Availability of resources

What clause 5.7 says

The clause covers people, premises, technology, finance and information. It asks for choices about funding, capacity, spare copies, alternate routes and buffers, so that core services continue at a level agreed in advance. It asks the organization to select and grow people with a mix of capabilities, know-how and conduct, to notice and answer change flexibly by reshaping and moving capabilities, and to check regularly whether resources fit, can be had and are placed well. The four activities share a logic: know what the core services need, reduce dependence on a single element, keep the ability to redeploy, and review as the organization changes. Resource resilience is not the same as holding more stock. It is the ability to shift what you have to where it is needed.

Why it matters

The clause is where resilience meets the budget. A plan that requires every resource to be duplicated is unaffordable and will be cut. A plan that assumes nothing will fail is not a plan. The middle path is to identify the small number of dependencies whose loss would stop a core service, and to decide consciously how to reduce or accept each one. The clause also puts people in the resource list. Skills, knowledge and behaviour are resources that take time to develop and cannot be bought at the moment of need.

What good looks like

List the core services and the resources each depends on. Mark the single points of failure and the time to recover. For each, record the decision: reduce, duplicate, contract for, or accept with a reason. Review the list when the service, the supplier or the technology changes. Keep a redeployment plan for the people and capabilities that can move between services, and test it once a year.

Evidence a reviewer asks for

There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.

An assessor will ask what level of service the organization has decided to maintain and which single points of failure it has accepted. A list of resources without a decision is an inventory, not a plan.

• Core service resource map Each core service, its critical resources and the time to recover
• Single point of failure register The dependencies whose loss would stop a core service, with the decision taken
• Acceptable service level The predetermined level at which each core service must continue, agreed by the owner
• Redeployment plan The people and capabilities that can move between services, and the trigger
• Resource review The last review of suitability, availability and allocation, with the changes made

Where it commonly fails

• Every resource is assumed to be available because it always has been.
• The continuity plan duplicates everything and is cut at the first budget review.
• No one has decided the minimum acceptable level for a core service.

What to do before the second edition

Take one core service and trace its critical resources back to their source. Where a single supplier, site, system or person appears twice, you have found the work. Record the decision and the owner for each.

Read across

• 5.3 Understanding and influencing context
• 5.8 Development and coordination of management disciplines
• 6.2.2 Determining gaps
• 6.3.1 Methods and processes

← 5.6 Shared information and knowledge5.8 Development and coordination of management disciplines →

Full register / The dates / Free transition check