ISO 22301 Business Continuity Objectives Template

Introduction

ISO 22301 is the international standard that outlines the requirements for establishing, maintaining, and improving a Business Continuity Management System (BCMS). It sets requirements and guidance for protecting an organization from the impact of disruptive incidents, preparing for and responding to disruptive incidents and post-incident recovery, and reducing the likelihood of disruptive incidents occurring. An effective BCMS based on ISO 22301 can help an organization minimize the impact of incidents, such as cyber-attacks, natural disasters, supply chain disruptions, and pandemics, on its ability to deliver products and services.

The Critical Role of Business Continuity Objectives

Objectives play a significant role in the functioning of any management system, including BCMS. Thus, business continuity objectives (BCO) should be developed and included in the BCMS scope to achieve the following:

• Align the BCMS with the organization’s strategy and business continuity policy by translating them into actionable objectives.
  
  
• Serve as guidance for managers and all organization members on what to do to achieve business continuity.
  
  
• Measure the performance of the BCMS, as there can be no measurement without objectives.
  
  
• Support resource allocation decisions by identifying the resources needed to achieve objectives and, therefore, the BCMS.
  
  
• Demonstrate compliance with ISO 22301 requirements since the standard specifically requires that the organization shall establish business continuity objectives.
  
  
• Help continually improve the BCMS by comparing performance against objectives.

Key Elements of an Effective ISO 22301 Objective

Business continuity objectives should be formulated in accordance with the following key elements:

• Specific: Objectives should be clearly worded. Ambiguous statements, such as “improve business continuity,” should be avoided. Instead, one can say, for instance, “reduce the Recovery Time Objective (RTO) for critical IT systems.”
  
  
• Measurable: It should be possible to measure progress toward achieving objectives. In other words, one should be able to answer the question, “How will we know if we have achieved the objective?” An example of a measurable objective can be “achieve the RTO of 4 hours for critical IT systems.”
  
  
• Achievable: The objective should be realistic and, therefore, achievable considering the available resources and constraints.
  
  
• Relevant: The objective should support the organization’s BCMS policy and should be aligned with the results of the Business Impact Analysis (BIA) and risk assessment and should contribute to the overall business continuity capability.
  
  
• Time-bound: Objectives should have a defined deadline or time frame for achievement. An example of a time-bound objective can be “achieve the RTO of 4 hours for critical IT systems by Q4 FY2024.”

In addition to the above elements, business continuity objectives should reflect the organization’s risk appetite and stakeholders’ expectations and requirements and meet legal and regulatory requirements.

Introduction to ISO 22301 Business Continuity Objectives Template

As can be seen from the above discussion, objectives are essential in BCMS. They should, therefore, be carefully developed and documented. An ISO 22301 Business Continuity Objectives Template can help in this regard since it can serve as a guide for developing objectives, ensuring that all critical elements are considered. In particular, the template can help ensure that all the information necessary for each objective is provided. For example, using the template, one can ensure that all the information, such as how the progress will be measured, is given.

Benefits of ISO 22301 Business Continuity Objectives Template

An ISO 22301 Business Continuity Objectives Template is a document, typically in spreadsheet format, that facilitates the development of objectives by guiding through the process of articulating each objective. It can bring the following benefits:

• Standardization – The template ensures that objectives are developed in a standardized manner.
  
  
• Comprehensiveness – The template ensures that all the information relevant to each objective is provided.
  
  
• Efficiency – The template helps reduce the time needed to develop objectives.
  
  
• Demonstration of Commitment – The use of the template demonstrates the organization’s commitment to developing objectives as part of the BCMS.
  
  
• Ease of Use – The template can make it easier to review, monitor, and update objectives.

Basic Components of ISO 22301 Business Continuity Objectives Template

A good template typically includes the following components:

• Objective ID – A unique objective identifier.
  
  
• Objective – Objective statement that specifies what is to be achieved. It should be specific (see the SMART criteria below).
  
  
• Alignment with Policy – A reference to the relevant policy statement or BCMS goal this objective is aligned with.
  
  
• Measurement/Metric – How the progress toward achieving the objective will be measured.
  
  
• Target – The specific target that will be used to measure the progress toward achieving the objective.
  
  
• Timeline/Deadline – The timeline or the date when the objective is expected to be achieved.
  
  
• Responsibility – The person or department responsible for achieving the objective.
  
  
• Resources – The resources that will be allocated to achieve the objective.
  
  
• Status – The current status of the objective (e.g., Not Started, In Progress, Achieved, Delayed).
  
  
• Review Date – The date when the objective will be reviewed.
  
  
• Comments/Progress – Comments and progress updates.

Steps to Develop ISO 22301 Business Continuity Objectives Using the Template

The process of developing business continuity objectives can be iterative. However, in most cases, the following steps should be taken:

1. Review the BCMS Scope, Context, and Policy

Review the organization’s BCMS scope and context and the BCMS policy to identify the high-level business continuity goals and objectives to be achieved, and the scope of the business continuity plan (BCP).

2. Carry Out Business Impact Analysis (BIA) and Risk Assessment

The results of the BIA, specifically the list of critical activities with their associated RTOs and RPOs, and the risk assessment, specifically the list of threats and vulnerabilities identified, are critically important in the development of business continuity objectives.

3. Brainstorm and Draft Objectives

Based on the information obtained in the previous steps, draft business continuity objectives.

4. Define SMART Objectives

Convert the objectives outlined in step 3 into specific, measurable, achievable, relevant, and time-bound (SMART) objectives.

5. Populate the ISO 22301 Business Continuity Objectives Template

Populate the columns of the template with the relevant information for each objective. In particular, one should specify what is to be achieved, how the achievement will be measured, what the target to be achieved is, and what the deadline for achieving the objective is. In addition, one should identify the responsible parties, resources to be allocated, and review dates. This step can be performed jointly with step 5.

6. Disseminate and Monitor the Objectives

Disseminate the objectives and monitor their achievement.

7. Review and Update the Objectives Periodically

Periodically review and update the objectives as needed, for example, on an annual basis or after major changes or incidents.

Examples of ISO 22301 Business Continuity Objectives

The following are some examples of business continuity objectives:

1. Achieve Defined Recovery Time Objective (RTO):

• Objective: Achieve the defined RTO for all critical processes and IT infrastructure within 6 months.
  
  
• Metric: The percentage of critical processes and IT infrastructure that meets the defined RTO.
  
  
• Target: 100%.

2. Achieve Defined Recovery Point Objective (RPO):

• Objective: Ensure that data backup and recovery mechanisms meet the defined RPO for all Tier 1 data by year-end.
  
  
• Metric: The number of instances where the RPO is exceeded in testing or actual recovery.
  
  
• Target: 0.

3. Test All Critical BCPs:

• Objective: Test all critical BCPs annually.
  
  
• Metric: The percentage of critical BCPs tested within the annual cycle.
  
  
• Target: 100%.

4. Provide Business Continuity Awareness Training:

• Objective: Provide business continuity awareness training to 100% of employees involved in critical processes by Q3.
  
  
• Metric: The percentage of relevant employees who have received business continuity awareness training.
  
  
• Target: 100%.

5. Identify and Establish Alternative Suppliers for Critical Single Points of Failure in the Supply Chain:

• Objective: Identify and establish alternative suppliers for all identified critical single points of failure in the supply chain within 9 months.
  
  
• Metric: The percentage of critical single points of failure in the supply chain with established alternative suppliers.
  
  
• Target: 100%.

6. Update External Crisis Communication Protocols:

• Objective: Ensure that external crisis communication protocols are updated and accessible within 24 hours of any significant change in business operations or regulatory requirements.
  
  
• Metric: The time taken to update and distribute external crisis communication protocols.
  
  
• Target: Within 24 hours.

Benefits of Adopting ISO 22301 Business Continuity Objectives

The following are the benefits of adopting a structured approach to developing objectives, such as using an ISO 22301 Business Continuity Objectives Template described above:

• Enhanced Organizational Resilience – By establishing clear objectives to be achieved, the organization will be more focused on achieving these objectives, thereby enhancing its business continuity and resilience.
  
  
• Improved Decision-Making – Objectives can help the organization make informed decisions about the allocation of resources and the selection of the most appropriate strategy for achieving business continuity.
  
  
• Compliance – Using a structured approach to developing business continuity objectives can help the organization demonstrate its commitment to meeting ISO 22301 and other relevant legal and regulatory requirements.
  
  
• Increased Stakeholder Confidence – Having well-defined and well-documented objectives can help increase the confidence of stakeholders in the ability of the organization to achieve business continuity and resilience.
  
  
• Culture of Continuous Improvement – The monitoring and review of objectives can foster a culture of continuous improvement as the organization will always have clearly defined goals to strive for.

Common Pitfalls to Avoid When Developing Business Continuity Objectives

When developing business continuity objectives, one should endeavor to avoid the following pitfalls:

• Vagueness – Objectives should not be worded in a way that allows different people to interpret them differently. For example, an objective such as “be more resilient” is too vague.
  
  
• Unachievability – Objectives should be realistic and, therefore, achievable. It is important to consider the available resources when setting objectives. For example, one should not set a target of achieving an RTO of 1 hour for critical IT systems if this requires allocating more resources than the organization has available.
  
  
• Absence of Ownership – It is important to identify who will be responsible for achieving each objective.
  
  
• Failure to Monitor Objectives – It is critically important to monitor the achievement of objectives.
  
  
• Failure to Reference BCSM Outcomes and BIA and Risk Assessment Results – As mentioned above, objectives should be aligned with the BCMS policy and should be informed by the results of the BIA and risk assessment.
  
  
• Too Many Objectives – It is important to set a limited number of objectives, and one should prioritize objectives to ensure that the most critical ones are set.

Conclusion

As can be seen from the above discussion, objectives are of paramount importance in BCMS. They specify what is to be achieved, provide direction, facilitate performance measurement and thus, enable continuous improvement, and demonstrate the organization’s commitment to achieving business continuity and resilience. By adopting a structured approach to developing objectives, such as using the ISO 22301 Business Continuity Objectives Template described above, the organization can develop clear objectives that will facilitate the achievement of business continuity and resilience.