Planning a BCMS Implementation Based on ISO 22301
Planning requirements
Clause 6 covers actions to address risks and opportunities, continuity objectives, and planning of changes. Candidates must distinguish risk and opportunity (management-system level, clause 6.1) from the risk assessment that supports continuity strategies (clause 8.2). A classic trap: assuming the 6.1 risk process and the 8.2 disruption risk assessment are the same activity-they are related but distinct.
Objectives
Continuity objectives must be measurable, monitored, communicated and updated, and must specify what will be done, resources, responsibility, timeframe and evaluation. Vague objectives ("improve resilience") fail the requirement. Questions often ask which element is missing from a stated objective; check measurability and accountability.
BIA and risk assessment as planning inputs
The BIA identifies prioritized activities, dependencies, impacts over time, MTPDs and recovery priorities. The risk assessment identifies threats, vulnerabilities and likelihood/consequence for those prioritized activities. Together they drive strategy selection. Traps include performing a BIA without top-management-agreed impact criteria, and selecting strategies before knowing recovery priorities.
Strategy and solutions
Strategies must be selected for people, information, facilities, suppliers and technology, then evaluated for feasibility and residual risk. A frequent exam trap is choosing a strategy that meets RTO on paper but is unaffordable or untested.
Worked rule of thumb
Plan backwards from impact: impact criteria → prioritized activities → MTPD → RTO → strategy → resource plan. If any step is skipped, the resulting plan is unsupported.
Documentation planning
Planning should identify the documented information needed (BIA report, risk assessment, strategies, plans, exercise records) and who approves it.