The standard is divided into the following main clauses: • Scope • Normative references • Terms and definitions • Terms related to security and resilience • Terms related to risk • Terms related to management systems
Clause 3.1: Terms related to security and resilience This section establishes the generic vocabulary used in the field of security and resilience including topics like business continuity management, emergency management, protective security and crisis management. The following terms are defined in this clause: • acute shock • affected area • after-action report • alert • all clear • all-hazards approach • business continuity • business continuity management • business continuity plan • business impact analysis • chronic stress • civil protection • civil society • command and control • command and control system • contingency • cooperation • coordination • counterfeit, verb • counterfeit good • countermeasure • crisis • crisis management • disaster • disaster risk reduction • disruption • drill • duty of care • early warning • emergency • emergency management • evacuation • event • exercise • goods • impact • impact analysis • incident • incident command • infrastructure • integrity • interoperability • landslide • material good • minimum business continuity objective, MBCO • maximum tolerable period of disruption, MTPD • mitigation • mutual aid agreement • organizational resilience • people at risk • preparedness • prevention • protection • public warning • public warning system • recovery • recovery point objective, RPO • recovery time objective, RTO • resilience • robustness • safety • security • security management • shelter in place • spontaneous volunteer, SV • supply chain • threat • vulnerability • vulnerability assessment ISO 22300 defines the
Business Impact Analysis (BIA) as the process of analyzing the impact of a disruption over time. This analysis identifies any prioritized activities that need to be recovered in order to avoid any failure. Other terms such as
Maximum Tolerable Period of Disruption (MTPD) and
Recovery Time Objective (RTO) are core terms of this section as they are about the different times it takes before an outage becomes irreversible and the times it would take to resume any operations. Additionally, the
Recovery Point Objective (RPO) is defined to measure the amount of data loss. Unlike RTO, which focuses on the time it takes to recover, RPO measures the amount of data an organization can afford to lose, which is measured in time. The standard classifies disruptive events based on their severity and the response required to recover. An incident is defined as an event that might, or could, lead to any form of disruption or loss. This is different from the definition given for emergency as that is an unexpected occurrence or event requiring immediate action to prevent any disruption or loss. The standard defines a crisis as an abnormal situation that threatens the organization's objectives and often requires strategic response. Instead of developing its own terminology on the subject, ISO 22300 endorse the work of ISO/TC 262 and repeats key terms and definitions from ISO 31073 in clause 3.2. The following terms are defined in this clause: • consequence • consultation and communication • control • hazard • likelihood • probability • residual risk • risk • risk acceptance • risk analysis • risk appetite • risk assessment • risk communication • risk criteria • risk evaluation • risk identification • risk management • risk mitigation • risk owner • risk reduction • risk register • risk sharing • risk source • risk tolerance • risk treatment Risk is defined as the effect of uncertainty on objectives. Organizations must state their
risk appetite, which is the amount and type of risk that they are willing to pursue or retain. In order to judge the risks taken by organizations, risk criteria is a necessity. Risk criteria are the reference against which the significance of a risk is evaluated. These steps begin with
risk identification in which the risk source is found. Following this,
risk analysis is used to understand the nature and gravity of the risk. Finally, risk evaluation compares the result against risk criteria to determine whether the risk is tolerable. Following this, policy is defined as the intentions and direction of an organization. Another generic term given is requirement which is simply the need or expectation that is stated. This is all then evaluated through
audits. If any requirement is not met, the standard defines this as nonconformity. To combat this, the organization or group must implement corrective action to eliminate the cause of the failure, and also use continual improvement to enhance performance over time. == Purpose ==