ISO 22301 scope

“An IT services organisation having contracts with customer for both onshore and Offshore work. The BCP that organisation has is primarily focused on the services being rendered from Offshore sites.” My questions are

1 - Does Onshore work also need to be cover? I have always been of the opinion it should not as service organisation does not have control on resources of Client onsite locations. Please clarify

Answer: According ISO 22301, the decision to include or not a service or process in the business continuity scope is up to the organization, that has to consider:
- its business objectives;
- legal requirements and contracts it has to fulfil;
- costs involved in implementing business continuity;
- potential losses related to disruptive events; and
- that any exclusion made will not affect the organization's ability and responsibility to ensure business and operations continuity.
So, if after considering all these issues you find no reason to include your Onshore work op eration on the BCMS scope, it does not need to be covered by the business continuity management system,

2 - When client facility or network not available there is a possibility of Service organisation losing revenue due to the disaster at Client location. This has billing impact on service organisation. What is the way forward for such situation?

Answer: If I understood well, you're asking what kind of business continuity strategy to develop if your client has a disruption - since you are completely dependent on this client in such case, the best strategy is not to have only a few big clients, but several smaller clients. That way you will decrease the risk of drop in revenue if one client is affected by a disaster.