ISO 22301 Requirements

Clause 4 starts with internal and external issues, relevant interested parties and their requirements, and applicable legal and regulatory requirements related to the continuity of products and services, activities, and resources. Amendment 1:2024 also requires the organization to determine whether climate change is a relevant issue and notes that interested parties can have climate-related requirements.

The documented BCMS scope must establish the parts of the organization included, taking account of location, size, nature, and complexity, and identify the products and services included. Exclusions must be documented and explained. They cannot impair the organization's ability and responsibility to provide business continuity as determined by the BIA, disruption-risk assessment, or applicable legal and regulatory requirements.

Clause 5 makes top management accountable for integrating BCMS requirements into business processes, providing resources, establishing policy and objectives compatible with strategic direction, assigning authority, and promoting improvement. The business continuity policy must be available as documented information, communicated internally, and available to interested parties as appropriate.

Planning should turn the policy into continuity objectives at relevant functions and levels. Objectives must be measurable if practicable, monitored, communicated, and updated as appropriate. Support requirements then make the system workable: resources, competence, awareness, communication, and controlled documented information. Evidence should show who owns each objective, what will be done, what resources are needed, when results are reviewed, and how changes to the BCMS are planned.

Clause 8.2 requires systematic BIA and disruption-risk assessment processes. The BIA identifies activities supporting products and services, assesses impacts over time, identifies when impacts would become unacceptable, sets earlier prioritized resumption time frames at a specified minimum acceptable capacity, identifies prioritized activities, and determines their resources and dependencies. The organization may perform the BIA or risk assessment first.

The Clause 8.2.3 risk assessment is narrower than the Clause 6.1 management-system planning exercise: it identifies, analyses, and evaluates disruption risks to prioritized activities and their required resources, then determines which risks require treatment.

Based on both outputs, Clause 8.3 requires strategies for before, during, and after disruption, one or more solutions, defined resource requirements, and implementation so the solutions can be activated when needed. Clause 8.4 then requires response structure, warning and communication, plans, activation criteria, team actions, resource and reporting requirements, and processes for recovery and return from temporary measures.

Clause 8.5 requires an exercising and testing programme that validates continuity strategies and solutions over time. Exercises and tests must use appropriate, planned scenarios with defined aims and objectives, produce formal post-exercise reports with outcomes, recommendations, and improvement actions, occur at planned intervals and after significant changes, and lead to changes and improvements.

Performance evaluation is broader than exercises. Clause 8.6 requires evaluation of the suitability, adequacy, and effectiveness of the BIA, risk assessment, strategies, solutions, plans, and procedures, including relevant partner and supplier capabilities. Clause 9 adds monitoring and measurement, internal audit, and management review.

When a nonconformity occurs, the useful record is not only the finding. Teams need to respond, control or correct the issue, address consequences, evaluate root causes, implement needed action, review effectiveness, and update the BCMS if the issue changes assumptions, scope, strategy, procedure, or resources.

Management review should convert BCMS evidence into decisions. It should consider previous actions, changes in context, business continuity performance, nonconformities, corrective actions, audit results, BIA and risk assessment information, capability evaluations, and opportunities for continual improvement. Outputs should include decisions on scope changes, BIA or risk updates, strategies, plans, resources, and improvement priorities.