ISO 22301 requirements for a business continuity management system
This domain tests the mandatory requirements of ISO 22301:2019, organized in clauses 4 to 10. The exam focuses on what an organization "shall" do, the sequence of operational activities, and the evidence an auditor would expect. You do not need to memorize every sub-clause, but you must know the logic and the outputs of the core processes.
Clause structure and intent
Clauses 4-7 establish the management system: context of the organization (4), leadership (5), planning (6) and support (7). Clauses 8-10 deliver and improve it: operation (8), performance evaluation (9) and improvement (10). This follows the harmonized structure used by many ISO management system standards.
Operation: the examined core
- 8.2 Business impact analysis and risk assessment: BIA first identifies prioritized activities and their MTPDs, dependencies and resources; risk assessment then identifies and evaluates risks to those activities. Outputs feed strategies.
- 8.3 Business continuity strategies and solutions: select and document strategies to protect prioritized activities, stabilize, continue and recover; consider people, information, technology, suppliers and facilities.
- 8.4 Plans and procedures: documented response structure, warnings, roles, communications and recovery.
- 8.5 Exercise programme: plans are exercised and tested on a schedule, with results reviewed and actions taken.
- 8.6 Evaluation: evaluate continuity performance and the effectiveness of strategies and plans.
Worked example
An auditor asks for evidence that recovery priorities are justified. The organization presents a risk register listing malware, fire and supplier failure, but no BIA. This is a nonconformity against 8.2 because risk assessment cannot substitute for BIA: the BIA establishes which activities are prioritized and their MTPD/RTO, and the risk assessment should address risks to those prioritized activities. The correct sequence is BIA, risk assessment, then strategies and plans.
Traps
MTPD is the point of intolerable harm, not the target recovery time; RTO must sit inside MTPD. A plan that has never been exercised does not satisfy 8.5. Management review (9.3) and corrective action (10.2) are requirements, not optional good practice. "Shall" requirements are auditable; "should" guidance is not. Do not treat the BCMS as IT-only.