Business Continuity Management System according to ISO 22301

ISO 22301 is the international standard that specifies the requirements for a Business Continuity Management System (BCMS). Its purpose is to prepare an organisation to continue operating and delivering its products and services at an acceptable level when an unexpected event disrupts its operations, such as a natural disaster, fire, power outage, failure of or cyber-attack on its information systems, a pandemic or the failure of a critical supplier.

The standard helps organisations identify their critical activities in advance, assess the risks that threaten them and plan how to respond and how to return quickly to normal operation, limiting financial losses and damage to their reputation.

The development of a Business Continuity Management System includes:

• Defining the scope and the business continuity policy.
• Business Impact Analysis (BIA) to identify critical activities and the resources they require.
• Setting the maximum tolerable period of disruption and the recovery objectives (RTO, RPO) for each critical activity.
• Assessment of the risks that could disrupt operations.
• Selection of business continuity strategies and solutions (alternative premises, backups, alternative suppliers, etc.).
• Preparation of Business Continuity and Crisis Management Plans, with clear roles and responsibilities.
• Staff training and exercising / testing of the plans.
• Monitoring, internal audits, management review and continual improvement.

The benefits of applying ISO 22301:

• Faster and organised response to incidents that disrupt operations.
• Reduced downtime, financial losses and recovery costs.
• Protection of the organisation’s reputation and the trust of customers, partners and investors.
• Compliance with contractual and regulatory requirements, such as those arising from the NIS2 Directive and the DORA Regulation for the financial sector.
• Competitive advantage in tenders and partnerships that require documented resilience.

ISO 22301 can be applied to any company or organisation, regardless of its size or the type of its activities. Its implementation leads to certification, following an audit carried out by a Certification Body, and it can be developed alongside or integrated with other Management Systems, such as ISO 27001 for Information Security and ISO 9001 for Quality.

Our services

• Assessment of the current situation and gap analysis against the requirements of the standard.
• Business Impact Analysis (BIA) and risk assessment.
• Preparation of the system documentation and the Business Continuity Plans, so that the system complies with the requirements of ISO 22301.
• Staff training and organisation of exercises.
• Internal audits and support until successful certification by a Certification Body.

For more information on Management Systems, please see the Information material section.