How to implement ISO 22301

How to implement ISO 22301

1. 1
   Context (clause 4)

   Define the scope of your BCMS and the interested parties and requirements it must satisfy.

2. 2
   Leadership & policy (clause 5)

   Secure top-management commitment, publish a business continuity policy, and assign roles and accountability.

3. 3
   Planning (clause 6)

   Set measurable continuity objectives and plan how you'll address risks and opportunities.

4. 4
   Support (clause 7)

   Provide resources, competence, awareness and documented information control.

5. 5
   Operation (clause 8)

   Run the BIA and risk assessment, choose strategies, write plans, and exercise them — the operational heart of the standard.

6. 6
   Performance evaluation (clause 9)

   Monitor, measure, audit internally and hold a management review against your objectives.

7. 7
   Improvement (clause 10)

   Handle nonconformities and drive continual improvement, then assemble your evidence and book the certification audit.

Frequently asked questions

What are the main requirements of ISO 22301?

ISO 22301 requires a scoped BCMS with leadership commitment and policy, measurable objectives, a business impact analysis and risk assessment, documented and exercised continuity plans, performance evaluation (audit and management review), and continual improvement.

How long does ISO 22301 certification take?

It depends on scope and starting maturity, but typically a few months. Having a system that continuously evidences each clause — rather than scrambling for documents before the audit — is what shortens it.