ISO/TS 22318:2021
(Main)Security and resilience — Business continuity management systems — Guidelines for supply chain continuity management
Security and resilience — Business continuity management systems — Guidelines for supply chain continuity management
This document gives guidance on methods for understanding and extending the principles of business continuity embodied in ISO 22301 and ISO 22313 to the management of supplier relationships. It enables an organization to develop and document the strategy to be better prepared to manage supply chain continuity. This document is generic and applicable to all organizations. It is applicable to suppliers of products, services and resources, both upstream and downstream. Supply chain continuity management (SCCM) specifically considers the issues faced by an organization which relies on the continuity of supply of resources as well as the ability to continue delivery of its products and services. The objective of SCCM is to protect the organization’s business activities from supply chain disruption.
Sécurité et résilience — Systèmes de management de la continuité d'activité — Lignes directrices pour le management de la continuité de la chaîne d'approvisionnement
Le présent document fournit des lignes directrices sur les méthodes permettant de comprendre et d’étendre les principes de la continuité d’activité contenus dans l’ISO 22301 et l’ISO 22313 au management des relations avec les fournisseurs. Il permet à un organisme de développer et de documenter la stratégie pour être mieux préparé à manager la continuité de la chaîne d’approvisionnement. Le présent document est générique et applicable à tous les organismes. Il s’applique aux fournisseurs de produits, de services et de ressources, tant en amont qu’en aval. Le management de la continuité de la chaîne d’approvisionnement (SCCM) prend spécifiquement en considération les questions auxquelles est confronté un organisme qui s’appuie sur la continuité de l’approvisionnement en ressources ainsi que sur la capacité à poursuivre la fourniture de ses produits et services. L’objectif du SCCM est de protéger les activités commerciales de l’organisme contre les perturbations de la chaîne d’approvisionnement.
General Information
Relations
Buy Standard
Standards Content (Sample)
TECHNICAL ISO/TS
SPECIFICATION 22318
Second edition
2021-12
Security and resilience — Business
continuity management systems —
Guidelines for supply chain continuity
management
Reference number
© ISO 2021
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
Contents Page
Foreword .v
Introduction . vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 The value of supply chain continuity management . 1
4.1 The supply chain . 1
4.1.1 General . 1
4.1.2 Supply chain model . 2
4.2 Supply chain continuity management . 3
4.2.1 General . 3
4.2.2 Embedding SCCM . 4
4.2.3 Benefits and opportunities . 5
4.3 Risk ownership . . 5
4.4 SCCM ownership . 5
5 BCMS prerequisites for SCCM .6
5.1 General . 6
5.2 Obtain top management commitment . 6
5.2.1 Accountability and responsibility . 6
5.2.2 Resources for managing SCCM . 6
5.2.3 SCCM framework . 6
5.2.4 Performance evaluation programme . 7
5.3 Promulgate business continuity principles throughout the supply chain . 7
5.4 Analyse continuity requirements and assess risk . 7
5.4.1 General . 7
5.4.2 Continuity requirements. 8
5.4.3 Risk assessment . 8
6 Effective SCCM .9
6.1 General . 9
6.2 Identify strategies and solutions . 9
6.2.1 General . 9
6.2.2 Option 1 — Reduce dependency and impact . 10
6.2.3 Option 2 — Rely on the organization’s business continuity strategies and
solutions . 10
6.2.4 Option 3 — Rely on the supplier’s business continuity strategies and
solutions . 11
6.2.5 Option 4 — Do nothing and retain the risk by informed decision .12
6.3 Assess suppliers’ continuity compliance .12
6.4 Establish contractual obligations .12
6.4.1 General .12
6.4.2 Principles to establish the continuity requirements in the contract .12
6.4.3 Continuity requirements. 13
6.5 Review and update . 14
7 Maintenance, performance and continual improvement .14
7.1 General . 14
7.2 Maintenance . 14
7.3 Performance evaluation . 15
7.4 Continual improvement .15
Annex A (informative) Example of general questions to be sent to priority suppliers .17
Annex B (informative) Managing priority suppliers’ disruptions .18
iii
Annex C (informative) Examples of joint exercises with suppliers .19
Bibliography .20
iv
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO’s adherence to
the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see
www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 292, Security and resilience.
This second edition cancels and replaces the first edition (ISO/TS 22318:2015), which has been
technically revised. The main changes are as follows:
— the document has been updated to reflect changes made to ISO 22301:2019;
— the upstream and downstream relationships within the supply chain have been clarified;
— the title has been updated;
— “key points” have been deleted as their concepts are included in the clauses;
— new diagrams have been inserted;
— annexes have been inserted.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.
v
Introduction
The focus of this document is on establishing appropriate levels of continuity within an organization’s
supply chain. It assumes that the organization seeking to establish supply chain continuity management
(SCCM) is aware of the principles of business continuity. It is intended to be useful to those with
responsibility for the continuity of the supply chain for resources required by the organization to
produce and deliver its products and services. The guidelines given in this document also have relevance
when the organization is the supplier as the organization can then prepare to meet the continuity
expectations of its customers as well as consider vulnerabilities which can arise when dependent on a
single customer.
This document considers the continuity implications to the organization if its suppliers do not have
adequate continuity in place.
Organizations rely on resources to be delivered on time and at an agreed quality and cost. These include,
for example, materials, labour, information and data, workplace, facilities and associated utilities,
equipment, consumables, information communication technology (ICT) systems, transportation,
logistics, finance and other services required to support the business activities of the organization.
This is referred to as “upstream”.
Organizations also rely on being able to deliver their products and services to their customers,
whether they are the next link in the supply chain or the end customer. Product and service delivery
(e.g. transportation, logistics, implementation services, machinery installation services) is performed
by the
...
TECHNICAL ISO/TS
SPECIFICATION 22318
Second edition
2021-12
Security and resilience — Business
continuity management systems —
Guidelines for supply chain continuity
management
Reference number
© ISO 2021
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
Contents Page
Foreword .v
Introduction . vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 The value of supply chain continuity management . 1
4.1 The supply chain . 1
4.1.1 General . 1
4.1.2 Supply chain model . 2
4.2 Supply chain continuity management . 3
4.2.1 General . 3
4.2.2 Embedding SCCM . 4
4.2.3 Benefits and opportunities . 5
4.3 Risk ownership . . 5
4.4 SCCM ownership . 5
5 BCMS prerequisites for SCCM .6
5.1 General . 6
5.2 Obtain top management commitment . 6
5.2.1 Accountability and responsibility . 6
5.2.2 Resources for managing SCCM . 6
5.2.3 SCCM framework . 6
5.2.4 Performance evaluation programme . 7
5.3 Promulgate business continuity principles throughout the supply chain . 7
5.4 Analyse continuity requirements and assess risk . 7
5.4.1 General . 7
5.4.2 Continuity requirements. 8
5.4.3 Risk assessment . 8
6 Effective SCCM .9
6.1 General . 9
6.2 Identify strategies and solutions . 9
6.2.1 General . 9
6.2.2 Option 1 — Reduce dependency and impact . 10
6.2.3 Option 2 — Rely on the organization’s business continuity strategies and
solutions . 10
6.2.4 Option 3 — Rely on the supplier’s business continuity strategies and
solutions . 11
6.2.5 Option 4 — Do nothing and retain the risk by informed decision .12
6.3 Assess suppliers’ continuity compliance .12
6.4 Establish contractual obligations .12
6.4.1 General .12
6.4.2 Principles to establish the continuity requirements in the contract .12
6.4.3 Continuity requirements. 13
6.5 Review and update . 14
7 Maintenance, performance and continual improvement .14
7.1 General . 14
7.2 Maintenance . 14
7.3 Performance evaluation . 15
7.4 Continual improvement .15
Annex A (informative) Example of general questions to be sent to priority suppliers .17
Annex B (informative) Managing priority suppliers’ disruptions .18
iii
Annex C (informative) Examples of joint exercises with suppliers .19
Bibliography .20
iv
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO’s adherence to
the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see
www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 292, Security and resilience.
This second edition cancels and replaces the first edition (ISO/TS 22318:2015), which has been
technically revised. The main changes are as follows:
— the document has been updated to reflect changes made to ISO 22301:2019;
— the upstream and downstream relationships within the supply chain have been clarified;
— the title has been updated;
— “key points” have been deleted as their concepts are included in the clauses;
— new diagrams have been inserted;
— annexes have been inserted.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.
v
Introduction
The focus of this document is on establishing appropriate levels of continuity within an organization’s
supply chain. It assumes that the organization seeking to establish supply chain continuity management
(SCCM) is aware of the principles of business continuity. It is intended to be useful to those with
responsibility for the continuity of the supply chain for resources required by the organization to
produce and deliver its products and services. The guidelines given in this document also have relevance
when the organization is the supplier as the organization can then prepare to meet the continuity
expectations of its customers as well as consider vulnerabilities which can arise when dependent on a
single customer.
This document considers the continuity implications to the organization if its suppliers do not have
adequate continuity in place.
Organizations rely on resources to be delivered on time and at an agreed quality and cost. These include,
for example, materials, labour, information and data, workplace, facilities and associated utilities,
equipment, consumables, information communication technology (ICT) systems, transportation,
logistics, finance and other services required to support the business activities of the organization.
This is referred to as “upstream”.
Organizations also rely on being able to deliver their products and services to their customers,
whether they are the next link in the supply chain or the end customer. Product and service delivery
(e.g. transportation, logistics, implementation services, machinery installation services) is performed
by the
...
SPÉCIFICATION ISO/TS
TECHNIQUE 22318
Deuxième édition
2021-12
Sécurité et résilience — Systèmes
de management de la continuité
d'activité — Lignes directrices pour
le management de la continuité de la
chaîne d'approvisionnement
Security and resilience — Business continuity management systems
— Guidelines for supply chain continuity management
Numéro de référence
DOCUMENT PROTÉGÉ PAR COPYRIGHT
© ISO 2021
Tous droits réservés. Sauf prescription différente ou nécessité dans le contexte de sa mise en œuvre, aucune partie de cette
publication ne peut être reproduite ni utilisée sous quelque forme que ce soit et par aucun procédé, électronique ou mécanique,
y compris la photocopie, ou la diffusion sur l’internet ou sur un intranet, sans autorisation écrite préalable. Une autorisation peut
être demandée à l’ISO à l’adresse ci-après ou au comité membre de l’ISO dans le pays du demandeur.
ISO copyright office
Case postale 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Genève
Tél.: +41 22 749 01 11
E-mail: copyright@iso.org
Web: www.iso.org
Publié en Suisse
ii
Sommaire Page
Avant-propos .v
Introduction . vi
1 Domaine d’application . 1
2 Références normatives .1
3 Termes et définitions . 1
4 La valeur du management de la continuité de la chaîne d’approvisionnement (SCCM) .2
4.1 La chaîne d’approvisionnement . 2
4.1.1 Généralités . 2
4.1.2 Modèle de la chaîne d’approvisionnement . 2
4.2 Management de la continuité de la chaîne d’approvisionnement (SCCM) . 4
4.2.1 Généralités . 4
4.2.2 Intégration du management de la continuité de la chaîne
d’approvisionnement (SCCM). 4
4.2.3 Bénéfices et opportunités . 5
4.3 Propriété du risque . 6
4.4 Propriété du management de la continuité de la chaîne d’approvisionnement
(SCCM). 6
5 Prérequis du système de management de la continuité d’activité (SMCA) pour le
management de la continuité de la chaîne d’approvisionnement (SCCM) .7
5.1 Généralités . 7
5.2 Obtenir l’engagement de la direction générale . 7
5.2.1 Responsabilité . 7
5.2.2 Ressources pour le management de la continuité de la chaîne
d’approvisionnement (SCCM). 7
5.2.3 Cadre du management de la continuité de la chaîne d’approvisionnement
(SCCM) . 7
5.2.4 Programme d’évaluation de la performance . 8
5.3 Promulguer les principes de continuité d’activité dans l’ensemble de la chaîne
d’approvisionnement . 8
5.4 Analyser les exigences de continuité et apprécier le risque . 8
5.4.1 Généralités . 8
5.4.2 Exigences de continuité . 9
5.4.3 Appréciation du risque . 9
6 Un management de la continuité de la chaîne d’approvisionnement (SCCM) efficace .10
6.1 Généralités . 10
6.2 Identifier les stratégies et les solutions . 10
6.2.1 Généralités . 10
6.2.2 Option 1 — Réduire la dépendance et l’impact . 11
6.2.3 Option 2 — S’appuyer sur les stratégies et solutions de continuité d’activité
de l’organisme .12
6.2.4 Option 3 — S’appuyer sur les stratégies et solutions de continuité d’activité
du fournisseur . 13
6.2.5 Option 4 — Ne rien faire et conserver le risque par décision informée .13
6.3 Évaluer la conformité des fournisseurs en matière de continuité .13
6.4 Établir des obligations contractuelles . 14
6.4.1 Généralités . 14
6.4.2 Principes pour établir les exigences de continuité dans le contrat. 14
6.4.3 Exigences de continuité . . 14
6.5 Revue et mise à jour . 16
7 Maintien, performance et amélioration continue .16
7.1 Généralités . 16
7.2 Maintien . 16
iii
7.3 Évaluation de la performance . 17
7.4 Amélioration continue . 17
Annexe A (informative) Exemple de questions générales à envoyer aux fournisseurs
prioritaires .19
Annexe B (informative) Management des perturbations de fournisseurs prioritaires .21
Annexe C (informative) Exemples d’exercices conjoints avec les fournisseurs .22
Bibliographie .23
iv
Avant-propos
L’ISO (Organisation internationale de normalisation) est une fédération mondiale d’organismes
nationaux de normalisation (comités membres de l’ISO). L’élaboration des Normes internationales est
en général confiée aux comités techniques de l’ISO. Chaque comité membre intéressé par une étude
a le droit de faire partie du comité technique créé à cet effet. Les organisations internationales,
gouvernementales et non gouvernementales, en liaison avec l’ISO participent également aux travaux.
L’ISO collabore étroitement avec la Commission électrotechnique internationale (IEC) en ce qui
concerne la normalisation électrotechnique.
Les procédures utilisées pour élaborer le présent document et celles destinées à sa mise à jour sont
décrites dans les Directives ISO/IEC, Partie 1. Il convient, en particulier, de prendre note des différents
critères d’approbation requis pour les différents types de documents ISO. Le présent document a été
rédigé conformément aux règles de rédaction données dans les Directives ISO/IEC, Partie 2 (voir
www.iso.org/directives).
L’attention est attirée sur le fait que certains des éléments du présent document peuvent faire l’objet de
droits de propriété intellectuelle ou de droits analogues. L’ISO ne saurait être tenue pour responsable
de ne pas avoir identifié de tels droits de propriété et averti de leur existence. Les détails concernant
les références aux droits de propriété intellectuelle ou autres droits analogues identifiés lors de
l’élaboration du document sont indiqués dans l’Introduction et/ou dans la liste des déclarations de
brevets reçues par l’ISO (voir www.iso.org/brevets).
Les appellations commerciales éventuellement mentionnées dans le présent document sont données
pour information, par souci de commodité, à l’intention des utilisateurs et ne sauraient constituer un
engagement.
Pour une explication de la nature volontaire des normes, la signification des termes et expressions
spécifiques de l’ISO liés à l’évaluation de la conformité, ou pour toute information au sujet de l’adhésion
de l’ISO aux principes de l’Organisation mondiale du commerce (OMC) concernant les obstacles
techniques au commerce (OTC), voir www.iso.org/avant-propos.
Le présent document a été élaboré par le comité technique ISO/TC 292, Sécurité et résilience.
Cette deuxième édition annule et remplace la première édition (ISO/TS 22318:2015), qui a fait l’objet
d’une révision technique. Les principales modifications sont les suivantes:
— le document a été mis à jour afin de refléter les modifications apportées à l’ISO 22301:2019;
— les relations amont et aval au sein de la chaîne d’approvisionnement ont été clarifiées;
— le titre a été mis à jour;
— les «points clés» ont été supprimés, car leurs concepts sont inclus dans les articles et paragraphes;
— de nouveaux schémas ont été ajoutés;
— des annexes ont été ajoutées.
Il convient que l’utilisateur adresse tout retour d’information ou toute question concernant le présent
document à l’organisme national de normalisation de son pays. Une liste exhaustive desdits organismes
se trouve à l’adresse www.iso.org/fr/members.html.
v
Introduction
Le présent document se focalise sur l’établissement de niveaux de continuité appropriés au sein de
la chaîne d’approvisionnement d’un organisme. Il suppose que l’organisme qui cherche à établir un
management de la continuité de la chaîne d’approvisionnement (SCCM) a conscience des principes
de la continuité d’activité. Il est destiné à être utile aux personnes responsables de la continuité de
la chaîne d’approvisionnement pour les ressources requises par l’organisme pour produire et livrer
ses produits et fournir ses services. Les lignes directrices données dans le présent document sont
également pertinentes lorsque l’organisme est le fournisseur, car il peut alors se préparer à satisfaire
aux attentes de se
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.