Implementing a BCMS Based on ISO 22301
Operation clauses
Implementation is clause 8: operational planning and control, BIA, risk assessment, continuity strategies and solutions, plans and procedures, exercise and testing, and evaluation of continuity documentation. Candidates must know that these are ongoing operational processes, not one-off projects. A frequent trap is treating the BIA as a document produced once; it must be reviewed at planned intervals and after significant change.
Plans and procedures
Plans must be structured to respond to disruptions, and include roles, communication, escalation and recovery arrangements consistent with the BIA. Procedures must be usable under stress-clear triggers, decision authority and contact arrangements. Traps include plans that restate the BIA without actionable steps, and plans that omit interdependencies and suppliers.
Exercise and testing
The standard requires exercising and testing at planned intervals, with results reviewed. Exercises should be proportionate and progressively challenging: plan walkthrough, simulation, then live or failover tests. A common exam trap is confusing a test (verifying a specific element works) with an exercise (rehearsing response). Records of exercises and the actions arising are the evidence auditors seek.
Evaluation of documentation
Continuity plans and procedures must be evaluated and updated when significant change occurs. Change triggers include organizational restructuring, new critical suppliers, new technology and lessons from incidents.
Worked example
A payments provider runs a tabletop exercise for a supplier outage; the exercise reveals an outdated escalation number. The corrective action is logged, the plan updated, and a follow-up test of the alternate supplier is scheduled. This demonstrates exercise, evaluation and improvement in one loop.
Rule of thumb
An untested plan is an assumption. Evidence of exercise plus resulting action is stronger than a polished document.