ASIS ORM.1-2017

ASIS ORM.1-2017 emphasizes a proactive, forward-looking approach to risk that supports the pursuit of business objectives and opportunities, as well as a process for prevention, protection, preparedness, readiness, mitigation, response, continuity, and recovery from undesirable and disruptive events. By fully integrating risk management processes throughout enterprise-wide business management activities, organizations will be empowered to make informed decisions based on best available information.

The Standard looks to eliminate "siloing" of risk by using a management systems approach that provides a holistic framework to develop and implement policies, objectives, and programs that consider:

• Context of the organization and its supply chain
• Legal, regulatory, and contractual obligations and voluntary commitments
• Needs of internal and external stakeholders
• Uncertainties in achieving its objectives
• Protection of human, tangible, and intangible assets.

The ORM.1 replaces two legacy ASIS standards that had been up for review: the ANSI/ASIS Organizational Resilience: Security, Preparedness and Continuity Management Systems (SPC.1) and ANSI/ASIS/BSI Business Continuity Management Standard (BCM.1).