ASIS

SPC.1-2009 Organizational Resilience

American National Standards Institute, Inc. (ASIS)

ASIS SPC.1-2009, Organizational

Resilience: Security, Preparedness,

and Continuity Management
Systems
Approved March 12, 2009

Preparation by Prep4Audit, LLC

ASIS SPC.1-2009 Organizational Resilience

ASIS: Organizational Resilience: Security, Preparedness, and Continuity

Management Systems
4.1.0.0 GENERAL REQUIREMENTS .....................................................................................................................................................4
4.1.1.0 SCOPE OF OR MANAGEMENT SYSTEM ................................................................................................................................................ 4
4.2.0.0 ORGANIZATIONAL RESILIENCE (OR) MANAGEMENT POLICY ..................................................................................................6
4.2.1.0 POLICY STATEMENT......................................................................................................................................................................... 6
4.2.2.0 MANAGEMENT COMMITMENT .......................................................................................................................................................... 7
4.3.0.0 PLANNING .............................................................................................................................................................................9
4.3.1.0 RISK ASSESSMENT AND IMPACT ANALYSIS............................................................................................................................................ 9
4.3.3.0 OBJECTIVES, TARGETS, AND PROGRAM(S) ......................................................................................................................................... 10
4.4.0.0 IMPLEMENTATION AND OPERATION ................................................................................................................................... 13
4.4.1.0 RESOURCES, ROLES, RESPONSIBILITY, AND AUTHORITY......................................................................................................................... 13
4.4.2.0 COMPETENCE, TRAINING, AND AWARENESS....................................................................................................................................... 14
4.4.3.0 COMMUNICATION AND WARNING ................................................................................................................................................... 15
4.4.4.0 DOCUMENTATION......................................................................................................................................................................... 16
4.4.5.0 CONTROL OF DOCUMENTS.............................................................................................................................................................. 16
4.4.6.0 OPERATIONAL CONTROL ................................................................................................................................................................ 17
4.4.7.0 INCIDENT PREVENTION, PREPAREDNESS, AND RESPONSE ...................................................................................................................... 18
4.5.0.0 CHECKING (EVALUATION) .................................................................................................................................................... 22
4.5.1.0 GENERAL..................................................................................................................................................................................... 22
4.5.2.0 MONITORING AND MEASUREMENT .................................................................................................................................................. 22
4.5.3.0 EVALUATION OF COMPLIANCE AND SYSTEM PERFORMANCE .................................................................................................................. 22
4.5.4.0 NONCONFORMITY, CORRECTIVE ACTION, AND PREVENTIVE ACTION ....................................................................................................... 23
4.5.5.0 CONTROL OF RECORDS .................................................................................................................................................................. 24
4.5.6.0 INTERNAL AUDITS ......................................................................................................................................................................... 24
4.6.0.0 MANAGEMENT REVIEW ....................................................................................................................................................... 26
4.6.1.0 GENERAL..................................................................................................................................................................................... 26
4.6.2.0 REVIEW INPUT ............................................................................................................................................................................. 26
4.6.3.0 REVIEW OUTPUT .......................................................................................................................................................................... 27
4.6.4.0 MAINTENANCE ............................................................................................................................................................................. 27
4.6.5.0 CONTINUAL IMPROVEMENT ............................................................................................................................................................ 27

Preparation by Prep4Audit, LLC