Overview
ISO 22301:2019 specifies requirements to implement, maintain and improve a business continuity management system (BCMS). Its operational core in clause 8 covers business impact analysis and risk assessment, continuity strategies and solutions, plans and procedures, an exercise programme and evaluation of business continuity capabilities.
How the standard is structured
- 4Context of the organization
- 5Leadership
- 6Planning
- 7Support
- 8Operation
- 9Performance evaluation
- 10Improvement
BCMS recovery design field guide
Design recovery around business impact and dependencies, then demonstrate the selected arrangements can deliver the required service level.
- 1
Refresh the BIA
Work with process owners to understand impacts over time, priority activities, minimum acceptable service and recovery needs.
- 2
Map dependencies
Include people, premises, technology, information, utilities, suppliers, transport and shared identity or communications services.
- 3
Select strategies
Compare proportionate options for continuity and recovery, including capacity, geographic diversity, workarounds and resource constraints.
- 4
Build usable plans
Define activation triggers, authority, roles, communications, recovery sequence and safe return to normal operations.
- 5
Exercise and improve
Match exercises to risk and objectives; measure results, assign corrective actions and verify that gaps are closed.
Evidence checklist
- Business-owned impact assumptions and approved recovery needs
- Dependency and supplier analysis
- Strategy capacity and availability evidence
- Exercise objectives, observed results and lessons
- Closed improvement actions and current activation information
Common failure modes
- Confusing backups or provider availability with end-to-end recoverability
- Setting RTOs without checking impacts and dependencies
- Treating a tabletop as proof of technical recovery
- Failing to update the BIA after major operational or climate-related change
Key concepts examiners test
Business impact analysis
Analysis of impacts over time of disruption, used to set prioritized activities and timeframes.
MTPD
Maximum tolerable period of disruption — after which impacts become unacceptable.
RTO
Recovery time objective — must be shorter than the MTPD.
RPO
Recovery point objective — the point to which information must be restored.
MBCO
Minimum business continuity objective — acceptable reduced service level during disruption.
Preparing for the Lead Auditor exam
- Verify that RTOs are consistently shorter than MTPDs and supported by tested solutions.
- Look for post-exercise reports and evidence that recommended actions were implemented.
- Check that the BIA was refreshed after significant change, such as new suppliers or sites.
- Interview plan owners to confirm they know activation criteria and communication paths.
Preparing for the Lead Implementer exam
- Run the BIA with business owners, not just IT, to get realistic impact timelines.
- Choose strategies for people, premises, technology, information and suppliers.
- Write plans as concise, role-based playbooks rather than long narratives.
- Build an exercise programme that escalates from walkthroughs to full simulations.