1. ISO 22301:2019, Security and resilience — Business continuity management systems — Requirements.
Clause 8.2.2 (Business impact analysis): This clause requires the organization to "identify the activities that support the provision of its products and services" and "assess the impacts over time of not performing these activities." When a new product or service is developed, this clause necessitates an assessment to understand its resilience requirements, which directly informs senior management decisions.
2. ISO 22313:2020, Security and resilience — Business continuity management systems — Guidance on the use of ISO 22301.
Section 8.2.2 (Guidance on Business impact analysis): This guidance document clarifies that the BIA should be used to "quantify and qualify the impacts of a disruption on its products and services" and that this "information is essential for top management when making strategic decisions about priorities for business continuity." This directly links the assessment of products/services to executive decision-making.
3. Herbane, B. (2019). Rethinking organizational resilience and strategic renewal in SMEs. Entrepreneurship & Regional Development, 31(5-6), 476-495.
DOI: https://doi.org/10.1080/08985626.2018.1541594
This academic paper discusses how organizational resilience involves strategic foresight and renewal, which includes evaluating new business opportunities (such as new products/services) for their potential impact on the organization's overall resilience. This supports the concept of a formal assessment process for new developments.