What should be avoided in the business continuity policy?

An organization has implemented controls to prevent the unauthorized disclosure of documented information required by the BCMS. Is this in compliance with ISO 22301?

Scenario:

Marketiser, a marketing company in Florida specializing in branding, advertising, market research, and design services, primarily serves small and medium-sized enterprises. After a devastating hurricane caused severe flooding and rendered its office unusable, Marketiser decided to implement a BCMS based on ISO 22301 to handle such disruptions.

The company formed a project team of four members from various departments and appointed Danielle as the project manager. Danielle conducted a comprehensive business impact analysis (BIA) focusing on activities related to data loss and backup recovery, recognizing the critical importance of safeguarding digital assets. She set specific recovery objectives, including a one-day recovery point objective (RPO) and a two-day recovery time objective (RTO).

Based on the BIA outcomes, the team chose a business continuity strategy that involved relocating preconfigured trailers with essential hardware and connectivity to an alternate site. Considering Marketiser's vulnerability to hurricanes, the strategy allowed swift activation and relocation with minimal lead time. To validate their strategy, Danielle and the team conducted real-time recovery exercises, testing their ability to restore data and resume critical operations within the defined RTO.

Danielle and the implementation team conducted a business impact analysis (BIA) for all activities related to data loss and backup recovery. Is this acceptable?

An organization is being audited by an independent organization to ensure conformity to the specified criteri

a. What type of audit is the organization conducting?

What is the purpose of an audit follow-up?