_1762866128417-DS2_OO1j.png)
What ISO 22301 is about
ISO 22301 is the international standard for business continuity management systems (BCMS). It describes how an organisation prepares for, responds to and recovers from disruption – whether a cyber attack, supplier failure, fire, pandemic or power outage. The central question is: which services must we restore within what time, and how do we do it?
The standard follows the Harmonized Structure and combines with ISO 9001, ISO 27001 and other management systems. ISO 22313 provides additional implementation guidance. Many organisations also draw on national frameworks for business continuity.
Key terms
| Term | Meaning |
|---|---|
| Business impact analysis (BIA) | Analysis of how the impact of disrupted activities develops over time, and setting priorities |
| Maximum tolerable period of disruption (MTPD) | Time after which the impact of a disruption becomes unacceptable |
| Recovery time objective (RTO) | Time within which an activity must be resumed after a disruption |
| Recovery point objective (RPO) | Maximum acceptable data loss, measured as a period before the disruption |
| Minimum business continuity objective (MBCO) | Minimum level of service that must be delivered during the disruption |
| Business continuity plan | Documented procedure for responding to a disruption and recovering |
Core requirements of clause 8
- 1
Business impact analysis and risk assessment (8.2)
Prioritise activities, identify dependencies on people, IT, premises and suppliers, assess risks to these resources.
- 2
Business continuity strategies (8.3)
Select solutions for continuing or restoring prioritised activities within the RTO – such as an alternative site, a second supplier or manual workarounds.
- 3
Plans and procedures (8.4)
Document response structure, alerting, communication, recovery and return to normal operations.
- 4
Exercise programme (8.5)
Exercise plans regularly – from tabletop to full test – and evaluate the results.
- 5
Evaluation of documentation and capabilities (8.6)
Check whether plans are current and effective and implement improvements.
How docxpert supports your BCMS
Planning and evaluating exercises
A continuity plan that has never been exercised is a hypothesis. ISO 22301 therefore requires an exercise programme that demonstrates the effectiveness of strategies and plans over time. Increasing the level of ambition step by step makes sense:
| Exercise type | Effort | What it shows |
|---|---|---|
| Plan walkthrough | Low | Are plans understandable, complete and known? |
| Tabletop exercise | Medium | Do decision paths and communication in the crisis team work? |
| Technical test | Medium to high | Can systems and data be restored within RTO and RPO? |
| Full-scale exercise | High | Do organisation, technology and service providers work together? |
For each exercise, document the objective, scenario, participants, observations and actions. Auditors pay particular attention to this evidence.
Building a BCMS in six steps
- 1
Mandate and scope
Management decides which sites, products and services are included and appoints owners for BCM.
- 2
Business impact analysis
Work with business areas to identify critical activities, impacts of disruption, RTO, RPO and dependencies.
- 3
Assess risks
Assess threats to the required resources – people, IT, premises, suppliers, information.
- 4
Select strategies
Define a solution for each critical activity and keep the necessary resources available.
- 5
Document plans and train
Create, approve and train people on the crisis management plan and the continuity and recovery plans.
- 6
Exercise, audit, improve
Run exercises, audit internally, evaluate in the management review and implement lessons learned.
Practical tips
- Start with the BIA: without priorities, continuity plans become too long and go unused in a real event.
- Keep plans short: checklists and clear roles help more under stress than lengthy text.
- Ensure offline availability: continuity plans must be reachable even when IT systems fail.
- Include suppliers: critical service providers should demonstrate their own continuity arrangements.
- Learn from every incident: real disruptions are the best exercises – evaluate them in a structured way.
Frequently asked questions
What is the difference between BCM and IT disaster recovery?
IT disaster recovery focuses on restoring IT systems. BCM looks at the whole organisation – people, sites, suppliers and processes – and defines which business activities must be running again how quickly. IT recovery plans are one part of that.
How often should a business impact analysis be updated?
At least annually and when significant changes occur, such as new products, sites, IT systems or suppliers. The standard requires the BIA to be reviewed at planned intervals and when changes occur.
Does ISO 22301 make sense for small companies?
Yes, at an appropriate scale. Small companies in particular often depend on a few people, customers or suppliers. Even a simple BIA and a few exercised plans significantly increase resilience.
Is there an automatic gap analysis for ISO 22301 in docxpert?
There is currently no dedicated requirement catalogue for ISO 22301. The 19 templates do show which clauses they cover, and BCM content is also covered through ISO 27001 and NIS2.
How often must continuity plans be exercised?
The standard does not set a fixed interval. Common practice is at least one exercise per year for each critical plan, plus technical recovery tests after major changes.
Who belongs in the crisis team?
Typically management, communications, IT, HR, site managers and, depending on the scenario, business areas. Named deputies and clear decision-making authority are essential.
How do I derive recovery objectives from a business impact analysis?
Assess each critical activity and consider the consequences of an interruption at different points in time. Account for dependencies on people, sites, information, suppliers and supporting technology. This helps prioritise which services must resume first and what minimum capacity is needed. Recovery time and recovery point objectives should follow from the analysis and tolerable impacts, not merely from technically achievable values. Record assumptions, data sources, owners and approval by process leads. Then check whether chosen strategies can meet the objectives in practice and whether supplier commitments align. Repeat the analysis after significant business changes and use exercises to expose unrealistic targets or overlooked dependencies.