Fundamental Principles and Concepts of a Business Continuity Management System
Domain 1 tests the vocabulary and logic that every later clause depends on: what a BCMS is, how it differs from emergency response or IT disaster recovery, and how BIA outputs drive strategy, plans and exercises.
Core concepts
- Business continuity is the capability to continue delivering products and services at acceptable predefined levels during and after disruption. A BCMS is the management system that establishes, implements, maintains and improves that capability.
- ISO 22301 follows the Plan-Do-Check-Act cycle: establish (Plan), operate (Do), evaluate (Check), improve (Act).
- The BIA identifies prioritised activities, dependencies and the impact of disruption over time. It sets the maximum tolerable period of disruption (MTPD) and recovery time objectives (RTOs) for activities and resources.
- Risk assessment identifies threats and vulnerabilities, evaluates likelihood and impact, and informs strategy selection.
- The minimum business continuity objective (MBCO) defines the minimum level of service acceptable during disruption; RTO must be shorter than MTPD to leave recovery margin.
- Strategies cover people, facilities, technology, data and suppliers; plans translate strategy into roles, escalation, communication and procedures; exercises validate both.
Worked example
A payment processor's BIA shows card authorisation cannot stop for more than 12 hours (MTPD). Management sets an RTO of 8 hours and an MBCO of 60% transaction throughput. The chosen strategy is a warm standby site plus manual fallback. An exercise tests failover and finds the manual procedure untested. Reasoning: the 4-hour gap between RTO and MTPD is deliberate margin; the exercise gap is evidence that the plan is not yet validated.
Traps
Confusing MTPD with RTO; treating disaster recovery as the whole BCMS; accepting a BIA with no top-management-approved priorities; assuming a plan is effective because it is documented.