Management: Risk, resilience and legal¶
Business continuity¶
Rules found in this domain: P73, P47.
Illustrative, not evidence.
Scenario. A payroll team sets a recovery time objective of 3 days. The maximum tolerable disruption is 5 days. If staff are short, optional reports stop first, and payroll continues.
Incident and crisis management¶
Rules found in this domain: P30, P79, P76, P37.
Illustrative, not evidence.
Scenario. A company faces a data outage. One incident commander leads. Group leads manage teams of about five. There is one crisis channel. If the commander is absent, a named deputy takes over.
- P30: There is one accountable incident commander. Each person reports to one person for a given task.
- P79: The commander directs a few group leads, not all responders. Each lead directs about five people.
- P76: Communication during the crisis is limited to the response, in one crisis channel.
- P37: The plan defines in advance what happens when the commander is absent: a deputy and a transfer of command.
Information security management¶
Rules found in this domain: P36, P78.
Illustrative, not evidence.
Scenario. A company limits each employee's access to the data their role needs. It keeps a register of its information assets with owners.
Data protection¶
Rules found in this domain: P36, P24, P11.
Illustrative, not evidence.
Scenario. A company collects customer data. Only the customer service team can see it. When a collection starts, each data set gets a purpose, a retention period and a deletion date. Changes to records keep the original entry.
Records management and accounting¶
Rules found in this domain: P11.
Illustrative, not evidence.
Scenario. A finance team corrects a booking error. It does not overwrite the old entry. It adds a new entry with the author, the date and the reason.
- P11: Changes keep the original entry visible and record who, when and why. A sample shows the full change history.
Litigation and investigations¶
Rules found in this domain: P83.
Illustrative, not evidence.
Scenario. An employee files a complaint about a dismissal. The company expects a legal dispute. It stops routine deletion of the related emails and chat channels, and records who handles them.
- P83: Litigation is reasonably anticipated. Routine deletion stops and the relevant records are preserved before anyone changes them, with a record of who handled the evidence.
Occupational health and safety¶
Rules found in this domain: P38.
Illustrative, not evidence.
Scenario. A warehouse has forklifts and walkers on the same aisle. A sign tells walkers to take care. The forklifts must use the aisle, so the hazard cannot be removed. The safety manager adds a walkway behind a fixed barrier instead of relying on the sign, and records why elimination was not possible.
- P38: The manager uses the highest possible control level. Elimination is not possible, and the record says why. A walkway behind a fixed barrier is an engineering control that does not depend on how walkers behave. A sign is an administrative control, which ranks lower.
Environmental management¶
Rules found in this domain: P3.
Illustrative, not evidence.
Scenario. A company reviews its energy and waste each quarter alongside the budget. It also looks at the impact of its purchases over their whole life.
- P3: Resource use is measured and reviewed. Environmental impact is part of decisions across the whole life cycle.
Organizational accident research¶
Rules found in this domain: P82.
Illustrative, not evidence.
Scenario. A hospital sees three projects in a row miss their deadline by two weeks. Nobody was harmed. A review treats it as a pattern, not as normal.
- P82: The deviation is recorded and investigated even though nothing went wrong. It is not accepted as normal before the cause is known.