It is supported by a business impact analysis, recovery time objectives, backups and disaster recovery arrangements. Plans that are not tested regularly often fail in a real incident.
Source: ISO 22301
Related terms
Enterprise risk management (ERM)The process of identifying, assessing, managing and monitoring, in an integrated way, the risks that could affect an organisation's achievement of its objectives.Cybersecurity riskThe likelihood of harm to an organisation from attacks such as unauthorised access to information systems, data leaks, ransomware or service disruption.IT general controlsControls over access management, change management, IT operations and system development that ensure information systems operate reliably.Anti-bribery and corruptionThe set of policies, controls and training designed to prevent the offering or acceptance of undue advantages to or from public officials or private sector employees.Application controlsAutomated or IT-dependent manual controls embedded in a software application that ensure transactions are processed completely, accurately and with authorisation.Compliance auditAn examination of whether an organisation's activities are carried out in accordance with the relevant laws, regulations, contracts or internal rules.
Last updated: November 8, 2026 · This definition is for general information only.