ISO 22301 FAQ

ISO 22301 specifies requirements for a business continuity management system, or BCMS, that can apply to any organization or a defined part of one regardless of type, size, or nature. The extent of application depends on the operating environment and complexity.

The current published conformity baseline is the October 2019 second edition with Amendment 1:2024. The amendment adds a climate-change determination to Clause 4.1 and a climate-related interested-party note to Clause 4.2. Clauses 4-10 contain requirements; ISO companion standards and notes provide guidance. ISO/CD 22301 is under development and is not the published requirements baseline.

A working BCMS includes more than response plans. It needs defined scope, leadership responsibilities, business continuity objectives, resources, competence, communications, controlled documented information, business impact analysis, risk assessment, continuity strategies, plans, exercises, performance evaluation, internal audit, management review, corrective action, and continual improvement.

The BCMS scope should identify the boundaries and applicability of the management system. ISO 22301 requires the organization to identify the included parts of the organization and the products and services covered. It must document and explain exclusions; an exclusion cannot reduce the organization's ability or responsibility to provide business continuity as determined by the BIA or risk assessment and applicable legal or regulatory requirements.

A weak scope says only that the organization has a business continuity program. A useful scope tells a reviewer which services, sites, teams, suppliers, systems, and recovery responsibilities are actually governed by the BCMS.

A business impact analysis identifies disruption impacts over time and uses those impacts to set business continuity priorities and requirements. It should connect activities to the products and services they support, then define time-sensitive consequences if those activities are interrupted.

The BIA identifies the time frame within which impacts from not resuming an activity would become unacceptable and sets an earlier prioritized time frame for resumption at a specified minimum acceptable capacity. ISO 22301 notes that these time frames may be called MTPD and RTO; the labels are not a substitute for the time-based impact rationale. The BIA also determines the resources and dependencies, including partners and suppliers, needed for prioritized activities.

ISO 22301 requires the BIA to identify the timeframe within which the impacts of not resuming an activity would become unacceptable; the standard notes that this may be called the maximum tolerable period of disruption (MTPD). It then requires prioritized timeframes for resuming disrupted activities at a specified minimum acceptable capacity; the standard notes that this may be called the recovery time objective (RTO).

The RTO should be set within the unacceptable-impact timeframe, with enough margin for activation, recovery, verification, and dependency delays. ISO 22301:2019 does not define or explicitly require a recovery point objective (RPO). An organization can still use RPO as a supporting data-loss or transaction-rework target where information recovery affects continuity.

Recovery strategies and solutions should be selected from BIA and risk assessment outputs. They need to consider options before, during, and after disruption, then translate those options into implemented capabilities such as alternate processes, staffing arrangements, supplier alternatives, technology recovery, facilities, communications, and resource availability.

A strategy is not credible until it is connected to recovery targets, resource requirements, responsible owners, business continuity plans and procedures, and exercise results. ISO 22301 requires selected strategies and solutions to meet the identified timeframes and agreed capacity. Recording or accepting a gap does not by itself show that requirement is met; the organization should change the solution, capability, or justified continuity requirement and retain the resulting decision and action evidence.

Third-party certification is optional, and ISO does not certify organizations. If certification is the chosen conformity route, evidence should show that the BCMS exists, operates, is evaluated, and improves. Useful evidence includes scope, policy, roles and responsibilities, business continuity objectives, competence records, communication arrangements, controlled documented information, BIA and risk assessment records, strategies and solutions, plans and procedures, exercise reports, incident or post-exercise actions, internal audits, management reviews, and corrective actions.

Auditors and customers usually need traceability. A plan without BIA support is weak. A BIA without recovery strategy decisions is incomplete. A strategy without exercise evidence is unproven. A finding without corrective action closure is unfinished.

ISO 22301 uses planned intervals rather than a fixed annual frequency. Exercises and tests must also occur when significant organizational or context changes arise. Internal audits should provide information about whether the BCMS conforms to the organization's own requirements and ISO 22301 requirements. Top management reviews the BCMS to ensure its continuing suitability, adequacy, and effectiveness.

Do not rely on a calendar alone. Review the BIA, risk assessment, strategies, solutions, plans, and procedures after significant changes to services, locations, suppliers, technology, workforce, legal requirements, threat conditions, or disruption experience.

ISO 22301 cannot be satisfied by storing a business continuity plan. The standard expects a maintained BCMS with leadership commitment, defined scope, documented information, operational planning, BIA, risk assessment, strategies, plans, exercises, performance evaluation, audit, management review, and improvement.

Activities do not need the same recovery target. Recovery requirements should come from the BIA; the separate risk assessment identifies disruption risks that inform strategies and solutions. Some activities may need rapid recovery, while others can wait if disruption impacts remain tolerable.