ISO 22301 BIA to Recovery Strategy Workflow

Before interviewing teams, confirm which parts of the organization and which products and services are inside the business continuity management system. Document and explain exclusions. They cannot reduce the organization's ability or responsibility to provide continuity as determined by the BIA or risk assessment and applicable legal or regulatory requirements.

The BCMS owner should confirm the scope with top management and relevant product or service owners before process owners supply BIA data. Define impact types and scoring criteria before the BIA workshop. Typical criteria include customer harm, safety, regulatory exposure, revenue loss, contractual breach, operational backlog, reputation, data loss, and supplier or partner interruption.

The BIA must identify activities that support products and services, assess impacts over time using defined criteria, and identify the time frame within which not resuming an activity would become unacceptable. ISO 22301 notes that this can be called the maximum tolerable period of disruption (MTPD).

Within that limit, set a prioritized time frame for resuming the activity at a specified minimum acceptable capacity. ISO 22301 notes that this can be called the recovery time objective (RTO). Use the analysis to identify prioritized activities and document their required resources, dependencies, and interdependencies.

Use the BIA and disruption risk-assessment outputs to identify strategies for before, during, and after disruption. Each strategy must comprise one or more solutions. Identify options by how well they protect prioritized activities, reduce disruption likelihood or duration, limit impacts, meet recovery time and capacity, and provide adequate resources.

Select strategies and solutions by how well they meet recovery time and agreed capacity, the amount and type of risk the organization may or may not take, and their costs and benefits. Then determine the required people, information and data, facilities and utilities, equipment and consumables, ICT, transport and logistics, finance, partners, and suppliers. Implement and maintain the selected solutions so they can be activated when needed.

After implementing strategies and solutions, update the business continuity plans and procedures. Each plan should state its purpose, scope, objectives, team roles, activation criteria, solution steps, dependencies, resources, reporting, communication, and stand-down process. It must be usable and available where and when the response team needs it.

The exercise programme should validate strategies and solutions over time. Use planned scenarios with clear aims and objectives, record outcomes, recommendations, and improvement actions in a formal report, and exercise at planned intervals and after significant changes.

BIA and recovery strategy records go stale when products, sites, suppliers, technology, staffing models, legal obligations, customer contracts, or threat assumptions change. Assign a review trigger to each prioritized activity and make the owner update the BIA, risk assessment, strategy, plan, and exercise backlog when the facts change.

Management review should consider BIA and risk-assessment information, capability evaluations, audit and performance results, unresolved risks, and lessons from disruptions and near misses. Its outputs should record decisions on improvement and needed changes to scope, the BIA, risk assessment, strategies, solutions, plans, procedures, controls, and measurement.