ISO 22301 LI cheat sheet

Business continuity is the capability of an organization to continue delivery of products or services at acceptable predefined capacities during a disruption.

A BCMS is a management system (policy, objectives, processes) that establishes, implements, operates, monitors, reviews, maintains and improves business continuity.

ISO 22301 follows the Harmonized Structure: Plan-Do-Check-Act applied to context, leadership, planning, support, operation, performance evaluation and improvement.

Terms: disruption = anticipated or unanticipated event that causes unplanned negative deviation; incident = event that may lead to disruption; crisis = unstable condition involving major consequences.

Maximum Acceptable Outage (MAO) or Maximum Tolerable Period of Disruption (MTPD) is the time frame within which a product/service/resource must be resumed to avoid unacceptable impacts.

Recovery Time Objective (RTO) is the target time to restore a product, service or resource after disruption; RTO must be less than or equal to the MTPD.

Recovery Point Objective (RPO) is the maximum acceptable data loss measured in time; Minimum Business Continuity Objective (MBCO) is the minimum acceptable level of service during disruption.

Business impact analysis (BIA) quantifies impacts over time and identifies prioritized activities, dependencies and resources; risk assessment identifies threats, vulnerabilities and likelihood.

BCMS scope states the products, services, locations and boundaries covered; the organization must determine internal/external issues and interested party requirements.

Initiation begins with top management commitment: a policy, defined roles, and a decision on the scope of the BCMS.

Context analysis (Clause 4) identifies internal/external issues, interested parties and their relevant requirements, and determines BCMS scope and processes.

Gap analysis compares current practices against ISO 22301 requirements to produce an implementation roadmap and prioritization.

Leadership (Clause 5) requires a business continuity policy, organizational roles/responsibilities/authorities, and integration with business processes.

A steering committee or sponsor with authority to allocate budget, staff and time is a prerequisite for initiation.

Implementation planning must address resources, competence, awareness, communication and documented information needed by the BCMS.

Legal, regulatory and contractual requirements (e.g., sector continuity obligations) must be identified at initiation and fed into scope and objectives.

A business case links continuity capability to stakeholder value, regulatory compliance and risk exposure to secure funding.

Clause 6 requires actions to address risks and opportunities, business continuity objectives with plans to achieve them, and planning of changes.

BC objectives must be measurable, monitored, communicated, and updated; plans specify what, who, when, resources and how results are evaluated.

The BIA determines prioritized activities, their MTPD/MAO, dependencies and required resources; the risk assessment determines threats and treatment.

Business continuity strategies and solutions are selected to protect prioritized activities before, during and after disruption, considering cost and residual risk.

Business continuity plans include incident response structure, warning/communication, activation criteria, roles, resource requirements and interdependencies.

Exercise programmes and maintenance plans are planned up front, including scope, type, objectives, schedule and post-exercise review.

Documented information plan defines what records are required, by whom, in what format, and retention/control rules.

Implementation plan sequencing typically follows: context/scope, BIA and risk assessment, strategy, plans, exercising, then performance evaluation.

Operation (Clause 8) requires business impact analysis, risk assessment, BC strategies and solutions, plans and procedures, and exercise/testing.

BIA output includes prioritized activities, impact criteria, MTPD, and resource/dependency requirements; risk assessment output includes risk register and treatment.

BC plans must be documented, communicated to relevant personnel, and include activation criteria, escalation, and communication with interested parties.

Exercise programme tests plans, identifies gaps, and builds competence; exercises may be discussion-based (tabletop) or operations-based (simulation, full-scale).

Support (Clause 7) covers resources, competence, awareness, communication and documented information; competence must be evidenced.

Incident response structure defines roles such as crisis management team, incident manager, communications lead and recovery teams.

Communication planning includes internal, external and media communication, with pre-agreed messages and contact lists.

Training and awareness ensure personnel understand the policy, their role in disruption, and how to report incidents.

Clause 9 requires monitoring, measurement, analysis and evaluation, internal audit, and management review.

Monitoring and measurement must define what is measured, methods, when, by whom, and when results are analyzed and evaluated.

Internal audits must be planned at intervals, use defined criteria and scope, be conducted by objective auditors, and report results to management.

Management review inputs include audit results, monitoring results, nonconformities, corrective actions, risks/opportunities, and interested party feedback.

Management review outputs include decisions on improvement opportunities, changes to the BCMS, and resource needs.

Performance indicators may include RTO achievement, exercise completion rate, plan update currency, and incident response times.

Nonconformity and corrective action (Clause 10) requires reaction, root cause analysis, action to eliminate cause, and review of effectiveness.

Evaluation determines whether the BCMS is effective, adequate and suitable, and whether objectives are being met.

Continual improvement (Clause 10) requires improving the suitability, adequacy and effectiveness of the BCMS.

Corrective actions must address the cause, be proportionate to the effect, and be verified for effectiveness.

Lessons learned from exercises, incidents and audits feed improvement actions and updates to BIA, risk assessment and plans.

Improvement is a PDCA cycle: results of evaluation and review drive changes to policy, objectives, plans and controls.

Documented information must be retained as evidence of nonconformities, corrective actions and improvement outcomes.

Change management ensures BCMS changes are planned and controlled so continuity capability is maintained.

Maturity models can be used to assess progression from ad hoc to optimized continuity capability.

Post-incident reviews and exercise debriefs identify root causes and improvement opportunities for plans and strategies.

Certification audits are performed against ISO 22301 by accredited certification bodies; the audit has two stages: Stage 1 (documentation/readiness) and Stage 2 (implementation effectiveness).

Stage 1 verifies scope, policy, objectives, documented information and readiness for Stage 2; Stage 2 evaluates implementation and effectiveness.

Audit evidence includes records of BIA, risk assessment, plans, exercises, internal audits, management reviews and corrective actions.

Nonconformities are classified as major (systemic/failure to meet requirement) or minor; major nonconformities must be corrected before certification.

Certification is valid for three years with surveillance audits (typically annually) and a recertification audit before expiry.

Pre-audit preparation includes internal audit, management review, closing nonconformities, and ensuring documented information is current and controlled.

Auditors sample evidence; traceability from policy and objectives to BIA, plans, exercises and improvement actions should be demonstrable.

Audit scope and boundaries must be clearly defined and consistent with the BCMS scope statement; exclusions must be justified.

The certification body issues a certificate stating scope, standard, and validity; the organization must maintain the BCMS between audits.