ISO22301 Update: Major Changes from 2012 to 2019

Major ISO22301:2019 Update

Clause 8 (operation) will require a fair bit of modification. As expected, I felt that the 2012 version is too prescriptive, but it is the key clause addressing the core of the matter of business continuity for me as a BCM practitioner.

While the structure of the sub-clauses was not modified a lot, new additions to the content were heavily discussed and, hopefully, improved to better suit the requirements of the practitioners who use this international standard.

Sub-clause	Name	Description of Modification
8.2.2	Business Impact Analysis (BIA)	Sub-Clause 8.2.2 was enhanced and a reference to ISO 22318 (supply-chain continuity) was added. Notes referring to the terms MTPD and RTO (both removed from the clause on terms and definitions) were added. The Sub-Clause now stipulates that the BIA should take impact categories as a starting point. While many organizations are already defining impact categories in their BIA, the new version of the standard makes this mandatory.
8.3	Business Continuity Strategies and Solutions	"Business continuity strategies and solutions" was renamed from "Business continuity strategy" The new name highlights the need for the identification and selection of strategies and solutions
8.4	Business Continuity Plans and Procedures	Formerly called “Establish and implement business continuity procedures”, this sub-clause has been now renamed to “Business continuity plans and procedures”, with a renewed focus on “Response structure” (8.4.2), “Warning and communication” (8.4.3), “Business continuity plans” (8.4.4) and “Recovery” (8.4.5).
8.5	Exercise Program	This new sub-clause replaces the sub-clause formerly called “Exercising and testing”.