Which BCMS process is used to develop a business continuity policy that sets out an operating framework?

Policy formulation is the BCMS process that is used to develop a business continuity policy that sets

out an operating framework. According to ISO 22301, the organization shall establish a business

continuity policy that is appropriate to the purpose and context of the organization and provides a

framework for setting business continuity objectives. The policy shall also demonstrate top

management’s commitment to the BCMS and its continual improvement1. The policy formulation

process involves the following steps2:

Define the scope and objectives of the policy

Identify the relevant internal and external issues and requirements

Analyze the current state of the BCMS and the gaps to be addressed

Draft the policy statement and the key principles and guidelines

Review and approve the policy by the top management

Communicate and distribute the policy to the relevant stakeholders

Monitor and update the policy as needed Reference:

ISO 22301:2019, clause 5.3

ISO 22301 Auditing eBook, page 24