--- title: "ISO 22301 FAQ: BCMS, BIA, MTPD, RTO and Audit Evidence" canonical_url: "https://www.sorena.io/artifacts/global/iso-22301/faq" source_url: "https://www.sorena.io/artifacts/global/iso-22301/faq/items/page/3" author: "Sorena AI" description: "Practical ISO 22301 FAQ for business continuity teams: BCMS scope, BIA, MTPD, RTO, RPO, strategies, exercises, audits, management review, and certification evidence." published_at: "2026-05-09" updated_at: "2026-07-24" keywords: - "ISO 22301 FAQ" - "BCMS FAQ" - "business impact analysis ISO 22301" - "MTPD RTO RPO" - "ISO 22301 audit evidence" - "business continuity management system" - "ISO 22301" - "business continuity management" - "BCMS" - "business impact analysis" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # ISO 22301 FAQ: BCMS, BIA, MTPD, RTO and Audit Evidence Practical ISO 22301 FAQ for business continuity teams: BCMS scope, BIA, MTPD, RTO, RPO, strategies, exercises, audits, management review, and certification evidence. *FAQ* *Global* *ISO 22301* ## ISO 22301 FAQ Clear answers to the ISO 22301 questions teams ask when building or maintaining a business continuity management system. This FAQ helps connect BCMS scope, business impact analysis, recovery targets, continuity strategies, exercises, audit evidence, and management review. ISO 22301:2019 specifies requirements for establishing, implementing, maintaining, and continually improving a business continuity management system (BCMS). The BCMS prepares the organization to continue delivering products and services at an acceptable predefined capacity during disruption; a business continuity plan is only one part of that system. ## Definitions ### Business continuity management system **Term:** BCMS A BCMS is the set of interrelated policies, objectives, roles, processes, resources, and controlled information an organization uses to establish, implement, maintain, and continually improve business continuity. It prepares the organization to continue delivering products and services within acceptable time frames at a predefined capacity during disruption. **Why it matters here:** ISO 22301 assesses the management system across its defined scope. A business continuity plan is one controlled part of the BCMS, not a substitute for scope, BIA, risk assessment, strategies, exercises, audits, management review, and improvement. Sources: - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) ### Business impact analysis A business impact analysis is the process of analysing how disruption affects an organization over time. Under ISO 22301, it establishes continuity priorities and requirements by identifying supporting activities, unacceptable disruption time frames, prioritized resumption time frames and capacity, prioritized activities, resources, dependencies, and interdependencies. **Why it matters here:** The business impact analysis explains what needs prioritized recovery and why. It is distinct from the disruption risk assessment, although the organization may perform the two processes in either order. Sources: - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - [ISO/TS 22317:2021 business impact analysis guidance](https://www.iso.org/standard/79000.html?ref=sorena.io) ### Maximum tolerable period of disruption **Term:** MTPD MTPD is a name ISO 22301 says can be used for the time frame within which the impacts of not resuming an activity would become unacceptable. The organization must determine the time frame but does not have to use the acronym. **Why it matters here:** MTPD is the outer impact limit for the activity. The BIA should support it with time-based criteria, evidence, assumptions, and approval rather than a copied duration. Sources: - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) ### Recovery time objective **Term:** RTO RTO is a name ISO 22301 says can be used for the prioritized time frame for resuming a disrupted activity at a specified minimum acceptable capacity. It must fall within the point at which continued non-resumption would become unacceptable. **Why it matters here:** RTO is a continuity requirement, not proof that recovery works. Resources, solutions, plans, supplier arrangements, and exercises should show whether the organization can meet it. Sources: - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) ### Recovery point objective **Term:** RPO RPO is a data-recovery target that identifies the point in time to which information must be restored after disruption. It determines how much recent data or transaction history may need to be recreated. ISO 22301:2019 does not define or explicitly require RPO. **Why it matters here:** Where data loss affects continuity, the organization can adopt an RPO and connect it to backup, replication, restoration, and reconciliation evidence. It is separate from the activity's RTO. Sources: - [NIST CSRC Recovery Point Objective glossary](https://csrc.nist.gov/glossary/term/recovery_point_objective?ref=sorena.io) - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) ### Third-party certification Third-party certification is written assurance from an independent certification body that a management system meets specified requirements. ISO develops ISO 22301 but does not perform certification or issue certificates. **Why it matters here:** Certification is optional under ISO management system standards. When chosen or required by another party, it assesses the stated BCMS scope and does not certify every product, service, site, supplier, or legal obligation. Sources: - [ISO certification overview](https://www.iso.org/certification.html?ref=sorena.io) - [ISO management system standards overview](https://www.iso.org/management-system-standards.html?ref=sorena.io) ## Browse sub-FAQ modules ### [ISO 22301 Business Impact Analysis FAQ](/artifacts/global/iso-22301/faq/business-impact-analysis.md) Practical ISO 22301 BIA FAQ covering prioritized activities, impact criteria, MTPD, RTO, RPO, dependencies, resources, strategy handoff, evidence, and review triggers. - 5 items ### [ISO 22301 Certification Evidence FAQ](/artifacts/global/iso-22301/faq/certification-evidence.md) FAQ guidance on ISO 22301 certification evidence: BCMS scope, documented information, BIA, risk assessment, exercises, internal audit, management review, and corrective action. - 4 items ### [ISO 22301 Management Review FAQ](/artifacts/global/iso-22301/faq/management-review.md) What ISO 22301 management review should cover: inputs, outputs, decisions, evidence, improvement actions, and ownership for BCMS leadership reviews. - 4 items ### [ISO 22301 MTPD FAQ](/artifacts/global/iso-22301/faq/mtpd.md) How ISO 22301 teams should define MTPD in the business impact analysis, separate it from RTO and RPO, and keep recovery evidence current. - 4 items ### [ISO 22301 Recovery Strategies FAQ](/artifacts/global/iso-22301/faq/recovery-strategies.md) Practical ISO 22301 FAQ on selecting recovery strategies from BIA, risk assessment, prioritized activities, resource needs, exercises, and review evidence. - 4 items ### [ISO 22301 RPO FAQ: Recovery Point Objectives](/artifacts/global/iso-22301/faq/rpo.md) How to set, evidence, test, and review recovery point objectives in an ISO 22301 business continuity management system. - 4 items ### [ISO 22301 RTO FAQ: Recovery Time Objectives](/artifacts/global/iso-22301/faq/rto.md) Plain-language ISO 22301 guidance for setting recovery time objectives from BIA evidence, MTPD limits, resources, dependencies, exercises, and review triggers. - 5 items ### [ISO 22301 Testing Exercises FAQ](/artifacts/global/iso-22301/faq/testing-exercises.md) How ISO 22301 teams should plan, run, evidence, and improve business continuity exercises and tests. - 4 items Browse all indexed questions: [/artifacts/global/iso-22301/faq/items](/artifacts/global/iso-22301/faq/items.md) ## All FAQ items *Page 3 of 3. Showing 4 of 34 items.* ### [What should an ISO 22301 exercise programme include?](/artifacts/global/iso-22301/faq/testing-exercises.md#what-should-an-iso-22301-exercise-programme-include) *Module: [ISO 22301 Testing Exercises](/artifacts/global/iso-22301/faq/testing-exercises.md)* The programme should be planned against the BCMS scope and business continuity objectives, not as a loose calendar of tabletop meetings. Each exercise or test should name the activity, site, product, service, dependency, plan, team, and scenario being validated. - Define the exercise objective before choosing the scenario or participants. - Tie each exercise to continuity objectives, prioritized activities, BIA outputs, risk assessment results, strategies, plans, and procedures. - Use scenarios that are realistic enough to test decisions, resource assumptions, communications, recovery sequencing, and dependency failures. - Plan coverage across roles and sites over time so the programme validates the BCMS, not only one team that already knows the plan. Sources for this answer: - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Primary ISO listing for the business continuity management system requirements standard that includes exercising and testing as part of BCMS operation. - [ISO 22313:2020 guidance standard page](https://www.iso.org/standard/75107.html?ref=sorena.io) - Companion guidance for applying ISO 22301, useful for shaping practical BCMS implementation and improvement records. ### [How should exercises validate BIA and recovery objectives?](/artifacts/global/iso-22301/faq/testing-exercises.md#how-should-exercises-validate-bia-and-recovery-objectives) *Module: [ISO 22301 Testing Exercises](/artifacts/global/iso-22301/faq/testing-exercises.md)* Exercises should test whether the BIA and risk assessment still describe reality. If the BIA sets an unacceptable-impact timeframe, an RTO, critical suppliers, required people, minimum resources, or a recovery sequence, programme coverage should test those assumptions. Test RPO too where the organization has adopted it as a supporting data-recovery target; ISO 22301:2019 does not define or explicitly require RPO. - Map each scenario to affected activities, products, services, sites, systems, people, suppliers, and recovery procedures. - Record whether the tested response met the intended RTO, RPO, MTPD-related priority, communication deadline, or resource assumption. - Flag gaps where plans depend on unavailable staff, stale contact lists, untested suppliers, missing access, unclear authority, or recovery steps that take longer than the BIA allows. - Feed validated changes back into the BIA, risk assessment, continuity strategies, procedures, training, and supplier follow-up. Sources for this answer: - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Supports the link between exercises, business impact analysis, business continuity strategies, plans, and BCMS evaluation. - [ISO 22313:2020 guidance standard page](https://www.iso.org/standard/75107.html?ref=sorena.io) - Supports practical guidance for applying ISO 22301 when evaluating and improving the BCMS. ### [What evidence should teams keep after each exercise?](/artifacts/global/iso-22301/faq/testing-exercises.md#what-evidence-should-teams-keep-after-each-exercise) *Module: [ISO 22301 Testing Exercises](/artifacts/global/iso-22301/faq/testing-exercises.md)* ISO 22301 requires formalized post-exercise reports containing outcomes, recommendations, and actions to implement improvements. Add enough scope, scenario, objective, participant, timing, and observation detail for a reviewer to understand what was tested and what the result does and does not validate. - Document the exercise scope, assumptions, date, facilitators, participants, affected processes, and plans tested. - Separate observations from corrective actions: an observation describes what happened; an action names the fix, owner, due date, and verification method. - Retain evidence of improvement, such as updated procedures, revised contact lists, new training records, supplier follow-up, resource changes, or accepted residual risk. - Preserve unresolved items for audit, risk review, or management review instead of burying them in meeting notes. Sources for this answer: - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Supports retaining exercise and evaluation evidence as part of the BCMS documented information and improvement cycle. - [ISO 22313:2020 guidance standard page](https://www.iso.org/standard/75107.html?ref=sorena.io) - Supports practical implementation records for applying and improving the BCMS after exercise results. ### [When should exercise results trigger corrective action or management review?](/artifacts/global/iso-22301/faq/testing-exercises.md#when-should-exercise-results-trigger-corrective-action-or-management-review) *Module: [ISO 22301 Testing Exercises](/artifacts/global/iso-22301/faq/testing-exercises.md)* ISO 22301 requires the organization to act on exercise and test results and implement changes and improvements. When a result is classified as a BCMS nonconformity, the separate corrective-action requirements apply: react to it, address consequences, evaluate causes and recurrence, implement needed action, review effectiveness, and retain evidence. Other observations can remain recommendations or improvement actions if they are not nonconformities. - Run exercises at planned intervals and when significant organizational, context, service, supplier, technology, site, or recovery-strategy changes occur. - Classify failed or partial results consistently. Use corrective action with cause and effectiveness review for nonconformities; use owned improvement actions for other exercise recommendations. - Update the BIA, risk assessment, strategies, plans, communication procedures, training, or supplier records when the exercise proves they are stale. - Escalate material gaps to management review when they affect BCMS suitability, adequacy, effectiveness, resources, scope, or continual improvement. Sources for this answer: - [ISO 22301:2019 standard page](https://www.iso.org/standard/75106.html?ref=sorena.io) - Supports review, evaluation, corrective-action, and continual-improvement handling for exercise findings. - [ISO 22313:2020 guidance standard page](https://www.iso.org/standard/75107.html?ref=sorena.io) - Supports using exercise outputs as implementation guidance for maintaining and improving a BCMS. ## FAQ Pagination - Canonical index (page 1): [/artifacts/global/iso-22301/faq/items](/artifacts/global/iso-22301/faq/items.md) - Page 1 rule: `/page/1` is intentionally not generated; use the canonical index markdown URL. - Current page: 3 of 3 Pages: [1](/artifacts/global/iso-22301/faq/items.md) | [2](/artifacts/global/iso-22301/faq/items/page/2.md) | [3](/artifacts/global/iso-22301/faq/items/page/3.md) [Previous page](/artifacts/global/iso-22301/faq/items/page/2.md) *Recommended next step* *Placement: after FAQ guidance* ## Operationalize ISO 22301 FAQ This FAQ helps turn common BCMS questions into assigned evidence: scope decisions, BIA records, recovery targets, strategy choices, exercise reports, audit findings, and management-review actions. - [Open Assessment Autopilot for ISO 22301](/solutions/assessment.md): Convert ISO 22301 FAQ answers into accountable tasks, evidence requests, review checkpoints, and certification-readiness records. - [Talk through ISO 22301 implementation](/contact.md): Review your BCMS scope, BIA quality, recovery targets, exercise evidence, audit gaps, and management-review actions. --- [Privacy Policy](https://www.sorena.io/privacy.md) | [Terms of Use](https://www.sorena.io/terms-of-use.md) | [DMCA](https://www.sorena.io/dmca.md) | [About Us](https://www.sorena.io/about-us.md) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/global/iso-22301/faq/items/page/3.md