ISO 22301 readiness
ISO 22301 checklist for your business continuity system
This checklist follows ISO 22301:2019 clause by clause, from context to improvement. For each point you see which evidence a company typically has. If most points are covered, the self-assessment shows where you stand.
01: Clauses 4 and 5
ISO 22301 checklist: context and leadership
ISO 22301:2019 uses the high level structure shared by most ISO management system standards. The requirements start at clause 4. Clauses 1 to 3 cover scope, references and terms, so there is nothing to tick there.
Clauses 4 and 5 are short, but auditors and customers read them first. They show whether management has decided what the system covers and who answers for it.
Interested parties and their requirements are known
Typical evidence: a list of customers, regulators, insurers and key suppliers, with the continuity requirements from contracts and supplier questionnaires.
The scope of the system is defined
Typical evidence: a half-page scope statement that names sites, services and any exclusions with a reason.
Management has set a business continuity policy
Typical evidence: a signed policy, available to staff on the intranet or in the onboarding folder.
Roles and responsibilities are assigned
Typical evidence: an organisation chart or table naming the crisis team, the person in charge and a deputy for each role.
02: Clauses 6 and 7
Planning and support: objectives, resources, documents
Planning sets the direction. Support provides the people, skills and paperwork to follow it. A company that already runs ISO 9001 or ISO 27001 usually has the document control and training routines in place and only needs to add continuity content.
Risks and opportunities of the management system are assessed
Typical evidence: a register that lists what could stop the system itself from working, for example a single person who knows the recovery steps.
Business continuity objectives are measurable
Typical evidence: written objectives with an owner and a measure, such as restoring order processing within an agreed time.
Resources are budgeted
Typical evidence: budget lines or approved purchases for backup systems, spare equipment, an alternative workplace or emergency stock.
Staff are competent and aware
Typical evidence: training records, attendance lists from briefings and a short continuity slide in the induction pack.
Internal and external communication is arranged
Typical evidence: a current contact list, a call tree and prepared messages for customers, staff and authorities.
Documented information is controlled
Typical evidence: version numbers, approval dates and a defined storage place that stays reachable during an IT outage, for example a printed copy.
03: Clause 8
Operation: the core of business continuity
Clause 8 is where this standard differs from every other management system. Most of the effort goes here, and most gaps show up here.
If the business impact analysis is missing, the rest of the clause has no foundation. Start with it.
Business impact analysis with prioritised activities
Typical evidence: a table of activities, ranked by the damage a stoppage causes, with the maximum acceptable downtime agreed with each process owner.
Recovery time and recovery point objectives are set
Typical evidence: an RTO and an RPO per critical activity, plus a check by IT that backups and restore times match them.
Risks of disruption are assessed and treated
Typical evidence: a risk assessment covering premises, IT, people and suppliers, with decisions on each risk and an owner for each measure.
Continuity strategies and solutions are implemented
Typical evidence: decisions on an alternative site, home office, a second supplier or buffer stock, and proof that they exist, such as a contract or an installed system.
Plans and the crisis organisation are documented
Typical evidence: a plan per critical activity with trigger, first steps, contacts and recovery order, and a crisis team description with a meeting place.
Plans are exercised
Typical evidence: an exercise schedule, a short report after each test, such as a restore from backup or a call tree run, and a list of actions that came out of it.
04: Clauses 9 and 10
Performance evaluation and improvement
Clauses 9 and 10 ask whether the system works in practice. A plan that has never been tested or reviewed does not meet them, however well it is written.
Monitoring and measurement
Typical evidence: records of the objectives from clause 6, for example test results, restore times and the share of staff briefed.
Internal audit
Typical evidence: an audit plan and a report by someone who does not own the process being checked.
Management review
Typical evidence: minutes of a meeting where management looked at audit results, exercise reports and changes in the business, with decisions recorded.
Nonconformities and corrective action
Typical evidence: a log of findings with cause, action, owner and closing date.
Continual improvement
Typical evidence: plans updated after a test or an incident, with the change visible in the version history.
05: Evidence
What to keep in your evidence folder
Keep everything in one folder, digital is fine. A purchasing department or a customer auditor asks for the same few documents again and again, so it saves time to have them ready.
| Clause | Typical document | Usually held by |
|---|---|---|
| 4 Context | Scope statement and list of interested parties | Management or quality manager |
| 5 Leadership | Signed policy and role description | Management |
| 6 Planning | Risk register and objectives | Quality or risk manager |
| 7 Support | Training records and contact list | HR and office management |
| 8 Operation | Business impact analysis, RTO and RPO table, continuity plans | Process owners and IT |
| 9 Performance evaluation | Exercise reports, audit report, review minutes | Quality manager |
| 10 Improvement | Corrective action log | Quality manager |
Gaps are normal at the first pass. Mark each point as covered, partly covered or missing, and work on the missing ones in the order of clause 8.
06: Zertify
Where does the Zertify self-assessment fit in?
The checklist above is a working tool for your own preparation. The Zertify assessment is the step that leads to the certificate. It has 34 yes/no questions for ISO 22301. Thirteen of them are must-meet questions and all must be answered yes. Of the other 21, at least 14 must be yes. The questions cover the core points of the assessment, not every requirement of the standard, so the checklist stays useful for your internal work.
SICE reviews every assessment. After you pass and pay, the certificate is issued by Zertify under licence from SICE within 4 hours. It carries a number and a QR code, and anyone can check it on the public verification page. The price is CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. The certificate is valid for 3 years, and you need no account to buy.
07: FAQ
Questions about the ISO 22301 checklist
It follows clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and improvement. The heaviest part is clause 8 with the business impact analysis, recovery objectives, continuity plans and exercises. For each point you need evidence, such as a document, a record or a test report.
Start with the business impact analysis. It tells you which activities are critical and how long each may be down. The recovery objectives, strategies and plans all build on it.
The standard asks for exercises at planned intervals, and you define those intervals. Set them so that every critical plan is tested at least once in a cycle you can defend to a customer, and write down the results.
Yes. The standard sets requirements for the result, not for the size of the organisation. A small company can keep short plans and a simple impact table, and use an external IT provider as long as the recovery times are agreed in writing.
No. The assessment has 34 yes/no questions on the core points. The checklist is more detailed and helps you build the evidence behind your answers.
Ask whether a stranger could read the document and understand what to do and who does it. For exercises, check that a dated report and resulting actions exist. If a point rests on a verbal agreement, write it down.
08: Guide
Related pages
Check your ISO 22301 readiness
Answer 34 yes/no questions and see whether your business continuity system passes.
Free and without registration.