PECB ISO 22301 Foundation cheat sheet

Business continuity (BC) is the capability of an organization to continue delivery of products or services at acceptable predefined levels following a disruptive incident; ISO 22301 is the requirements standard for a BCMS and is certifiable, unlike ISO 22313 (guidance).

BCMS = management system (policy, objectives, processes, roles, documented information) applied to continuity; it follows the Plan-Do-Check-Act cycle: Plan (establish), Do (implement and operate), Check (monitor and review), Act (maintain and improve).

ISO 22301 uses the Harmonized Structure (Annex SL): Clauses 4 Context, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement; Clauses 4-10 are the auditable requirements.

Key terminology distinctions: a disruption is an event that causes unplanned negative deviation; an incident is an event that might lead to disruption; a crisis is an unstable condition involving broad strategic impact requiring urgent action.

BIA (business impact analysis) identifies activities supporting products/services and assesses the impact over time of their disruption; it determines prioritized activities, impact tolerances and RTOs, and is distinct from risk assessment, which estimates likelihood and consequence of threats.

Recovery time objective (RTO) = target time to resume activity or resource after disruption; maximum acceptable outage (MAO)/maximum tolerable period of disruption (MTPD) = the point beyond which impacts become unacceptable; RTO must be shorter than MTPD.

Continuity strategies and solutions are selected to protect prioritized activities and meet RTOs; they include resource redundancy, alternate sites, manual workarounds, and supply-chain alternatives, and are validated by exercising and testing.

BC is risk-based and impact-based, applies to all organization sizes and sectors, and covers products, services, supply chain, and dependencies; certification audits assess conformity to ISO 22301 requirements, not to ISO 22313 guidance.

Clause 4: determine external and internal issues, interested parties and their relevant requirements, and the BCMS scope; the scope statement must be documented and available, and the BCMS must be established within that scope.

Clause 5: top management must demonstrate leadership by establishing BC policy and objectives compatible with strategic direction, ensuring integration into business processes, providing resources, and assigning BC responsibilities and authorities.

Clause 6: planning addresses risks and opportunities, BC objectives at relevant functions and levels (measurable, monitored, communicated, updated), and planning of changes; documented information must be retained as evidence.

Clause 7 support: resources, competence of persons doing BC work (with retained evidence), awareness, communication (internal/external, including what and when to communicate), and documented information control (creation, update, distribution, protection, retention).

Clause 8 operation sequence: business impact analysis and risk assessment (8.2) -> continuity strategies and solutions (8.3) -> plans and procedures (8.4) -> exercise programme (8.5) -> evaluation of BC documentation and capabilities (8.6).

BIA and risk assessment outputs must be systematic, updated at planned intervals or on significant change, and retained as documented information; they identify prioritized activities, dependencies, and threats with risk treatment options.

Continuity plans and procedures must include roles and responsibilities, communication, escalation and notification, and recovery steps; they must be exercised at planned intervals and reviewed, with results retained as documented information.

Clause 9: monitor, measure, analyze and evaluate BC performance; conduct internal audits at planned intervals; management review must consider inputs (audit results, BIA/risk status, exercise results, nonconformities) and produce decisions on improvement and resources.

Clause 10: handle nonconformities and corrective actions (react, evaluate cause, implement action, review effectiveness, update risks), retain documented information, and continually improve the BCMS's suitability, adequacy and effectiveness.