ally checked and measured to help understand the deviations against specified results. This phase was also later changed to Study to help understand that the phase is not just about measuring, but more about understanding the results. Act: Where corrective actions are taken to help act on the significant differences between expected and actual results. This should encompass an understanding of the root causes for the deviations so the corrective actions are both remedial and preventive in nature. The guidelines necessary to determine the framework for requirements for a BCMS are: Understanding the organization's needs and the necessity for establishing business continuity management policy and objectives Implementing and operating controls and measures for managing an organization's overall capability to manage disruptive incidents Monitoring and reviewing the performance and effectiveness of the BCMS Continual improvement based on objective measurement Having introduced components of the BCMS, let's look at the actual requirements of the BCMS as defined by the ISO standard(http://pecb.org/iso22301/iso22301_whitepaper.pdf).1 The context of the organization should include: A thorough understanding of the products, services, partners, channels, and relationships to understand the impact of an event that could challenge business continuity. The corporate policy of the organization determines the values chosen by the organization to help drive its goals and objectives. The business continuity policy (BCP) determines the necessary requirements for business continuity that are acceptable to the organization. A strategic alignment between the corporate policy and the BCP is vital for the success of the BCMS. A risk assessment gives information about the risk appetite of the organization, as to what levels of risk it is comfortable with. Identify the relevant stakeholders and their needs and expectations from the BCMS to complete the understanding of the context. Impacts or constraints imposed by any regulatory bodies fo