Free readiness test
ISO 22301:2019 Lead Implementer: 40 free scenario questions
Implement a BCMS from business impact analysis through to tested continuity plans and recovery strategies.
Reviewed by cyber security professionals with 25+ years of experience each.
Sign up free to startScenario
You are implementing ISO 22301 for a regional bank with 180 branches, a head office, two data centres and outsourced cash logistics. The CEO wants certification within nine months and proposes a scope limited to the head office 'to keep it simple'. The bank's regulator has just issued operational resilience rules requiring firms to identify important business services, such as retail payments and ATM cash availability, and to set impact tolerances. Branch staff, the data centres and the cash logistics provider all contribute to these services. The board also wants the certificate to be referenced in the regulatory submission due in twelve months. The IT director warns that including data centres will 'double the work'. Budget for external help is limited to one consultant for three months. The head of compliance warns that a narrow certificate could be challenged by the regulator.
What is the BEST approach to defining the scope?
- AAdopt the head-office scope now and expand it after certification.
- BScope around important services and what delivers them.
- CInclude every activity of the bank so nothing is missed.
- DLet the regulator define the scope during its review.