ISO 22301 · Business continuity

Business
Continuity

A management system built on ISO 22301 to keep operating when something goes down, and to be able to prove it.

See what you can engage Request proposal

Why this programme

Having a plan is not the same as being able to run it

Almost every organisation that calls us already has a continuity plan. It is written, approved and filed away. What they do not have is any certainty that it works: nobody has ever run it, the phone numbers in it are out of date, and the person who knew how to do it left two years ago.

The standard devotes an entire clause to exercises

ISO 22301 makes that distinction explicit: its clause 8.5 requires an exercise programme, and 8.6 requires evaluating continuity capabilities. Documenting is not enough; you have to test and leave a record that you tested.

And it all starts with the business impact analysis: which processes cannot stop, how long they can hold out and how much data you can afford to lose. Without those figures agreed with the business —not with IT—, any plan is an expensive assumption.

What it builds on

The standard

NCh-ISO 22301:2020 — Chilean standard from the INN, an adoption of ISO 22301:2019

Methodology we bring

ISO 22317 — business impact analysis
ISO 22313 — implementation guidance
ISO 31000 — risk management

It integrates with ISO 27001: continuity of information security is an Annex A control, and anyone who already has an ISMS reuses context, roles and internal audit.

How we work

Seven Phases, Concrete Deliverables

They run through clauses 4 to 10 of the standard. Estimated duration of 4 to 7 months depending on the number of critical processes and sites.

Fase 1 of 7 Diagnosis and scope

A gap assessment against ISO 22301 and a defined system scope: which sites, which processes and which services are included. An executive report for top management.
Fase 2 of 7 Governance

Continuity policy, roles for the continuity and crisis teams, and measurable objectives approved by top management.
Fase 3 of 7 Impact analysis

The BIA: prioritised processes with their maximum tolerable period of disruption, and the recovery time and recovery point objectives agreed with each area of the business.
Fase 4 of 7 Risks and strategies

Continuity risk assessment and the strategies chosen for each critical process, with their cost and their resource requirements.
Fase 5 of 7 Plans and procedures

Continuity and recovery plans, activation procedures, call tree and crisis communication protocol, including communication to clients and to the authority.
Fase 6 of 7 Exercises

An exercise programme with at least one actually run —desktop or field— with its results report and the corrections applied to the plans.
Fase 7 of 7 Verification

Assessment of capabilities, internal audit, management review and preparation for certification.

The exercise is run, not written up

Phase 6 ends with an exercise actually run and its report, not with a procedure describing how it would be done. That is where the phone numbers that no longer exist turn up, and the backups nobody had ever tried to restore — and it is cheaper to find out in a drill.

What you can engage

Scopes of the Programme

The gap assessment can be engaged on its own: it is a useful diagnosis in itself and commits you to nothing. Inside the full programme it comes at a discount.