ISO 22301 requirements, clause by clause

ISO 22301:2019 follows the high level structure that ISO 9001, ISO 14001 and ISO 27001 also use. Clauses 1 to 3 cover scope, references and terms. The requirements you have to meet sit in clauses 4 to 10.

Clauses 4 to 7 build the frame around the system. They are short on technology and long on decisions: who is responsible, what is in scope, which resources are reserved.

Clause 4, Context

You describe your business, the parties with expectations towards it (customers, regulators, insurers, staff) and the scope of the continuity system. The scope names the sites, services and processes covered.

Clause 5, Leadership

Management owns the system. That means a business continuity policy, named roles for continuity and crisis work, and visible support with time and budget.

Clause 6, Planning

You set continuity objectives, for example the maximum tolerable downtime of the order system. You also plan how to deal with risks and how to change the system in a controlled way.

Clause 7, Support

People are trained and aware of their role in an incident. Communication channels are defined, and documents are controlled so that the current plan is the one people find.

Clause 8 is where a continuity system differs from other management systems. It asks for evidence that you can restart critical work after an outage. A policy on its own does not give that evidence.

The work follows a fixed order. Each step feeds the next.

1. 01

   Business impact analysis

   List your activities and rank them by the damage a stop causes over time. The result is a prioritised list: invoicing may wait three days, customer support may not.

2. 02

   Recovery objectives

   For each prioritised activity you set a recovery time objective (RTO), the time until it runs again, and a recovery point objective (RPO), the amount of data you can afford to lose.

3. 03

   Risk assessment

   You assess the risks of disruption to those activities, such as a failed data centre, a supplier that stops delivering, a fire or a pandemic, and decide how to treat them.

4. 04

   Continuity strategies and solutions

   You choose the measures that meet the RTO and RPO: a second site, backups restored on a schedule, an alternative supplier, remote working.

5. 05

   Plans and crisis organisation

   Business continuity plans state who does what, in which order, with which contact details. The crisis team and its decision rights are written down.

6. 06

   Exercises

   Plans are tested, from a desktop walk-through to a real restore. Results are recorded and the plan is corrected where the exercise exposed gaps.

A plan that is never reviewed ages quickly. Staff change, systems move to the cloud, suppliers are replaced. Clauses 9 and 10 make sure the system follows the business.

Monitoring and measurement

You decide what to measure, for instance exercise results against the RTO, and keep the figures.

Internal audit

Someone who did not write the plans checks them against the standard and your own rules, at planned intervals.

Management review

Management looks at audit results, incidents, exercises and changes in the business, and records decisions.

Nonconformity and corrective action

When an exercise fails or a plan is out of date, you record the cause, fix it and check that the fix worked.

Continual improvement

The system gets better with each cycle. The evidence is the trail of changes after audits, reviews and incidents.

The standard names documented information at several points. The table shows what a small or medium business typically keeps for each clause. The form can be short, as long as it is current and approved.

No law makes ISO 22301 compulsory for a company in general. The request usually comes from a customer. IT and cloud providers, suppliers to banks and insurers, logistics firms, manufacturers inside supply chains, healthcare and energy suppliers and outsourcing providers meet it most often.

In a supplier questionnaire or a tender, the purchasing department wants to see recovery objectives and proof that plans were tested. A certificate answers that question before it is asked.

• ISO for small and medium businesses

You answer 34 yes/no questions online. Thirteen are must-meet questions and all need a yes. They cover the core of the assessment, not every requirement of the standard. Of the other 21 questions, at least 14 need a yes.

SICE reviews every assessment. After you pass and pay, the certificate is issued by Zertify under licence from SICE within 4 hours. It carries a number and a QR code, and anyone can check it on the public verification page. There is no on-site audit.

The price is CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. The certificate is valid for 3 years. Readers who want to compare this with the classic route, an on-site audit by a certification body, will find the points side by side in the guide.

• Start the free self-assessment
• ISO 22301 certificate
• Pricing
• Compare certification routes