well as the selection of response measures to be taken in the event of an interruption.
- Mitigation Measure Implementation - DarkSkope will provide appropriate support and advice to assist you to capture the appropriate mitigation measures that need to be put in place.
- Strategic Business Continuity Plan - DarkSkope will assist you to formulate a Strategic Business Continuity Plan (BCP) that is line with the structure identified and that takes account of the Strategic BIA.
Phase 2 – Development of Management Programme and Defining the Standard
- BCM Policy - DarkSkope will assist you to develop a comprehensive BCM Policy that defines the scope, standards and benchmarks against which you will develop your BCM capability.
- BCM Management Programme - DarkSkope will assist you in the production of a BCM Management Programme to account for training, exercising and auditing in relation to the BCM capability.
Phase 3 – Departmental / Site BCM Role Out
- Raising Staff Awareness - DarkSkope will help to raise the awareness of staff by providing awareness presentation(s) to selected BCM practitioners within your Departments / Sites.
- Departmental / Site Assistance - DarkSkope will provide support to Department / Site level BCM practitioners in the development of their Business Unit Resumption Plans.
Phase 4 - Validation
- Validation Exercise - DarkSkope develop & facilitate a suitable exercise to enable the validation of your BCM capability. We will produce a draft exercise format, instruction and will facilitate all aspects of exercise delivery. Post exercise hot de-briefs and a comprehensive Post-Exercise Report will be produced to inform 'lessons' to be captured.