The ISO 22301 Library

What is ISO 22301? A Comprehensive Overview of the Business Continuity Standard

What You Need to Know About ISO 22301:2019: A Broad Overview of the Standard

To understand ISO 22301, it is crucial to first get an overview of what business continuity actually means and why it is important to organizations.

So, what exactly is business continuity and how is it managed?

At its core, business continuity refers to an organization's ability to continue operating during and after a disruptive event. This can include natural disasters, cyberattacks, power outages, or other unexpected incidents that can disrupt operations.

Business continuity management (BCM) is the process of identifying potential threats to an organization's ability to operate, implementing procedures to ensure the organization can continue delivering services during disruptions, and ultimately minimizing the impact of the disruption on the organization.

Why is business continuity important?

The ability to continue operating during and after a disruptive event is crucial for any organization, regardless of size or industry.

Without a plan in place for dealing with unexpected events, organizations risk

being unable to provide critical services,
losing revenue, or
even going out of business altogether.

The consequences of a disruption can be significant, including:

reputational damage,
financial losses,
the need for additional resources,
legal liability, and
loss of customer trust.

ISO 22301 is a standard that provides an internationally recognized and certifiable framework for business continuity management (BCM). It was first published in 2012 and revised in 2019, and it provides a systematic approach to managing business continuity.
ISO 22301:2019 is the technical name for the newest version of the framework.

The standard is designed to help organizations of all sizes and industries establish, implement, maintain, and continually improve their business continuity management system (BCMS), which aligns with their business objectives.
It takes a comprehensive top-down approach and aims to ensure that businesses can continue to deliver products and services following disruptive events, such as natural or man-made disasters.

The standard achieves this by determining the company's business priorities and potential risks through a business impact analysis and risk assessment.

Once these are identified, ISO 22301 defines the necessary steps to decrease the liklihood of such events from happening and if they happen, how to recover minimal and normal operations as quickly as possible.

What is a BCMS? Understanding Business Continuity Management Systems

A Business Continuity Management System (BCMS) is a set of processes, policies, and procedures that an organization uses to ensure that essential business functions can continue during and after a disaster or other disruptive event. The goal of a BCMS is to provide a framework for effective response to such events, minimize the impact on the organization, and enable the organization to quickly return to normal operations.

Sounds complicated? It is not.

In short, your BCMS includes all processes, documentation and controls you have implemented to ensure the continuous delivery of services during and after a disruption.

It is a risk-based approach, therefore it is important to assess all detected risks to the continuity of your business and to mitigate their impact by developing plans and processes to continue operations. By taking a proactive approach it is possible to build resilience ,reduce the risk of disruptions and ensure the continuity of critical services.

This can involve developing plans and procedures for responding to specific events, such as cyber attacks or natural disasters, as well as establishing communication channels, training employees, and conducting regular testing and drills.

ISO 22301 follows a process approach based on the "Plan-Do-Check-Act" (PDCA) cycle.

But what is a PDCA cycle in ISO 22301?

The PDCA cycle, which stands for Plan-Do-Check-Act, is a method for organizations to continuously improve their processes. This four-step approach provides a framework for making data-driven decisions and achieving long-term success.

Plan: Create a plan to identify areas where improvements or changes can be made.
Do: Implement the changes outlined in the plan and measure their effectiveness.
Check: Analyze data and review the results of the changes made in the "Do" phase to evaluate their effectiveness.
Act: Take action to either make further improvements or incorporate the changes into broader company practices based on the results of the "Check" phase.

Here's an example of how the PDCA cycle works within the ISO 22301 world:

Plan: Identify potential risks and prioritize critical business functions. Develop a plan to minimize the impact of disruptions to those functions, including procedures for emergency response, communication, and resource allocation.
Do: Implement the business continuity plan by training staff, conducting regular drills, and testing the effectiveness of recovery procedures.
Check: Review the results of business continuity exercises and assess the effectiveness of the plan. Identify any gaps or areas for improvement.
Act: Based on the results of the review, revise and update the business continuity plan as necessary to address any identified shortcomings or to incorporate lessons learned. Repeat the cycle regularly to ensure continuous improvement.

Need Help with Your ISO 22301 Implementation or Audit?

Benefits and Advantages of ISO 22301: Why the standard is the Right Choice

Improved Resilience

ISO 22301 provides a systematic approach to business continuity management that enables organizations to become more resilient to disruptive events.

Legal Compliance

Compliance with ISO 22301 can help organizations to meet legal and regulatory requirements related to business continuity.

Competitive Advantage

Organizations that are certified to ISO 22301 can use it as a competitive advantage, as it demonstrates their commitment to business continuity and their ability to effectively manage disruptions.

Cost Savings

Effective business continuity management can help organizations to reduce the costs associated with disruptions, such as lost productivity, revenue, and reputation.

Enhanced Stakeholder Confidence

Certification to ISO 22301 demonstrates to customers that an organization has a robust measures in place, which enhances their confidence in the organization's ability to deliver products and services

Better decision-making

ISO 22301 provides a framework for data-driven decision-making, enabling organizations to make informed decisions about their business continuity strategies.

Global recognition

ISO 22301 is an internationally recognized standard, which can provide organizations with global recognition and facilitate international trade.

Increased employee awareness

Implementing ISO 22301 can increase employee awareness of business continuity risks and the importance of effective business continuity management, which can help to build a culture of resilience within the organization.

Business Continuity Management: Who Can Benefit from Pursuing ISO 22301 Certification?

Easy answer: Everyone can benefit from pursuing ISO 22301 certification.

As an organization grows, it will inevitably face business continuity issues at some point. Like with all incidents, the question is not if it will happen, but when. The larger an organization is or the more critical its provided services are, the higher the likelihood of such an event.

Moreover, if an organization wants to work with different key companies, these companies will require to have these business continuity measures in place. They expect the organization to be able to provide its services without interruptions or data loss.

It's important to note that ISO 22301 certification is not only for IT companies, as many people expect.
It's equally important for businesses that are not IT-related.
For example, it's essential for supply chain management to withstand disruptions. What would happen if a war broke out, and a company's main supplier of goods was unable to deliver its primary material? The company needs options!

So why not start preparing as early as possible and integrating business continuity into the company culture?

Want to go ahead?

Breaking Down ISO 22301:2019 Framework : A Close Look at all the Clauses

ISO 22301:2019 is structured around 10 main clauses and 46 sub-clauses

The term "clause" refers to a section or provision within a legal document or standard. In the case of ISO 22301, the clauses provide the foundation for the standard and guide organizations in establishing an effective BCMS.

Each clause represents a high-level area of focus for the BCMS.

Buy and download your copy of ISO 22301:2019 here.

ISO 22301:2019

ISO 22301:2019 Clause 4 Context of the Organization

4.1 – Understanding the Organization and its Context:
Identify internal and external factors that may affect business continuity.
4.2 - Understanding the needs and expectations of interested parties
The organization must determine the interested parties relevant to the BCMS and their relevant requirements and identify and assess legal and regulatory requirements related to its products, services and activities.
4.3 - Determining the scope of the business continuity management system:
Define the Scope of the BCMS and take internal and external issues, mission and objectives into account.
4.4 – Business Continuity Management System:
Establishing, implementing, maintaining, and continually improving the BCMS.

ISO 22301:2019 Clause 5 Leadership

5.1 - Leadership & Commitment:
Demonstrating management's commitment and involvement in establishing, implementing, maintaining, and continually improving the BCMS.
5.2 - Policy:
Establish and Communicate the Business Continuity Policy.
5.3 – Organizational Roles, Responsibilities & Authorities:
Defining and communicating business continuety roles, responsibilities, and authorities within the organization.

ISO 22301:2019 Clause 6 Planning

6.1 – Actions to Address Risks and Opportunities: The organization shall determine and take appropriate actions to address risks and opportunities that can affect the achievement of the BCMS objectives.
6.2 - Business Continuety objectives and planning to achieve them:
The organization shall establish measurable objectives for the BCMS and align them with the organization's strategic goals. Furhtermore, it needs to be determined how the organization plans to achive them.
6.3 Planning Of Changes:
The organization shall ensure that changes to the BCMS are conducted in a planned manner.

ISO 22301:2019 Clause 7 Support

7.1 – Resources:
The organization shall determine and provide the resources needed for the establishment, implementation, maintenance, and continual improvement of the BCMS.
7.2 – Competence:
The organization shall determine the necessary competence of persons doing work under its control that affects the performance and effectiveness of the BCMS.
7.3 – Awareness:
The organization shall ensure that persons doing work under its control are aware of the BC policy, their contribution to the effectiveness of the BCMS, and the implications of not conforming to the BCMS requirements.
7.4 – Communication:
The organization shall determine the internal and external communications relevant to the BCMS.
7.5 - Documented information:
- 7.5.1 - General:
  The organization shall determine and maintain the necessary documented information to support the operation of the BCMS and retain documented information to the extent necessary to have confidence that the processes have been carried out as planned.
- 7.5.2 - Creating and updating:
  The organization shall ensure that documented information required by the BCMS is identified, developed, and maintained.
- 7.5.3 Control of documented information:
  The organization shall ensure that documented information required by the BCMSand by this International Standard is controlled to ensure that it is adequately protected and is available where and when it is needed.

ISO 22301:2019 Clause 8 Operation

8.1 – Operational Planning & Control:
The organization shall determine, plan, and control the processes needed for the operation of the BCMS.
8.2 - Business Impact Analysis and Risk Assessment:
The organization must implement and maintain processes to assess and regularly review business impacts and implement a risk assessment process.
8.3 - Business Continuity Strategies and Solutions:
Business continuity strategies must be identified based on the outputs of the business impact analysis and the risk assessment. The appropriate strategy must be selected based on business requirements, needs to be allocated with the needed resources, and implemented.
8.4 - Business continuity plans and procedures:
- 8.4.1 - General:
  The organization must develop a response structure that allows for timely responses, create plans and procedures for managing disruptions, and clearly define when to activate their business continuity solutions.
- 8.4.2 - Response structure:
  The organization must implement and maintain a response structure with clearly defined roles and responsibilities to assess and respond to disruptions, activate business continuity solutions, prioritize actions, monitor effects, and communicate with relevant parties. Each Response Team must have identified personnel with documented procedures to guide their actions.
- 8.4.3 - Warning and communication:
  The organization shall document and maintain procedures for communication with relevant parties, including emergency responders and media, during disruptions. They should also consider alerting interested parties and ensuring coordination with other responding organizations.
- 8.4.4 - Business continuity plans:
  The organization must have documented business continuity plans and procedures to guide its response to disruptions. These plans should include details on how to continue or recover prioritized activities, how to monitor the impact of disruptions, and procedures for delivering products and services. Each plan should have a clear purpose, defined roles and responsibilities and activation criteria.
- 8.4.5 Recovery:
  Organization needs documented processes for returning business activities to normal after a disruption.
8.5 Exercise programme:
Organization must have a program to exercise and test its business continuity strategies and solutions . These exercises should be consistent with objectives, well-planned, and produce formal post-exercise reports for continuous improvement.

ISO 22301:2019 Clause 9 Performance evaluation

9.1 - Monitoring, measurement, analysis and evaluation:
The organization shall evaluate the performance and effectiveness of the BCMS, and identify opportunities for improvement.
9.2 - Internal audit:
- 9.2.1 - General:
  The organization shall conduct internal audits of the BCMS to determine whether it conforms to the requirements of the standard and the organization's own requirements.
- 9.2.2 Internal audit programme:
  The organization shall establish, implement, maintain and continually improve an internal audit program to provide assurance that the BCMS conforms to the requirements of the standard.
9.3 Management review:
- 9.3.1 - General:
  Top management shall review the BCMS at planned intervals to ensure its continuing suitability, adequacy, effectiveness, and alignment with the strategic direction of the organization.
- 9.3.2 - Management review inputs:
  The inputs to the management review shall include information on the performance and effectiveness of the BCMS, results of internal audits and external audits, feedback from interested parties, and changes in the external and internal context that may affect the BCMS.
- 9.3.2 - Management review results:
  The outputs of the management review shall include decisions and actions related to the improvement of the BCMS and its processes, resource needs, and opportunities for improvement.

ISO 22301:2019 Clause 10 Improvement

10.1 - Nonconformity and Corrective Action:
The organization shall have a process to identify and address nonconformities and to take corrective action to prevent their recurrence.
10.2 - Continual Improvement:
The organization shall continually improve the suitability, adequacy and effectiveness of the BCMS.

All A Bit Much?