Which BCMS process is used to develop a business continuity policy that sets out an operating framework?

Policy Formulation is the process through which top management establishes the business continuity policy. According to ISO 22301, this policy provides the overarching framework for setting business continuity objectives and guides the implementation, operation, and maintenance of the BCMS. It ensures that the business continuity initiatives align with the organization's strategic direction and establishes the foundational operating framework for all subsequent continuity planning.

A. Develop and Management: This is not a recognized standard process for establishing the initial policy framework within the ISO 22301 standard.
B. Performance Evaluation: This process assesses the BCMS after it has been implemented, rather than formulating the initial policy framework.
D. Management Review: This involves reviewing an existing BCMS for continuing suitability, not the initial formulation of the policy itself.

1. ISO 22301:2019, Clause 5.2 (Business continuity policy).

2. Business Continuity Institute (BCI) Good Practice Guidelines (GPG), Policy and Programme Management.