SI 24001: Organizational resilience management system (ORMS) – Requirements and guidance for use

Israeli Standard SI 24001: Organizational resilience management system – Requirements and guidance for use will help organizations preparedness for dealing with emergencies or irregular situations. The standard integrates risk and threat analysis as a basis for preparing management plans. On the basis of this analysis, the organization must draw a preparedness plan. The 9/11 attacks in the US in 2001 was the wakeup call about the vulnerability of infrastructures to a terrorist attack or powerful natural disaster, such as earthquakes, hurricanes, and tsunamis. For the global economy to survive, every organization must be ready and plan its business continuity before such a crisis hits.

It is important to identify and assess the threats and to adapt, plan, and execute actions to mitigate them in order to maintain production and customer service continuity.

SI 24001 is applicable to organizations of every size and type, which seek to –

• Strengthen their security resilience, improve operational continuity, and protect critical assets
• Establish, realize, maintain, and improve the security resilience management system
• Ensure the upholding of a declared security resilience policy
• Prove to others that the security resilience policy exists
• Obtain a commitment to comply with the standard

Establishment of security resilience management and continuity system pursuant to SI 24001 will enable an organization to –

• Identify risks and threats to the organization and prepare for them
• Identify and management threat mitigation policies
• Identify, examine, and management continuity alternatives
• Meet market, customer, and government demands
• Reduce costs from the loss of resources and suspension of operations

Standards Institution of Israel auditors help identify whether the organization's security resilience and continuity system is in compliance with the requirements of the standard and suggest points in need of improvement in order to obtain SI 24001 certification.

SI 24001 may be implemented together with the current management standards, as follows:

• SI ISO 9001: quality management systems certified organizations – this standard does not include specifications for catastrophic events that are liable to shut down production. SI 24001 certification will complete the preparedness for such events.
• SI ISO 14001: Environmental management system, SI ISO 45001/OHSAS 18001: Occupational health and safety, and SI ISO 22000: Food safety management certified organizations – these standards only cover accidents, not malicious events. SI 24001 certification will complete preparedness for malicious events.
• SI ISO 27001: Information security management certified organizations – the standard only covers information security. SI 24001 certification will complete preparedness for other threats against the organization. The standard deals with the organization's supplementary actions to security events and business continuity.

Road to certification

Certification follows the successful implementation an organization's in-house organizational resilience and business continuity management systems pursuant to the requirements of the standard. To start this process, it is recommended to purchase the standard at the Standards Institution of Israel Information Center, study the requirements, and participate in appropriate training. It is also possible to consult with outside experts and undergo a preliminary audit by Standards Institution of Israel to check for shortcomings.

The process ought to be seen as an opportunity for improvement via the organization team which will receive management commitment and involvement. At the end of the process, independent Standards Institution of Israel auditors will perform an audit that confirms that the organization's organizational resilience and business continuity management are compatible to the specifications of the standard.