Clause 8 : Operation

Requirement
The organisation must plan, implement, and control processes needed to meet requirements and implement Clause 6 actions, by establishing criteria for processes, implementing control in line with those criteria, and keeping documented information showing processes ran as planned. The organisation must control planned changes, review consequences of unintended changes, and ensure outsourced processes and the supply chain are controlled.

How to Implement
Translate your risk treatment decisions into standard operating procedures, and pay particular attention to the supply chain control requirement, since a disruption at a key supplier can be just as damaging as one inside your own operations. Build supplier continuity expectations into contracts where the relationship is critical enough to warrant it.

Mandatory Documents
Yes, conditionally mandatory. Documented information must be kept “to the extent necessary to have confidence that the processes have been carried out as planned.”

Requirement
8.2.1 General requires implementing systematic processes for business impact analysis and risk assessment, reviewed at planned intervals and after significant changes.

8.2.2 Business Impact Analysis requires defining impact types and criteria, identifying activities that support product and service delivery, assessing impacts over time from disruption of those activities, identifying the maximum tolerable period of disruption (MTPD), setting recovery time objectives (RTO), identifying prioritised activities, and determining the resources and dependencies (including partners and suppliers) those activities need.

8.2.3 Risk Assessment requires implementing a risk assessment process to identify risks of disruption to prioritised activities and their required resources, analyse and evaluate those risks, and determine which require treatment.

How to Implement
The BIA is where you work out which activities genuinely can’t wait if disrupted, since not every activity needs the same urgency. As ISO 22313 frames it, examine each activity’s impact over time against categories like financial, reputational, operational, legal, and contractual consequences, then work out two figures for each: the maximum tolerable period of disruption (how long before the impact becomes genuinely unacceptable) and your recovery time objective (the target you’re actually planning to hit, which should sit comfortably inside that maximum).

Note that “prioritised” doesn’t always mean “fastest to recover,” since an activity that could wait six months but would take eight months to restore still needs early attention. Once prioritised activities are identified, the risk assessment that follows should focus specifically on what could disrupt those activities and the resources they depend on, rather than attempting to assess every conceivable risk across the whole organisation.

Mandatory Documents
There is no single explicit “shall be available as documented information” statement naming a BIA or risk assessment report by title, but the detailed outputs required throughout 8.2.2 and 8.2.3 (impact criteria, prioritised activities, MTPDs, RTOs, identified risks) are, in practice, impossible to evidence without documenting them. You must maintain:

• A Business Impact Analysis report, covering prioritised activities, MTPDs, RTOs, and dependencies
• A Risk Assessment report, covering identified risks and treatment decisions

Requirement
8.3.1 General requires identifying and selecting strategies based on BIA and risk assessment outputs, covering options before, during, and after disruption, comprised of one or more solutions.

8.3.2 requires identifying strategies based on the extent to which they meet recovery requirements, protect prioritised activities, reduce disruption likelihood, shorten disruption periods, limit impact, and provide adequate resources.

8.3.3 requires selecting strategies based on meeting recovery requirements, the organisation’s risk appetite, and cost-benefit considerations.

8.3.4 requires determining resource requirements across people, information and data, physical infrastructure, equipment, ICT systems, transportation and logistics, finance, and partners and suppliers. 8.3.5 requires implementing and maintaining selected solutions so they can be activated when needed.

How to Implement
For each prioritised activity from your BIA, identify realistic options for protecting it, continuing or resuming it quickly, and managing the broader impact of its disruption, then weigh those options against cost, speed, and how well they fit your organisation’s actual risk appetite.

A strategy is rarely a single solution; most prioritised activities end up protected by a combination, for example, a backup site plus cross-trained staff plus an alternative supplier, rather than one silver-bullet fix.

Mandatory Documents
There is no explicit “shall be available” statement specifically naming strategy documentation, though the requirement to “implement and maintain selected business continuity solutions” in practice requires documenting what those solutions are. It is strongly recommended to maintain:

• A Business Continuity Strategy and Solutions document, covering selected strategies, resource requirements, and implementation status

Requirement
8.4.1 General requires implementing a response structure for timely warning and communication, with plans and procedures that are specific, flexible, impact-focused, effective, and assign clear roles.

8.4.2 Response Structure requires one or more teams responsible for responding to disruptions, with clearly stated roles and relationships, collectively competent to assess disruption impact, activate responses, plan actions, prioritise (with life safety first), monitor effects, activate solutions, and communicate with interested parties. Each team needs identified personnel and alternates, plus documented procedures.

8.4.3 Warning and Communication requires documented procedures for internal and external communication, receiving and responding to interested party communications, ensuring communication availability during disruption, coordinating with emergency responders, managing media response, and recording disruption details and decisions.

8.4.4 Business Continuity Plans requires documented plans containing team actions, activation thresholds, procedures to maintain agreed capacity, and guidance on managing immediate consequences, with each plan covering purpose, roles, actions, supporting information, interdependencies, resources, reporting, and stand-down process.

8.4.5 Recovery requires documented processes to restore business activities from temporary measures back to normal operations.

How to Implement
Build your response structure around life safety first, since the standard explicitly requires this as the top priority before any business recovery activity begins.

Name specific people (and their alternates) to each response team, and write procedures specific enough to actually follow under pressure, since a vague plan is of little use during a genuine disruption. For warning and communication, decide in advance who speaks to media, who contacts emergency services, and how you’ll reach staff if normal systems are down, since these decisions need to exist before they’re needed, not during the event itself.

Finally, don’t treat recovery as implicit in your response plan: write a separate, explicit process for standing down temporary measures and returning to normal operations, since this transition is often where organisations lose momentum after the initial crisis response ends.

Mandatory Documents
Yes, explicitly mandatory across several points. You must maintain:

• Documented response procedures for each response team (8.4.2.4)
• Documented warning and communication procedures (8.4.3.1)
• Documented business continuity plans and procedures, covering each required element under 8.4.4.2 and 8.4.4.3
• Documented recovery processes (8.4.5)

Requirement
The organisation must implement a programme of exercising and testing to validate the effectiveness of its strategies and solutions over time. Exercises must be consistent with business continuity objectives, based on well-planned scenarios with clear aims, build teamwork and competence, collectively validate strategies and solutions over time, produce formal post-exercise reports with recommendations, be reviewed for continual improvement, and be performed at planned intervals and after significant changes. The organisation must act on exercise results to implement changes and improvements.

How to Implement
Build an annual exercise calendar that progressively tests different parts of your BCMS, from simple tabletop discussions through to full simulations, rather than running the same type of exercise every time.

Treat the post-exercise report as the real deliverable, not the exercise itself: every exercise should produce documented findings and recommendations that actually feed back into your plans, strategies, and training, closing the loop rather than being filed away unread.

Mandatory Documents
There is no explicit “shall be available as documented information” statement naming exercise records directly, but the requirement to “produce formalized post-exercise reports” effectively makes this mandatory in substance. You must maintain:

• Post-Exercise Reports, covering outcomes, recommendations, and improvement actions, for every exercise conducted

Requirement
The organisation must evaluate the suitability, adequacy, and effectiveness of its BIA, risk assessment, strategies, solutions, plans, and procedures, through reviews, analysis, exercises, tests, post-incident reports, and performance evaluations.

This includes evaluating partner and supplier business continuity capabilities, evaluating compliance with legal and regulatory requirements and the organisation’s own policy and objectives, and updating documentation in a timely manner.

Evaluations must occur at planned intervals, after an incident or activation, and when significant changes occur.

How to Implement
Build a structured annual review of your entire BCMS documentation set, not just a check that documents still exist, but a genuine assessment of whether they’d actually work if activated today. Extend this evaluation to key partners and suppliers whose own continuity capability directly affects yours, since a resilience plan that assumes a supplier will perform as expected, without ever checking, is a gap waiting to be discovered at the worst possible time.

Mandatory Documents
There is no single explicit document named for 8.6, but since evaluations must demonstrably occur “at planned intervals, after an incident or activation, and when significant changes occur,” evidence of these evaluations is effectively required. It is strongly recommended to maintain:

• An Evaluation Log or Report, recording evaluation dates, scope, findings, and resulting document updates