Who shall establish, document, provide resources, and demonstrate commitment to a business continuity management policy within the defined scope of…

The responsibility for establishing policy, providing resources, and demonstrating commitment to a Business Continuity Management System (BCMS) lies with top management. This is a fundamental principle of governance for any management system. Top management has the ultimate authority and accountability to set the organization's strategic direction, allocate necessary resources (financial, human, and technical), and ensure the BCMS is integrated into the organization's processes. Their visible commitment is critical for fostering a resilient organizational culture and ensuring the effectiveness of the BCMS.

B. Security manager: The security manager is a functional role responsible for implementing and managing aspects of the BCMS, but they lack the authority to establish enterprise-wide policy or allocate major resources.

C. Human resource manager: The HR manager's role is focused on the personnel aspects of business continuity, such as employee communication and welfare, not the overall strategic direction and resourcing of the BCMS.

D. Chief financial officer: While a key member of top management responsible for financial resources, the overall accountability for establishing policy and demonstrating commitment is a collective top management responsibility, not solely the CFO's.

1. ISO 22301:2019

Security and resilience — Business continuity management systems — Requirements.

Clause 5.1

Leadership and commitment: "Top management shall demonstrate leadership and commitment with respect to the business continuity management system by: a) ensuring that the business continuity policy and business continuity objectives are established... c) ensuring that the resources needed for the business continuity management system are available..."

Clause 5.2

Policy: "Top management shall establish a business continuity policy..."

2. ASIS International

Protection of Assets (POA)

Business Continuity Management volume

2021.

Chapter 2

Program Initiation and Management

Section: "Management Support": This section emphasizes that senior management support is the "single most important element of a successful BCM program." It details their responsibilities

which include approving the BCM policy

committing resources

and providing overall direction and authority.

3. Fischer

R. J.

Halibozek

E.

& Walters

D. C. (2019). Introduction to security (10th ed.). Butterworth-Heinemann.

Chapter 15

Emergency Management and Business Continuity: The text states that a successful business continuity plan requires a "top-down approach" and that "senior management must be fully committed to the process

providing the necessary resources and support." (Paraphrased from discussions on BCP governance).