Before an incident, decide which production line to restore first after a power failure and how much can still be delivered if a key supplier stops shipping. This page uses ISO 22313 as a reference and proposes a discussion path from delivery needs to recovery exercises, so time, people, and resources in a plan can be checked against one another.
Who it applies to and when to start
Organizations with an emergency manual that has not been tested, customer requirements for uninterrupted supply, or a recent site or critical-system change can begin by reviewing one important delivery. Business, production, IT, and purchasing contacts should participate.
Common business challenges
For example, if a customer can wait two days but restarting equipment takes three, that is a capability gap requiring a decision. Copying each department's recovery time into one table does not resolve contradictions. A list of alternate suppliers is also insufficient if capacity, contracts, or switching conditions are missing.
Approach and applicable requirements
ISO 22313:2020 provides guidance on applying the ISO 22301 business continuity management system and supports organizations in maintaining a predefined acceptable capability during disruption. It does not replace ISO 22301 management-system requirements. See the ISO overview.
The following is a possible project scope for discussion. These arrangements are suggested working methods; the actual services must be agreed after confirming requirements.
Deliveries and dependencies
Start with one product or service. Record the consequences of disruption, acceptable delay, and required resources, then identify whether recovery priority is constrained by upstream activities.
Feasible recovery options
List alternative sites, delegated staff, equipment, and supply sources. For each option, record supported capacity, the person who activates it, and conditions that remain unconfirmed.
Exercises and updates
Turn decisions in the plan into tabletop scenarios. Check whether contacts, approvals, and handoffs can be completed, then assign responsibility for updates after staffing or operational changes.
Support and work stages
1. Select one delivery chain
Interview activity owners, map deliveries and dependencies, and list recovery assumptions that conflict.
2. Compare acceptable options
Estimate the time and resources each option needs. Management decides priorities and remaining tolerable constraints.
3. Walk through a disruption scenario
Under an agreed scenario, record when information arrives, the decisions made, and actions remaining. A real switch test needs separate approval, stop conditions, and rollback arrangements.
4. Write findings back into the plan
Assign an owner and retest method to each gap. After revision, confirm that handoff contacts know which version is current.
Suggested outputs and acceptance checks
Possible deliverables include a dependency map, recovery-option comparison, exercise records, and an improvement tracker. During review, trace a customer delivery to the required resources, activation responsibility, and feasible time. Mark untested capabilities separately.
Information to prepare
- Key deliveries, order commitments, and customer tolerance for disruption.
- Critical equipment, systems, workplaces, people, and suppliers.
- Existing business impact analysis, backup agreements, and contacts.
- Past disruptions, recovery times, and exercise results.
For an initial discussion, use an information inventory and de-identified examples. Share project data only after confirming its purpose, access, and retention arrangements.
Assessing schedule and fees
Estimate based on the number of activities and sites, confirmation of external resources, and exercise type. Tabletop exercises, live system switching, and cross-site coordination require different levels of effort. Backup equipment, IT engineering, and third-party certification should be budgeted separately.
Frequently asked questions
If we back up data daily, what else should we check?
In addition to restoration time, confirm who can operate the systems, whether equipment is available, and whether upstream and downstream processes can continue delivery.
Must an exercise stop production?
Start with a tabletop exercise to identify gaps. A live switch test needs approval according to operational risk; production should not be used as an unapproved test environment.
Can ISO 22313 replace the basis for ISO 22301 certification?
No. ISO 22313 explains application; ISO 22301 provides the relevant management-system requirements.
How can a small company start?
Choose one service that cannot stop for long, confirm its owner, alternatives, and contact method, and then expand gradually.
Can a plan promise that operations will never stop?
State the capability and scenarios it covers. Disruption may still occur when events exceed available resources or assumptions.
When should we reassess?
Review relevant arrangements when critical people, systems, sites, or supplier relationships change, or when exercises show that an assumption no longer holds.
Related services and enquiries
For a discussion, bring a process map for one important delivery, its currently tolerable downtime, and the disruption you are most concerned about. Contact Captain International.