ISO 22301 for business continuity
A management system for keeping critical operations running through a disruption, and recovering them in a known order.
- Standard
- ISO 22301:2019
- At the centre
- The business impact analysis
- Works with
- ISO/IEC 27001, ISO 9001
- Gap analysis
- Two days on site, report within a week
- Pace
- You and your certification body
ISO 22301 sets out how an organisation identifies its critical activities, assesses what would disrupt them, plans how to continue and recover, and tests those plans. The business impact analysis sits at the centre of it: it sets how long each activity can stop before the damage becomes unacceptable.
- 01 Enquiry
- 02 Gap analysis
- 03 Plan
- 04 Build
- 05 Embed
- 06 Internal audit
- 07 Close out
- 08 Management review
- 09 Handover
ISO 22301 for business continuity sits at step 4 of the readiness cycle. You receive the documented management system.
The plan nobody has opened
Most continuity plans are written once, filed, and first read during the disruption they were meant for.
The plan names people who have since left, a call list nobody updated and a recovery site nobody has visited. It has not been exercised, so the first test is the real event.
The deeper failure is upstream. Without a business impact analysis, every activity is treated as critical, the plan tries to recover everything at once, and the recovery order is decided in the room on the day. ISO 22301 puts the analysis first for that reason.
The third is dependency. The activity everyone protects often depends on a system, a supplier or one person nobody listed. The impact analysis is where those dependencies are found, on paper, before they fail.
The parts of the system
| Part | What it does | What you hold |
|---|---|---|
| Business impact analysis | For each activity, the impact of it stopping over time, how long it can stop, and the order in which activities come back. | The business impact analysis |
| Risk assessment | What could disrupt the prioritised activities, and how likely and serious each disruption is. | The risk assessment |
| Continuity strategies | How each prioritised activity continues or recovers: an alternate site, a manual workaround, a standby supplier or cross-trained staff. | Strategy decisions with the resources each needs |
| Plans and procedures | Who responds, who communicates, and the recovery steps in order, written so someone under pressure can follow them. | Continuity plans |
| Exercising and testing | Tabletop exercises, drills and tests that show whether the plans work before they are needed. | Exercise records with what went wrong |
| Review | Plans and the analysis revisited after exercises, incidents and changes to the business. | Internal audit report and review minutes |
Documents that stay with you
The business impact analysis
Every activity in scope with its impact over time, its tolerable outage, its recovery time and what it depends on.
The risk assessment
The disruptions that matter to the prioritised activities, assessed by a stated method.
Continuity plans
Response, communication and recovery written per prioritised activity, with names, contacts and the order of steps.
The exercise record
The scenario, who took part, what the walk-through exposed and the action raised against each gap.
The internal audit report
The system audited against the standard, including whether the plans match the analysis they came from.
How the build runs
- 01
Gap analysis
Your current arrangements set against the standard, clause by clause.
- 02
Impact analysis with the managers
Time frames come from the people who live with the consequence of an activity stopping, not from IT alone.
- 03
Strategies and resources
How each prioritised activity continues, and what that needs in people, premises, systems and suppliers.
- 04
Plans for the first hours
Who does what first, who is called, and where the recovery steps are kept when the network is down.
- 05
Tabletop exercise
The plan walked through against a realistic scenario, with every gap written down and given an owner.
- 06
Internal audit and review
The system audited, and management reviewing what the exercise and the audit found.
One system, one warehouse
A logistics operator whose warehouse management system is a single point of failure.
When it stops, picking stops, dispatch stops and the trucks wait at the gate. Nobody had written down how long the business could run without it.
The impact analysis sets how long each activity can stop: receiving, picking, dispatch and invoicing, each with its own time frame and recovery order. The plan says who does what in the first four hours, including the manual picking method and who authorises it.
A tabletop exercise tests the plan before anyone needs it. The operator holds the impact analysis, the plan and an exercise record listing what the walk-through exposed, with an owner against each item.
What continuity managers ask
Is business continuity the same as disaster recovery?
No. Disaster recovery restores IT systems. Business continuity covers the whole activity, including people, premises, suppliers and the manual workarounds that keep work moving while systems are down. A disaster recovery plan is usually one input to the continuity plans.
Does every activity need a plan?
No. The impact analysis decides which activities are prioritised. Plans are written for those, and the rest recover in the normal course. Trying to plan for everything is how continuity programmes stall.
How often do plans have to be exercised?
The standard asks for exercises at planned intervals and when there are significant changes. We set the programme with you so every prioritised plan is exercised within the cycle, starting with a tabletop.
We hold ISO 27001. Does that cover continuity?
Partly. ISO 27001 covers information security during disruption and the readiness of your IT for continuity. ISO 22301 covers the whole business, not only information. The two share a structure and fit in one integrated system.
Often paired with
ISO 27001 readiness
Information security and IT readiness, the systems side of continuity.
Read moreIndustryLogistics and warehousing
Where a single system outage stops dispatch for everyone downstream.
Read moreServiceIntegrated management system
Continuity on the same document set as quality or information security.
Read moreServiceInternal audit
Checking the plans still match the analysis they came from.
Read morePart of one system
Every division keeps records to the same standard, so the second one you need works the way the first one did.
The impact analysis comes first
It decides what the plans cover and in what order. The gap analysis shows how far your current arrangements are from it, and you keep the report whatever you decide.