scope:

This Standard establishes a common set of criteria for emergency management and business continuity programs.

This Standard establishes the elements of a continuous improvement process to develop, implement, maintain, and evaluate emergency management and business continuity programs that address prevention and mitigation, preparedness, response, and recovery. The elements of a continuous improvement process included in this Standard are

(a) program management;

(b) planning;

(c) implementation;

(d) evaluation; and

(e) management review.

This Standard covers programs in which the functions of prevention and mitigation, preparedness, response, and recovery are considered independently or in combinations.

The elements of programs covered by this Standard address the functions (prevention and mitigation, preparedness, response, and recovery) commensurate with the risks established by the entity's hazard identification, risk assessment, and business impact analysis.

This Standard applies to public, not-for-profit, and private entities.

In CSA Standards, "shall" is used to express a requirement, i.e., a provision that the user is obliged to satisfy in order to comply with the standard; "should" is used to express a recommendation or that which is advised but not required; "may" is used to express an option or that which is permissible within the limits of the standard; and "can" is used to express possibility or capability. Notes accompanying clauses do not include requirements or alternative requirements; the purpose of a note accompanying a clause is to separate from the text explanatory or informative material. Notes to tables and figures are considered part of the table or figure and may be written as requirements. Annexes are designated normative (mandatory) or informative (non-mandatory) to define their application.