When developing any measurement system, the foundational step is to define its purpose and methodology. This involves establishing clear objectives (the aims of the activity) and a structured approach for gathering and interpreting data (how information will be collected and assessed). This ensures the measurement process is focused, consistent, and yields meaningful, actionable insights into the organization's Business Continuity culture. Without this clarity, any data collected would lack context and be difficult to evaluate reliably, rendering the entire exercise ineffective. This aligns with the core management system principle of 'Plan-Do-Check-Act'.

A. Requiring all personnel to respond is an implementation tactic, not a foundational design principle, and may not be feasible or necessary for an accurate assessment.

C. Using outcomes to inform solutions is a subsequent step; the primary focus during development is on creating an accurate and reliable measurement system itself.

D. The goal is an objective assessment to drive improvement; presenting outcomes only in a positive way is unethical and undermines the purpose of the measurement.

1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.

Clause 9.1, "Monitoring, measurement, analysis and evaluation," states that the organization must determine "a) what needs to be monitored and measured" (the aims) and "d) how the results will be analysed, evaluated and documented" (how it will be assessed). This directly supports defining aims and methods as a primary step.

2. Business Continuity Institute (BCI), Good Practice Guidelines (GPG), 2018 Edition.

Section 8.4, "Reviewing the BCM Programme," emphasizes that any review activity "should have a clear scope and objectives" before it is undertaken. This principle of defining the aims is fundamental to developing a system for measuring a specific component like culture (p. 138).

3. ISO 22313:2020, Security and resilience — Business continuity management systems — Guidance on the use of ISO 22301.

Section 9.1, "Monitoring, measurement, analysis and evaluation," provides guidance that reinforces the need to establish what will be measured and how. It notes the importance of selecting appropriate methods to ensure the results are valid, which directly relates to how information is collected and assessed.