Publishing and copyright information

The BSI copyright notice displayed in this document indicates when the document was last issued.

© The British Standards Institution 2022

Published by BSI Standards Limited 2022

ISBN 978 0 539 16787 0

ICS 03.100.01

The following BSI references relate to the work on this document:
Committee reference CAR/1/1
Draft for comment 22/30433159 DC

Foreword

Publishing information

This British Standard is published by BSI Standards Limited, under licence from The British Standards Institution, and came into effect on 31 August 2022. It was prepared by Subcommittee CAR/1/1, BS 65000 Organization resilience, under the authority of Technical Committee CAR/1, Continuity and resilience. A list of organizations represented on this committee can be obtained on request to the committee manager.

Supersession

This British Standard supersedes BS 65000:2014, which is withdrawn.

Information about this document

This is a full revision of the standard, which was originally published in 2014 as a guide. The revision is based on a body of evidence, from both academia and industry practice, which has emerged since then. This body of evidence shows increasing convergence in the core principles and practices that contribute to more effective organizational resilience. This includes a broader understanding of the scope of organizational resilience, addressing the organization’s wider system within which it operates and across the five dimensions of finance, operations, human, social and environment. The revision introduces the following principal changes:

the standard has been rewritten as a code of practice, which provides clear recommendations to organizations;
the scope and context of organizational resilience is clarified and is broader, incorporating the wider ecosystem and five dimensions of finance, operations, human, social and environment;
the standard considers both defensive and progressive dimensions, for continuity and adaptability;
the core cultural and design principles for organizational resilience are set out; there are four cultural and four design principles;
practices and techniques for developing organizational resilience are recommended; and
the standard considers maturity, measurement and assurance of organizational resilience, and provides an updated maturity model in Annex A.

This revised standard also builds on existing standards and frameworks that organizations might have in place, for example recognizing that business continuity is a constituent discipline that supports organizational resilience.

This publication can be withdrawn, revised, partially superseded or superseded. Information regarding the status of this publication can be found in the Standards Catalogue on the BSI website at bsigroup.com/standards, or by contacting the Customer Services team.

Where websites and webpages have been cited, they are provided for ease of reference and are correct at the time of publication. The location of a webpage or website, or its contents, cannot be guaranteed.

Use of this document

As a code of practice, this British Standard takes the form of recommendations and guidance. It is not to be quoted as if it were a specification. Users are expected to ensure that claims of compliance are not misleading.

Users may substitute any of the recommendations in this British Standard with practices of equivalent or better outcome. Any user claiming compliance with this British Standard is expected to be able to justify any course of action that deviates from its recommendations.

It has been assumed in the preparation of this British Standard that the execution of its provisions will be entrusted to appropriately qualified and experienced people, for whose use it has been produced.

Presentational conventions

The guidance in this standard is presented in roman (i.e. upright) type. Any recommendations are expressed in sentences in which the principal auxiliary verb is “should”.

Commentary, explanation and general informative material is presented in smaller italic type, and does not constitute a normative element.

Where words have alternative spellings, the preferred spelling of the Shorter Oxford English Dictionary is used (e.g. “organization” rather than “organisation”).

Contractual and legal considerations

This publication has been prepared in good faith, however no representation, warranty, assurance or undertaking (express or implied) is or will be made, and no responsibility or liability is or will be accepted by BSI in relation to the adequacy, accuracy, completeness or reasonableness of this publication. All and any such responsibility and liability is expressly disclaimed to the full extent permitted by the law.

This publication is provided as is, and is to be used at the recipient’s own risk.

The recipient is advised to consider seeking professional guidance with respect to its use of this publication.

This publication is not intended to constitute a contract. Users are responsible for its correct application.

Compliance with a British Standard cannot confer immunity from legal obligations.

Introduction

Resilience is a strategic capability for an organization. It enables an organization to:

prepare for and respond to disruption;
adapt in a timely and appropriate manner; and
thrive in a changing environment.

Organizational resilience requires an enterprise-wide approach, including assets, processes, functions, units and geographies, and involves third parties and other stakeholders. Operational resilience is a subset of organizational resilience that focuses on day-to-day delivery of products and services, whereas organizational resilience applies a strategic lens over a longer time frame and requires resilience across five categories or dimensions: environmental, social, human, built and financial. The pursuit of organizational resilience requires a consideration of the organization's role in the wider context in which it operates. Organizational resilience is an entity-wide activity. As this British Standard is aimed at the organizational level, it provides a framework in which all resilience activities, including operational, financial, environmental, reputational and human resilience, can be positioned.

Organizational resilience is both defensive and progressive, building the capacity for continuity and adaptation, innovation, learning and renewal. By applying the principles and practices of organizational resilience, organizations are better placed to take opportunities and shape the future.

Every organization is unique. The scope, scale and means by which organizational resilience is practised needs to be part of the culture and align with the priorities of the organization.

This British Standard gives recommendations and guidance to help organizations make the necessary choices to improve resilience within the context of their organization. It describes organizational resilience, articulates the benefits, and explains how it can be improved. It determines top management's responsibilities, provides guidance on organizational design for resilience, and connects with other management standards across related disciplines. It also specifies the principles, behaviours, capabilities and characteristics that enable the development, assessment and improvement of organizational resilience, and offers guidance on enabling a culture that supports learning and adaptation.

In periods of significant uncertainty, adversity or disruption, highly resilient organizations secure strategically better outcomes than less resilient ones, notably in respect of:

adapting to avoid harm or loss and exploiting opportunities as the organization’s environment changes;
reduced likelihood of significant disruption, potentially making the difference between survival and failure;
lower impacts when disruption does occur;
protected reputation and brand value through a demonstration of business and social responsibility under adversity;
faster recovery: the return to full operations is quick and confident; and
stronger renewal: adapting or transforming following disruption to achieve a secure basis for the future and greater influence within the wider community.

Highly resilient organizations also achieve benefits outside of periods of significant uncertainty, adversity or disruption, which include:

advantage through better situational awareness, agility, learning and innovation;
reliability and speed of response and recovery in the face of lower level disruption;
alignment with stakeholder and societal expectations of continuity and responsiveness, building and protecting reputation and brand value;
greater confidence and a culture of flexibility, adaptability and innovation; and
greater assurance to, and trust from, other organizations.

Highly resilient organizations demonstrate a mindset of continual improvement, building and developing structures, adaptive ways of working and a culture that embeds the principles set out in this British Standard.

In some cases, organizations are required to formally report periodically on their resilience activities. Reporting systems can vary but the goals of assurance, confidence and effective internal controls always apply. Demonstrating effective governance through reporting systems encourages continual improvement, drives corporate health checks and promotes organizational resilience agendas.

Regular and effective reporting on organizational resilience demonstrates good stewardship, effective oversight and responsive foresight. It builds a foundation of trust and integrity, and drives cultural and stakeholder awareness of resilience as a demonstrated and strategic imperative for the organization.

1 Scope

This British Standard provides recommendations and guidance to organizations of all sizes and types on developing organizational resilience that:

determines the responsibilities of top management and clarifies the nature, scope and context of organizational resilience appropriate for the organization;
identifies the natural/environmental, social, human, built and financial capitals as core elements of organizational resilience;
specifies the principles, behaviours, capabilities and characteristics that enable the development, assessment and improvement of organizational resilience;
enables the organization to deliver against objectives;
identifies dependencies, including the impact of external relationships and contextual influences on organizational resilience;
supports the development of adaptive capacity and a learning culture; and
connects other management standards and other activities and resources to efficiently and cost‑effectively build and maintain organizational resilience capabilities.

This British Standard brings coherence to the approach necessary to build and sustain organizational resilience. It does not aim to limit or constrain thinking but is intended to guide an organization in making the unique and necessary choices to achieve organizational resilience in the context of the organization and respond to the wider changes and uncertainty facing society.

2 Normative references

3 Terms and definitions

4 Guiding principles

5 Practices of organizational resilience

5.1 Establishing the context for organizational resilience

5.2 Developing organizational resilience

5.3 Stress testing organizational resilience

5.4 Embedding resilience

5.5 Organizational learning

5.6 Organizational structure change

5.7 Governance for resilience

5.8 Resilience reporting

6 Maturity and measurement in resilience

6.1 Relativity and benchmarking

6.2 The concepts of maturity and measurement

6.3 Maturity

6.4 Measurement

6.5 Assurance

7 Management review

Bibliography

BS 65000:2022

Organizational resilience. Code of practice

Current

Published:

31 Aug 2022