scope:

This Standard:

a) Is a sector specific standard based on the ISO 19011: 2011 and ISO/IEC 17021:2011;

b) Provides guidance for conducting conformity assessment of the ANSI/ASIS SPC.1-2009 Organizational Resilience: Security, Preparedness, and Continuity Management Systems - Requirements with Guidance for Use standard, as well as similar risk and resilience based management system standards (e.g., ISO 22301:2012, Societal security - Business continuity management systems - Requirements; ANSI/ASIS/BSI BCM.01-2010, Business Continuity Management Standard; ISO 28000:2007, Specification for security management systems for the supply chain; ASIS/ANSI PAP.1-2012, Security Management Standard: Physical Asset Protection; etc.);

c) Provides guidance on auditing risk and resilience based management system standards for the disciplines of risk, resilience, security, crisis, continuity, and recovery management, including principles of auditing, managing the audit program, and conducting audits, as well as evaluation of competence of persons involved in the audit process;

d) Describes the process of attestation of fulfillment of the requirements of a risk and resilience based management system standard for the disciplines of risk, resilience, security, crisis, continuity, and recovery management;

e) Provides guidance on the management of audit programs, conduct of internal or external audits of the management system and risk, resilience, security, crisis, continuity, and recovery management, as well as on competence and evaluation of auditors;

f) Provides guidance for bodies providing auditing and third party certification of risk and resilience based management system standards for the disciplines of risk, resilience, security, crisis, continuity, and recovery management; and

g) Provides confidence and information to stakeholders that the requirements of standards for risk, resilience, security, crisis, continuity, and recovery management are being met.

Organizations, of all types and sizes can use the concepts and guidance of this Standard. It is recommended that organizations implementing risk and resilience based management system standards use the procedures described in this Standard in conjunction with the ISO 19011:2011 to conduct their internal audit activities.

This Standard is a guidance document and not intended as a specification for third-party certification.