Continuity management framework criteria and standards used as audit criteria
The criteria landscape
ISO 22301 is the certifiable requirements standard. ISO 22313 provides guidance, and ISO 22300 holds vocabulary. Supporting references include business impact analysis and supply-chain guidance, ICT readiness standards, national frameworks such as NIST SP 800-34, and sector regulation. A finding cannot be raised against a "should" - only against a "shall", a policy, a contract, or a legal requirement. Certification bodies audit against the requirements standard; internal audits may use broader criteria but must say which.
Clause map
Context and scope; leadership and policy; planning including risk assessment, business impact analysis and objectives; support - resources, competence, awareness, communication, documented information; operation - BIA, risk assessment, strategies and solutions, plans and procedures, exercises and testing; performance evaluation - monitoring and measurement, internal audit, management review; improvement - nonconformity, corrective action, continual improvement.
Definitions that get tested
MTPD is the impact-based time by which an activity must be resumed - the tolerable limit. The RTO must be less than or equal to the MTPD. The RPO is the acceptable data loss measured in time. Treating a business impact analysis as a risk assessment, or an RTO as an MTPD, is the most common criteria error in the exam.
Traps
Auditing against guidance as if it were mandatory; quoting a good-practice guide as a certification requirement; accepting a plan with no exercise evidence as conforming; and auditing policy documents only, never the operating clauses.
Rule of thumb: for every requirement ask four questions - is it defined, implemented, effective, and maintained? Documented information decays, so effectiveness needs evidence dated inside the audit period.