What is business continuity management?
Business continuity management is a core process of sound management: it identifies the threats that could disrupt operations and puts controls in place against them.
The aim is a high degree of organizational resilience and an effective response to any event that disrupts operations — an accident, a fire, a flood, a cyberattack, a supply failure or the absence of key employees.
An implemented management system based on ISO 22301 (Business continuity management systems) ensures that the organization can keep operating in difficult times, whatever the scale and nature of the threats it faces. The current edition of the standard is ISO 22301:2019.
Where does an ISO 22301 system start?
The system starts with two analyses — a business impact analysis and a risk assessment. Together they show what matters most and what threatens it.
Identifies which activities are critical, what impact their disruption has over time, and within what timeframe and to what level they must be restored.
Identifies the threats to critical activities and their resources, assesses the likelihood and consequences, and determines which risks require measures.
The analysis also covers the resources on which critical activities depend: people, buildings, equipment, information systems, data, suppliers and partners.
How are business continuity plans built?
The plans are built on the results of the analysis: for each critical activity a strategy for continuing or recovering it is chosen, and the plan sets out who does what in the event of a disruption.
- 1Strategies and solutions
For example, a backup site, alternative suppliers, data backups and cover for key employees.
- 2Response structure
A team with clear roles and authority that takes charge in the event of an incident.
- 3Plans and procedures
Written plans for response, communication, and the continuation and recovery of operations.
- 4Communication
Who informs employees, customers, suppliers, institutions and the public, and when and how.
A plan that has not been tested is just a document. That is why ISO 22301 requires a programme of exercises and tests.
Why are exercises and tests needed?
Exercises and tests show whether the plans actually work and whether people know what to do — before a real disruption occurs.
| Type | What it checks |
|---|---|
| Plan review | Whether contacts, resources and responsibilities are up to date |
| Scenario-based (tabletop) exercise | How the team makes decisions during a simulated event |
| Technical test | Whether systems and data are restored within the required time |
| Full-scale exercise | How the whole plan works under near-real conditions |
The results of exercises, internal audits and the management review lead to corrective actions and continual improvement of the system.
Who is ISO 22301 important for and what are its benefits?
ISO 22301 is particularly relevant to organizations that operate in high-risk conditions and whose uninterrupted operation matters to themselves, to their customers, to interested parties and to society as a whole.
- ManufacturingManufacturing companies with branches in different regions.
- Public sectorInstitutions whose services must remain available even in a crisis.
- Finance and insuranceOrganizations that serve customers and handle payments without interruption.
- HealthcareMedical facilities and healthcare providers.
- Transport and logisticsCompanies on which supply chains depend.
- Telecommunications and ITService providers that other organizations rely on.
- faster recovery and smaller losses in the event of a disruption;
- greater organizational resilience;
- the trust of customers, partners and interested parties;
- proof of preparedness for contracting authorities and regulators.
The standard is fully integrable with ISO 9001, ISO/IEC 27001, ISO/IEC 20000-1 and ISO 28000. ISO 22301 certificates are issued by CERTIND S.A. under accreditation by IAS (USA).
Questions about ISO 22301
What is ISO 22301?
ISO 22301 is the international standard for business continuity management systems. The current edition is ISO 22301:2019.
What is a business impact analysis (BIA)?
It is an analysis that identifies critical activities, the consequences of their disruption and the timeframes within which they must be restored.
Which standards does ISO 22301 integrate with?
ISO 22301 is fully integrable with ISO 9001, ISO/IEC 27001, ISO/IEC 20000-1 and ISO 28000, and the audits can be conducted jointly.
How often should the plans be tested?
The standard requires a programme of exercises and tests carried out at planned intervals and whenever significant changes occur. The organization determines the frequency according to its risks.