Most resilience policies are either a mission statement with a logo or a forty-page plan wearing a policy’s name tag. Bryan Strawser of Bryghtpath recently reviewed a global company’s business continuity policy that failed four of ISO 22301’s six requirements. Nowhere did it require anyone to exercise anything.
In this episode, Bryan explains what a resilience policy actually is: the three-to-five-page charter that gives your entire program its authority. He walks through the seven elements that belong in it, from scope and executive commitment to program requirements, framework alignment, and reporting. He also covers the four most common ways policies go wrong, including the missing exercise requirement and the wrong signature.
Bryan closes with a three-step playbook you can run this week. Read your policy cold, check it against ISO 22301 Clause 5.2, and search it for the word “exercise.” Get the policy right and everything else in your program has something to stand on.
