When operations are disrupted, recovery needs to cover more than IT systems. It may also depend on people, sites, suppliers, and customer deliveries. ISO 22301 planning can begin by identifying which activities cannot stop for long, then determining the resources, alternatives, and decision responsibilities needed.
Service category and standard status
Management System Auditing (MS)
Depending on organizational scope and the applicable edition, work may cover system implementation, internal audits, supplier audits, or preparation for an external audit. An independent certification body decides whether to issue a certificate under its own procedures.
This work focuses on business impact analysis, recovery priorities, continuity strategies, and exercises.
Who it applies to and when to start
Review continuity needs when customers require uninterrupted supply, the organization depends heavily on one site or supplier, or it has experienced a shutdown or system failure. Restructuring, service changes, and new critical systems may also affect existing plans.
Common business challenges
Backups succeed but the business still stops because people or equipment are unavailable; one department sets recovery times without connecting them to customer and business impacts; a contact list is complete but no one knows who may activate the plan; or an exercise follows a script without testing resource conflicts and decisions.
Approach and applicable requirements
The ISO catalogue lists ISO 22301:2019 and Amendment 1:2024 as business continuity management system requirements. Its focus is to prepare, respond, and maintain or restore an appropriate level of delivery after disruption. It should not be described as a guarantee of zero interruption.
Possible topics include business impact analysis, critical activities and dependencies, risks, continuity strategies and resources, activation and communication, continuity and recovery plans, exercises, and improvement. Recovery time objectives need to connect to business impact and acceptable service capacity; IT recovery time alone is not a substitute.
Support and work stages
Confirm which deliveries need priority recovery
Work with business and support teams to record how disruption impacts change over time, customer commitments, and dependent resources. Prepare business-impact and priority records.
Compare feasible continuity strategies
Discuss alternate sites, staffing, suppliers, and information resources. Review capability limits, costs, and prerequisites so objectives are supported by resources.
Write and review the plans
Organize activation authority, roles, contacts, and recovery steps into usable plans, then choose suitable scenarios for a tabletop or other authorized exercise.
Track exercise and change impacts
Include exercise findings, incident lessons, and organizational changes in updates. Outputs may include resource gaps, assigned improvements, and management-review topics.
Information to prepare
Prepare key products and services, customer delivery commitments, departmental activities and resource dependencies, suppliers and site information, historical disruptions, current response and backup plans, and exercise records. Mark recovery capabilities that have not been tested as assumptions.
Assessing schedule and fees
The number of departments, sites, critical activities, and the depth of exercises affect timing and require owners to participate in decisions. Backup equipment, alternate sites, system changes, and resource purchases need separate budgets; documents alone do not build recovery capability.
Frequently asked questions
Are data backups enough?
Backups are only one possible resource. Confirm that business activities, people, sites, and suppliers can support recovery too.
Must we buy a backup data center first?
Understand business impacts and feasible strategies before deciding whether a specific facility is needed. This avoids buying infrastructure before confirming its use.
Can IT set the recovery time by itself?
Business owners and relevant resource teams need to confirm it together. Objectives must reflect delivery needs and achievable capability.
Must an exercise stop normal operations?
Not always. Exercises can be designed in stages according to their purpose. Tests affecting live operations need separate authorization, risk controls, and recovery arrangements.
How often should plans be updated?
In addition to routine review, changes to important activities, resources, or responsibilities, as well as incidents and exercise findings, may require updates.
Does completing consulting work guarantee a certificate?
The relevant body decides whether to assess and certify under its procedures. Project work should first support actual continuity capability and improvement.
Related services and enquiries
For service delivery, see ISO/IEC 20000-1. When you discuss business continuity with Captain International, start with the delivery that can least tolerate interruption and its current dependencies.