business continuity plan requirements

What Is A Business Continuity Plan? [+ Template & Examples]

Published: December 30, 2022

When a business crisis occurs, the last thing you want to do is panic.

executives discussing business continuity plan

The second-to-last thing you want to do is be unprepared. Crises typically arise without warning. While you shouldn't start every day expecting the worst, you should be relatively prepared for anything to happen.

A business crisis can cost your company a lot of money and ruin your reputation if you don't have a business continuity plan in place. Customers aren't very forgiving, especially when a crisis is influenced by accidents within the company or other preventable mistakes. If you want your company to be able to maintain its business continuity in the face of a crisis, then you'll need to come up with this type of plan to uphold its essential functions.

In this post, we'll explain what a business continuity plan is, give examples of scenarios that would require a business continuity plan, and provide a template that you can use to create a well-rounded program for your business.

Table of Contents:

What is a business continuity plan?

Business Continuity Types
Business Continuity vs Disaster Recovery

Business Continuity Plan Template

How to write a business continuity plan.

Business Continuity Examples

A business continuity plan outlines directions and procedures that your company will follow when faced with a crisis. These plans include business procedures, names of assets and partners, human resource functions, and other helpful information that can help maintain your brand's relationships with relevant stakeholders. The goal of a business continuity plan is to handle anything from minor disruptions to full-blown threats.

For example, one crisis that your business may have to respond to is a severe snowstorm. Your team may be wondering, "If a snowstorm disrupted our supply chain, how would we resume business?" Planning contingencies ahead of time for situations like these can help your business stay afloat when you're faced with an unavoidable crisis.

When you think about business continuity in terms of the essential functions your business requires to operate, you can begin to mitigate and plan for specific risks within those functions.

Crisis Communication and Management Kit

Manage, plan for, and communicate during your corporate crises with these crisis management plan templates.

Free Crisis Management Plan Template
12 Crisis Communication Templates
Post-Crisis Performance Grading Template
Additional Crisis Best Management Practices

You're all set!

Click this link to access this resource at any time.

Business Continuity Planning

Business continuity planning is the process of creating a plan to address a crisis. When writing out a business continuity plan, it's important to consider the variety of crises that could potentially affect the company and prepare a resolution for each.

Don't forget to share this post!

How to Navigate Customer Service During a Business Closure

10 Crisis Communication Plan Examples (and How to Write Your Own)

I Tried 7 Crisis Management Software to See if They’re Worth It (Results & Recommendations)

20 Crisis Management Quotes Every PR Team Should Live By

Social Media Crisis Management: Your Complete Guide [Free Template]

De-Escalation Techniques: 19 Best Ways to De-Escalate [Top Tips + Data]

Situational Crisis Communication Theory and How It Helps a Business

What Southwest’s Travel Disruption Taught Us About Customer Service

Showcasing Your Crisis Management Skills on Your Resume

What Is Contingency Planning? [+ Examples]

Manage, plan for, and communicate during a corporate crisis.

Service Hub provides everything you need to delight and retain customers while supporting the success of your whole front office

An official website of the United States government

Here’s how you know

Official websites use .gov A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS A lock ( Lock A locked padlock ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Business Continuity Planning

Organize a business continuity team and compile a business continuity plan to manage a business disruption. Learn more about how to put together and test a business continuity plan with the videos below.

Business Continuity Plan Supporting Resources

Business Continuity Plan Situation Manual
Business Continuity Plan Test Exercise Planner Instructions
Business Continuity Plan Test Facilitator and Evaluator Handbook

Business Continuity Training Videos

The Business Continuity Planning Suite is no longer supported or available for download.

Business Continuity Training Introduction

An overview of the concepts detailed within this training. Also, included is a humorous, short video that introduces viewers to the concept of business continuity planning and highlights the benefits of having a plan. Two men in an elevator experience a spectrum of disasters from a loss of power, to rain, fire, and a human threat. One man is prepared for each disaster and the other is not.

View on YouTube

Business Continuity Training Part 1: What is Business Continuity Planning?

An explanation of what business continuity planning means and what it entails to create a business continuity plan. This segment also incorporates an interview with a company that has successfully implemented a business continuity plan and includes a discussion about what business continuity planning means to them.

Business Continuity Training Part 2: Why is Business Continuity Planning Important?

An examination of the value a business continuity plan can bring to an organization. This segment also incorporates an interview with a company that has successfully implemented a business continuity plan and includes a discussion about how business continuity planning has been valuable to them.

Business Continuity Training Part 3: What's the Business Continuity Planning Process?

An overview of the business continuity planning process. This segment also incorporates an interview with a company about its process of successfully implementing a business continuity plan.

Business Continuity Training Part 3: Planning Process Step 1

The first of six steps addressed in this Business Continuity Training, which detail the process of building a business continuity plan. This step addresses how organizations should “prepare” to create a business continuity plan.

Business Continuity Training Part 3: Planning Process Step 2

The second of six steps addressed in this Business Continuity Training, which detail the process of building a business continuity plan. This step addresses how organizations should “define” their business continuity plan objectives.

Business Continuity Training Part 3: Planning Process Step 3

The third of six steps addressed in this Business Continuity Training, which detail the process of building a business continuity plan. This step addresses how organizations should “identify” and prioritize potential risks and impacts.

Business Continuity Training Part 3: Planning Process Step 4

The fourth of six steps addressed in this Business Continuity Training, which detail the process of building a business continuity plan. This step addresses how organizations should “develop” business continuity strategies.

Business Continuity Training Part 3: Planning Process Step 5

The fifth of six steps addressed in this Business Continuity Training, which detail the process of building a business continuity plan. This step addresses how organizations should define their “teams” and tasks.

Business Continuity Training Part 3: Planning Process Step 6

The sixth of six steps addressed in this Business Continuity Training, which detail the process of building a business continuity plan. This step addresses how organizations should “test” their business continuity plans. View on YouTube

Last Updated: 12/21/2023

Return to top

Search Search Please fill out this field.
Business Continuity Plan Basics
Understanding BCPs
Benefits of BCPs
How to Create a BCP
BCP & Impact Analysis
BCP vs. Disaster Recovery Plan

Frequently Asked Questions

Business Continuity Plan FAQs

The Bottom Line

What is a business continuity plan (bcp), and how does it work.

Investopedia / Ryan Oakley

What Is a Business Continuity Plan (BCP)?

A business continuity plan (BCP) is a system of prevention and recovery from potential threats to a company. The plan ensures that personnel and assets are protected and are able to function quickly in the event of a disaster.

Key Takeaways

Business continuity plans (BCPs) are prevention and recovery systems for potential threats, such as natural disasters or cyber-attacks.
BCP is designed to protect personnel and assets and make sure they can function quickly when disaster strikes.
BCPs should be tested to ensure there are no weaknesses, which can be identified and corrected.

Understanding Business Continuity Plans (BCPs)

BCP involves defining any and all risks that can affect the company's operations, making it an important part of the organization's risk management strategy. Risks may include natural disasters—fire, flood, or weather-related events—and cyber-attacks . Once the risks are identified, the plan should also include:

Determining how those risks will affect operations
Implementing safeguards and procedures to mitigate the risks
Testing procedures to ensure they work
Reviewing the process to make sure that it is up to date

BCPs are an important part of any business. Threats and disruptions mean a loss of revenue and higher costs, which leads to a drop in profitability. And businesses can't rely on insurance alone because it doesn't cover all the costs and the customers who move to the competition. It is generally conceived in advance and involves input from key stakeholders and personnel.

Business impact analysis, recovery, organization, and training are all steps corporations need to follow when creating a Business Continuity Plan.

Benefits of a Business Continuity Plan

Businesses are prone to a host of disasters that vary in degree from minor to catastrophic. Business continuity planning is typically meant to help a company continue operating in the event of major disasters such as fires. BCPs are different from a disaster recovery plan, which focuses on the recovery of a company's information technology system after a crisis.

Consider a finance company based in a major city. It may put a BCP in place by taking steps including backing up its computer and client files offsite. If something were to happen to the company's corporate office, its satellite offices would still have access to important information.

An important point to note is that BCP may not be as effective if a large portion of the population is affected, as in the case of a disease outbreak. Nonetheless, BCPs can improve risk management—preventing disruptions from spreading. They can also help mitigate downtime of networks or technology, saving the company money.

How To Create a Business Continuity Plan

There are several steps many companies must follow to develop a solid BCP. They include:

Business Impact Analysis : Here, the business will identify functions and related resources that are time-sensitive. (More on this below.)
Recovery : In this portion, the business must identify and implement steps to recover critical business functions.
Organization : A continuity team must be created. This team will devise a plan to manage the disruption.
Training : The continuity team must be trained and tested. Members of the team should also complete exercises that go over the plan and strategies.

Companies may also find it useful to come up with a checklist that includes key details such as emergency contact information, a list of resources the continuity team may need, where backup data and other required information are housed or stored, and other important personnel.

Along with testing the continuity team, the company should also test the BCP itself. It should be tested several times to ensure it can be applied to many different risk scenarios . This will help identify any weaknesses in the plan which can then be corrected.

In order for a business continuity plan to be successful, all employees—even those who aren't on the continuity team—must be aware of the plan.

Business Continuity Impact Analysis

An important part of developing a BCP is a business continuity impact analysis. It identifies the effects of disruption of business functions and processes. It also uses the information to make decisions about recovery priorities and strategies.

FEMA provides an operational and financial impact worksheet to help run a business continuity analysis. The worksheet should be completed by business function and process managers who are well acquainted with the business. These worksheets will summarize the following:

The impacts—both financial and operational—that stem from the loss of individual business functions and process
Identifying when the loss of a function or process would result in the identified business impacts

Completing the analysis can help companies identify and prioritize the processes that have the most impact on the business's financial and operational functions. The point at which they must be recovered is generally known as the “recovery time objective.”

Business Continuity Plan vs. Disaster Recovery Plan

BCPs and disaster recovery plans are similar in nature, the latter focuses on technology and information technology (IT) infrastructure. BCPs are more encompassing—focusing on the entire organization, such as customer service and supply chain.

BCPs focus on reducing overall costs or losses, while disaster recovery plans look only at technology downtimes and related costs. Disaster recovery plans tend to involve only IT personnel—which create and manage the policy. However, BCPs tend to have more personnel trained on the potential processes.

Why Is Business Continuity Plan (BCP) Important?

Businesses are prone to a host of disasters that vary in degree from minor to catastrophic and business continuity plans (BCPs) are an important part of any business. BCP is typically meant to help a company continue operating in the event of threats and disruptions. This could result in a loss of revenue and higher costs, which leads to a drop in profitability. And businesses can't rely on insurance alone because it doesn't cover all the costs and the customers who move to the competition.

What Should a Business Continuity Plan (BCP) Include?

Business continuity plans involve identifying any and all risks that can affect the company's operations. The plan should also determine how those risks will affect operations and implement safeguards and procedures to mitigate the risks. There should also be testing procedures to ensure these safeguards and procedures work. Finally, there should be a review process to make sure that the plan is up to date.

What Is Business Continuity Impact Analysis?

An important part of developing a BCP is a business continuity impact analysis which identifies the effects of disruption of business functions and processes. It also uses the information to make decisions about recovery priorities and strategies.

FEMA provides an operational and financial impact worksheet to help run a business continuity analysis.

These worksheets summarize the impacts—both financial and operational—that stem from the loss of individual business functions and processes. They also identify when the loss of a function or process would result in the identified business impacts.

Business continuity plans (BCPs) are created to help speed up the recovery of an organization filling a threat or disaster. The plan puts in place mechanisms and functions to allow personnel and assets to minimize company downtime. BCPs cover all organizational risks should a disaster happen, such as flood or fire.

Federal Emergency Management Agency. " Business Process Analysis and Business Impact Analysis User Guide ." Pages 15 - 17.

Ready. “ IT Disaster Recovery Plan .”

Federal Emergency Management Agency. " Business Process Analysis and Business Impact Analysis User Guide ." Pages 15-17.

Terms of Service
Editorial Policy
Privacy Policy
Your Privacy Choices

ISO 22301 Business Continuity Simplified: Fortify Your Business Against Disruption

By Andy Marker | June 22, 2020 (updated September 15, 2022)

Share on Facebook
Share on LinkedIn

Link copied

In this article, you’ll find expert tips and implementation guides, and you'll learn how ISO 22301 can buffer your business against disasters.

Included on this page, you’ll find an International Standards Organization (ISO) 22301 audit checklist template , a simplified ISO 22301 cheat-sheet , and an ISO 22301 self-assessment checklist , as well as examples of ISO 22301 in action and an ISO 22301 quick-start guide .

What Is ISO 22301?

ISO 22301 is a global standard for business continuity planning requirements to help organizations protect themselves against disruptions. The most current version is 22301:2019, Security and resilience - Business continuity management systems - Requirements.

The requirements in ISO 22301 address disruptive incidents that can be natural or human-made, widespread or local, intentional or unintentional, such as a snowstorm, a broken water main, an epidemic, a data breach, or a phishing attack. Large or small, for- and nonprofit organizations alike can use ISO 22301.

The Business Manager’s Quick-Start Guide to ISO 22301

The ISO 22301 standard can provide benefits for your business continuity planning, even if your organization chooses not to pursue certification, or the review process that confirms your business continuity system meets all ISO 22301 requirements.

"Certification is nice, but not required,” says Mart Rovers of InterProm. “First, seek compliance. That way, you know that your business continuity management practices are in better shape." You can start to create a solid business continuity plan with just a few simple steps, which you can also download as this ISO 22301 Quick-Start Guide .

Check If You Already Have Continuity Plans: Find out if your organization already has business continuity plans. Search through your document management system and ask management or long-time employees. Organizations sometimes create and quickly forget about resources, or store responses locally in an informal system. As Andrew Nichols of the Michigan Manufacturing Technology Center suggests, if your organization already implements other ISO standards, such as ISO 9001 or ISO 27000, you can leverage some of the common requirement elements for your 22301 plan.
Identify Missing Components: Conduct a gap analysis of existing policies and processes to see what business continuity resources you need. According to Mart Rovers, one way to conduct a self-assessment is to copy into a spreadsheet each phrase of the ISO 22301 standard that contains the word "shall." Then, determine gaps between your company and the standard. "Use the standard as your guide to establishing a coherent set of practices to address business continuity management for your organization," says Rovers. You can also use Smartsheet's ISO 22301 Self-Assessment Checklist and ISO 22301 Simplified Cheatsheet for your gap analysis.
Keep It Simple: Having binders full of perfectly formatted procedures won’t help in an emergency. Create easy-to-follow guidelines and checklists and, more importantly, build "muscle memory" in your employees through training and drills. That way, in a panic, people understand what to do without having to be told.
Make Your Plan a Living Document: Ticking off items on an audit checklist doesn't mean you’re prepared. Frequently read, revise, and practice your plan to keep it relevant and to train new staff.

Communicate Your Plan to Staff and Other Stakeholders: Even the most well-written plan is useless if the people who can benefit from it don't know about it. Inform everyone covered by the plan that it exists, including your supply chain and other outside stakeholders.

ISO 22301 Requirements

The ISO 22301 standard offers a framework for planning, testing, and monitoring a business continuity management system (BCMS). The ISO 22301 document contains 10 sections, which introduce the standard and definitions, as well as actionable requirements of the standard.

As with other ISO requirement documents, ISO 22301 describes only what organizations must do to reach minimum proficiency — it does not prescribe how to achieve these standards. Each organization must consider its distinct conditions and obligations to find the best way to follow the requirements.

Here is an overview of the clauses in ISO 22301 that impact an organization most:

Clause 4, Context: Your organization must understand what it is, what it does, and what outputs and processes it must sustain. You must also determine who has a stake in the continuity of your operations — in other words, the interested parties. For example, customers have a stake in your organization continuing to function.
Clause 5, Leadership: Few organizational initiatives thrive without the sustained support and championship of top management. Management must commit to a business continuity plan and make available any resources — human, financial, or otherwise — to ensure its success.
Clause 6, Planning: To plan for sustainability, you must understand what disruptions could potentially occur and how these incidents affect the business — in other words, potential risks and their impact. Set measurable business continuity objectives to guarantee the minimum viable products or services, as well as compliance with any legal or regulatory requirements.
Clause 7, Support: No program can advance without resources and support. Decide what personnel, roles, and teams you need for threat response and how you can best enhance their effectiveness. Create internal and external communication procedures for reference, and communicate the continuity plan to all necessary parties before and during a crisis. Establish a document management system for key continuity documents, such as procedures.
Clause 8, Operation: Conduct your risk assessment and business impact analysis , and plan your disruption recovery approach. Implement the recovery plan with detailed procedures, and test it regularly to verify that it works. Make sure people can find the procedures (and other documents) they need, and revise your plan as necessary.
Clause 9, Evaluation: Establish a process to regularly measure and assess your continuity policies and procedures and their execution. Review and revise your plan and documents to ensure they are effective and relevant
Clause 10, Improvement: Seek continual improvement in all functional and operational areas, including through periodic management reviews. Improvements in day-to-day activities help bolster the organization in times of disruption. When processes veer from the standard or fail to conform with ISO and quality management standards, implement corrective action.

Key Definitions Related to ISO 22301

Some of the following key terms and concepts originate with ISO, some with ISO 22301, and some with business continuity and risk management:

Context: The purpose and character of the organization and the environment in which it operates. This includes internal and external influences that shape the business continuity management system.
Disruptive Incident: A disruptive incident is an event that stops or slows the everyday work of an organization. Examples of disruptive incidents include earthquakes, internet stoppages, broken fans in a data center, or food poisoning in a cafeteria.
Interested Parties: Interested parties are stakeholders in the successful operation and outcomes of your business continuity plan. They can include customers, employees, suppliers, or regulatory officials.
Leadership: In ISO 22301, leadership refers to top management or the person or people who run the organization and champion the business continuity effort.
Maximum Acceptable Outage (MAO): The length of time an activity or process can be unavailable or ineffective before the health and survival of the organization are threatened.
Minimum Business Continuity Objective (MBCO) : The lowest level of products or services that is acceptable for a business to offer during a disruption.
Recovery Timeframe Objectives (RTO): This refers to the prioritization of key activities and the timing that makes those activities operational.

Benefits of ISO 22301 and Business Continuity Management System

If teams are already overwhelmed with their workload, they may not like to think about disasters. Furthermore, organizations might think that ISO standards include difficult jargon and that pursuing a continuity plan adds unnecessary work. However, management systems practitioners suggest that continuity preparations produce substantial gains.

“I think it's a truism that many organizations can benefit from the principles and some of the practices of resiliency and contingency planning,” says Andrew Nichols, Quality Program Manager at the Michigan Manufacturing Technology Center .

As an example of the benefits that risk analysis and preparation can yield, Nichols relates his experience of visiting a small northeastern town during a widespread winter power outage. The whole town was closed, with the exception of one restaurant that had a generator.

“They had a line of people out the door every mealtime because nowhere else was capable,” Nichols remembers. “Somebody had the foresight to think about the loss of power. And that organization cleaned up financially because they were able to provide what the customers needed.”

Consider these specific benefits to using ISO 22301 business continuity planning:

Protect against and recover from disruptive incidents.
Identify and control current and future threats.
Improve your risk management planning efforts.
Prevent large-scale damage.
Become proactive in preventing problems and recovering from incidents, rather than reactive to damage and disruption.
Reduce downtime and increase recovery time.
Keep important activities running during disruption.
Deliver quality products consistently.
Provide dependable service.
Prove you’re a reputable supplier.
Prove your resilience to all stakeholders.

Experts also assert that ISO 22301 can be a simple and effective continuity tool. “All these ISO standards, they’re like hidden gems because of how fast they can get you up to speed without having to reinvent the wheel,” says Mart Rovers, President of IT consulting firm InterProm .

“I cannot emphasize enough how within reach this standard is. Anytime people hear the word ‘ISO,’ they think, ‘Oh, that's for large organizations. Oh, that's way too formal. It's too much. It's overkill.’ I understand where this is coming from because the word ‘standard’ itself is scary for many organizations. However, the size of organization really doesn't matter. The things you should be doing in ISO 22301, you can do at a smaller scale,” says Rovers.

Some also hesitate at the thought of certification. Both Nichols and Rovers stress that certification is not necessary for every enterprise. Although certification may be a condition of doing business for some companies, those who don’t need certification can still gain advantages from following ISO 22301.

In weighing the pros and cons of ISO certification, Rovers suggests buying a copy of ISO 22301 , and then copying and pasting each sentence that contains the word “shall” into a spreadsheet (these sentences represent the requirements you must follow). From the spreadsheet, consider whether full ISO adoption and certification are too complicated for your organization. Regardless of your decision, you can always use the spreadsheet to conduct a self-audit.

ISO 22301 in Action

The following image provides a small sample of the possible outcomes to business continuity management.

How a Management System Helps Business Continuity

For those familiar with other ISO standards, the management system component of ISO 22301 might be a new concept. Rovers describes management systems as follows:

“The best way to explain a management system is to imagine opening up an old watch. It has these spinning wheels, these gears. In the case of an ISO standard, you're looking at a number of requirements to put that watch together with all these spinning wheels. That watch is a coherent system. You take out one of those gears, and then the watch fails.

“A management system for continuity follows the same idea — every requirement that the standard asks for represents one of those gears. And every requirement serves a distinct purpose (otherwise, it would not be a requirement). If you don't meet a particular requirement, the watch, so to speak, may not function as it could or should. These ISO requirements are not just there to keep you busy.”

ISO 22301 and PDCA

Each segment of the PDCA (plan-do-check-act) cycle for continuous improvement corresponds to at least one ISO 22301 clause. Organizations can use ISO 22301 to test continuity procedures, review outcomes, and implement updates or fix problems in a continuous cycle that leads to an increasingly resilient business continuity system.

ISO 22301 and Maturity Models

A maturity model measures an organization’s ability to pursue continuous improvement in key areas. ISO 22301 does not have a maturity model.

As Rovers explains, “It was never the intent of ISO 22301 to be a maturity model. You either meet all the requirements of the standard, or you don’t. You could say that by not meeting the requirements of the standard, you’re not mature. Or better said, your business continuity management practices are not mature.”

BCM Lifecycle ISO 22301

The business continuity management (BCM) lifecycle represents industry best practices and some of the core requirements of ISO 22301. These practices offer a solid foundation for resilience, while offering flexibility to adapt to changes in the organization.

Guided by leadership, these are the key activities for the lifecycle:

Conduct a business impact analysis and risk assessment.
Establish a business continuity strategy.
Establish and implement business continuity procedures.
Exercise and test the procedures regularly before a disruption occurs.

ISO 22301 Audit Checklist Template (Excel)

Use this detailed checklist to determine if your business continuity plan aligns with ISO 22301 standards. You can use the template whether you’re applying for certification or simply pursuing a continuity management plan.

Download ISO 22301 Audit Checklist Template

Excel | Smartsheet

ISO 22301 Self-Assessment Checklist

This self-assessment checklist is divided into sections that correspond to clauses in ISO 22301. Use it to confirm whether your business continuity system meets the requirements for leadership, planning, support, operation, performance evaluation, and continual improvement.

Download ISO 22301 Self-Assessment Checklist Template

Excel | Word | PDF

ISO 22301 Implementation Guide

This guide states the essential information from ISO 22301 in plain English. For best results, read it with the full standard, which is currently available for free online to support the COVID-19 response.

Download ISO 22301 Implementation Guide Template

Excel | Word | PDF

ISO 22301 Simplified Cheat-Sheet

Use this simplified cheat-sheet to understand the basic elements of creating a business continuity plan. The template walks you through the process of determining critical aspects of your organization, writing the recovery plan, and exercising the plan to ensure proficiency.

Download ISO 22301 Simplified Cheat-Sheet Template

ISO 22301 Business Continuity Policy Template

A business continuity policy describes the processes and procedures an organization needs in order to function well daily, including in times of disruption and crisis. This policy template includes space for BCMS objectives, a leadership description, a policy outline, and any certification details.

Download ISO 22301 Business Continuity Policy Template

ISO 22301 Business Continuity Template

ISO 22301 Business Continuity Plan Template

Use this template to create a business continuity plan. Describe the results of your risk analysis and business impact analysis, detail your disaster recovery and continuity procedures, and list key contacts and important assets.

Download ISO 22301 Business Continuity Template

Word | PDF

ISO 22301 Business Continuity Sample

The Community Nonprofit Center of New York made available this business continuity template to support the response to coronavirus. Find space to detail responses to minimal and critical emergencies, a risk matrix template, and lists for information about insurance, critical assets, and responses to disruptive events.

For other most useful free, downloadable business continuity plan (BCP) templates please read our "Free Business Continuity Plan Templates" article.

Disaster Recovery Plan Templates

After you perform a risk analysis and business impact analysis, consider writing a disaster recovery plan. Disaster recovery plan templates , available in different formats, provide an easy-to-use structure for documenting continuity plans. Download templates specialized for IT, payroll, small businesses, and more.

To learn about the difference between recovery plans and continuity plans, visit our "Business Continuity and Disaster Recovery: Their Differences and How They Work Together" article.

ISO 22301 Versus ISO 27301

ISO 27301 provides requirements that organizations use to ensure their information and communications technology (ICT) continuity, security, and readiness to survive a disruption. The standard is often staged with ISO 22301 because both are based on similar management system approaches.

The full name of this standard is ISO 27301 - Information Technology - Security Techniques . Originally published in 2011, it is soon to be revised.

“Both [ISO 27301 and ISO 22301] ask for top management involvement and commitment, both ask that you have the right resources, that you have documentation management, that you do performance evaluations, and that you make improvements,” explains Rovers.

They differ in the focus of the risk assessment: ISO 27001 addresses security, whereas ISO 22301 addresses business continuity. “Each area has different risks, but the approach to the risk management assessment and mitigation follows the same steps. There's enormous overlap.”

IT security continuity has significant relevance in the remote work environment. For example, while using your work laptop at home or signed into the work network, what happens when someone innocently plugs in a thumb drive that infects your laptop and corrupts the network? Both ISO 22301 and ISO 27001 work together to prevent such incidents and mitigate problems that occur.

For additional resources, visit " Free ISO 27001 Checklists and Templates ."

General Requirements Across Management System Standards

Some ISO requirements are commonly stated across the management system standards, which include ISO 22301; ISO 9001 , Quality Management; ISO 20000, IT Service Management; and ISO 27001, Information Security. Examples of common requirements include establishing objectives for the business continuity management system as appropriate to the organization, obtaining management’s commitment to supporting the system, implementing a documentation management system, conducting internal audits, and pursuing continual improvement. This functional overlap enables organizations to undertake combined audits for these standards.

Historical Foundations of ISO 22301

The concept of business continuity was borne out of the IT boom of the 1980s and 1990s. Public and private organizations realized the need to ensure continuity of service and key supplies and to mitigate the effects of disruptive events. The first formal standard reflecting these concerns was the United Kingdom’s British Standard (also known as BS) 25999, which introduced the management system concept to the business continuity discipline.

In 2012, the global standards body ISO released ISO 22301:2012 as the first international standard for business continuity. Based on the contributions and comments of continuity professionals from assorted industries in over 60 countries, ISO 22301 superseded BS 25999.

ISO’s consensus-based standards, such as 22301, cover practices and industries ranging from quality management, IT service, and food safety to environmental safety and information security. ISO standards aim to increase the quality and safety of many products and services, including most common household items, appliances, and cars. Although large enterprises and manufacturers usually follow ISO requirements and guidelines, organizations of all sizes and types can benefit from ISO principles.

For ISO 22301, the standard provides a consistent BCMS framework and a universal language among organizations for communicating about continuity and aligning processes.

When they get certified in ISO 22301 and other ISO standards, organizations can demonstrate to management, legislators, regulators, customers, and other stakeholders that they follow good practices. For ISO certification, organizations need third-party verification that they comply with all requirements of a standard.

“Certification shows you have some level of competence,” explains Rovers. “It shows you take the standard seriously. For organizations buying your goods or services, it can be a compelling reason to choose you.”

Guidance Documents for ISO 22301

For in-depth discussions of aspects of the 22301 standard, ISO offers a series of guidance documents. To those considering pursuing ISO 22301 certification, these documents provide additional insight:

ISO 22313 - Security and resilience — Business continuity management systems — Guidance on the use of ISO 22301
ISO 22316 - Security and resilience — Organizational resilience — Principles and attributes
ISO 22317 - Societal security — Business continuity management systems — Guidelines for business impact analysis (BIA)
ISO 22318 - Societal security — Business continuity management systems — Guidelines for supply chain continuity
ISO 22330 - Security and resilience — Business continuity management systems — Guidelines for people aspects of business continuity
ISO 22331 - Security and resilience — Business continuity management systems — Guidelines for business continuity strategy

What Is the Latest Version of ISO 22301?

The requirement document ISO 22301:2019, Security and resilience - Business continuity management systems - Requirements , was released on October 31, 2019. The update from the original 2012 version reflects changes in management system approaches and clarifies specifications around clause 8.

Build Powerful, Automated Business Processes and Workflows with Smartsheet

Empower your people to go above and beyond with a flexible platform designed to match the needs of your team — and adapt as those needs change.

The Smartsheet platform makes it easy to plan, capture, manage, and report on work from anywhere, helping your team be more effective and get more done. Report on key metrics and get real-time visibility into work as it happens with roll-up reports, dashboards, and automated workflows built to keep your team connected and informed.

When teams have clarity into the work getting done, there’s no telling how much more they can accomplish in the same amount of time. Try Smartsheet for free, today.

Any articles, templates, or information provided by Smartsheet on the website are for reference only. While we strive to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability, or availability with respect to the website or the information, articles, templates, or related graphics contained on the website. Any reliance you place on such information is therefore strictly at your own risk.

These templates are provided as samples only. These templates are in no way meant as legal or compliance advice. Users of these templates must determine what information is necessary and needed to accomplish their objectives.

Discover why over 90% of Fortune 100 companies trust Smartsheet to get work done.

Artificial Intelligence
Generative AI
Business Operations
Cloud Computing
Data Center
Data Management
Emerging Technology
Enterprise Applications
IT Leadership
Digital Transformation
IT Strategy
IT Management
Diversity and Inclusion
IT Operations
Project Management
Software Development
Vendors and Providers
Enterprise Buyer’s Guides
United States
Middle East
España (Spain)
Italia (Italy)
Netherlands
United Kingdom
New Zealand
Data Analytics & AI
Newsletters
Foundry Careers
Terms of Service
Privacy Policy
Cookie Policy
Copyright Notice
Member Preferences
About AdChoices
Your California Privacy Rights

Our Network

Computerworld
Network World

How to create an effective business continuity plan

A business continuity plan outlines procedures and instructions an organization must follow in the face of disaster, whether fire, flood, or cyberattack. here’s how to create a plan that gives your business the best chance of surviving such an event..

Professional Meeting: Senior Businesswoman and Colleague in Discussion

The tumultuous events of the past several years have impacted practically every business. And with the number of extreme weather events, cyberattacks, and geopolitical conflicts continuing to rise, business leaders are bracing for the possibility of increasingly more frequent impactful incidents their organizations will need to respond to.

According to PwC’s 2023 Global Crisis and Resilience Survey , 96% of 1,812 business leaders said their organizations had experienced disruption in the past two years and 76% said their most serious disruption had a medium to high impact on operations.

It’s little wonder then that 89% of executives list resilience as one of their most important strategic priorities.

Yet at the same time, only 70% of respondents said they were confident in their organization’s ability to respond to disruptions, with PwC noting that its research shows that too many organizations “are lacking the foundational elements of resilience they need to be successful.”

A solid business continuity plan is one of those foundational elements.

“Every business should have the mindset that they will face a disaster, and every business needs a plan to address the different potential scenarios,” says Goh Ser Yoong, head of compliance at Advance.AI and a member of the Emerging Trends Working Group at the professional governance association ISACA.

A business continuity plan gives the organization the best shot at successfully navigating a disaster by providing ready-made directions on who should do what tasks in what order to keep the business viable.

Without such as a plan, the organization will take longer than necessary to recover from an event or incident — or may never recover at all.

What is a business continuity plan?

A business continuity plan (BCP) is a strategic playbook created to help an organization maintain or quickly resume business functions in the face of disruption, whether that disruption is caused by a natural disaster, civic unrest, cyberattack, or any other threat to business operations.

A business continuity plan outlines the procedures and instructions that the organization must follow during such an event to minimize downtime, covering business processes, assets, human resources, business partners, and more.

A business continuity plan is not the same as a disaster recovery plan , which focuses on restoring IT infrastructure and operations after a crisis. Still, a disaster recovery plan is part of the overall strategy to ensure business continuity, and the business continuity plan should inform the action items detailed in an organization’s disaster recovery plan. The two are tightly coupled, which is why they often are considered together and abbreviated as BCDR.

Why business continuity planning matters

Whether you operate a small business or a large corporation, it’s vital to retain and increase your customer base. There’s no better test of your capability to do so than right after an adverse event.

Because restoring IT is critical for most companies, numerous disaster recovery solutions are available. You can rely on IT to implement those solutions. But what about the rest of your business functions? Your company’s future depends on your people and processes. Being able to handle any incident effectively can have a positive effect on your company’s reputation and market value, and it can increase customer confidence.

Moreover, there are increasing consumer and regulatory expectations for both enterprise security and continuity today. Consequently, organizations must prioritize continuity planning to prevent not only business losses, but financial, legal, reputational, and regulatory consequences.

For example, the risk of having an organization’s “license to operate” withdrawn by a regulator or having conditions applied (retrospectively or prospectively) can adversely affect market value and consumer confidence.

Building (and updating) a business continuity plan

Whether building the organization’s first business continuity plan or updating an existing one, the process involves multiple essential steps.

Assess business processes for criticality and vulnerability: Business continuity planning “starts with understanding what’s most important to the business,” says Joe Nocera, principle in the cyber risk and regulatory practice at PwC, a professional services firm.

So the first step in building your business continuity plan is assessing your business processes to determine which are the most critical; which are the most vulnerable and to what type of events; and what are the potential losses if those processes go down for a day, a few days, or a week.

“This step essentially determines what you are trying to protect and what you are trying to keep up for systems,” says Todd Renner, senior managing director in the cybersecurity practice at FTI Consulting.

This assessment is more demanding than ever before because of the complexity of today’s hybrid workplace, the modern IT environment, and the reliance on business partners and third-party providers to perform or support critical processes.

Given that complexity, Goh says a thorough assessment requires an inventory of not only key processes but also the supporting components — including the IT systems, networks, people, and outside vendors — as well as the risks to those components.

This is essentially a business impact analysis.

Determine your organization’s RTO and RPO: The next step in building a business continuity plan is determining the organization’s recovery time objective (RTO), which is the target amount of time between point of failure and the resumption of operations, and the recovery point objective (RPO), which is the maximum amount of data loss an organization can withstand.

Each organization has its own RTO and RPO based on the nature of its business, industry, regulatory requirements, and other operational factors. Moreover, different parts of a business can have different RTOs and RPOs, which executives need to establish, Nocera says.

“When you meet with individual aspects of the business, everyone says everything [they do] is important; no one wants to say their part of the business is less critical, but in reality you have to have those challenging conversations and determinations about what is actually critical to the business and to business continuity,” he adds.

Detail the steps, roles, and responsibilities for continuity: Once that is done, business leaders should use the RTO and the RPO, along with the business impact analysis, to determine the specific tasks that need to happen, by whom, and in what order to ensure business continuity.

“It’s taking the key components of your analysis and designing a plan that outlines roles and responsibilities, about who does what. It gets into the nitty-gritty on how you’re going to keep the company up and running,” Renner explains.

One common business continuity planning tool is a checklist that includes supplies and equipment, the location of data backups and backup sites, where the plan is available and who should have it, and contact information for emergency responders, key personnel, and backup site providers.

Although the list of possible scenarios that could impact business operations can seem extensive, Goh says business leaders don’t have to compile an exhaustive list of potential incidents. Rather, they should compile a list that includes likely incidents as well as representative ones so that they can create responses that have a higher likelihood of ensuring continuity even when faced with an unimagined disaster.

“So even if it’s an unexpected event, they can pull those building blocks from the plan and apply them to the unique crisis they’re facing,” Nocera says.

The importance of testing the business continuity plan

Devising a business continuity plan is not enough to ensure preparedness; testing and practicing are other critical components.

Renner says testing and practicing offer a few important benefits.

First, they show whether or how well a plan will work.

Testing and practicing help prepare all stakeholders for an actual incident, helping them build the muscle memory needed to respond as quickly and as confidently as possible during a crisis.

They also help identify gaps in the devised plan. As Renner says: “Every tabletop exercise that I’ve ever done has been an eye-opener for everyone involved.”

Additionally, they help identify where there may be misalignment of objectives. For example, executives may have deprioritized the importance of restoring certain IT systems only to realize during a drill that those are essential for supporting critical processes.

Types and timing of tests

Many organizations test a business continuity plan two to four times a year. Experts say the frequency of tests, as well as reviews and updates, depends on the organization itself — its industry, its speed of innovation and transformation, the amount of turnover of key personnel, the number of business processes, and so on.

Common tests include tabletop exercises , structured walk-throughs, and simulations. Test teams are usually composed of the recovery coordinator and members from each functional unit.

A tabletop exercise usually occurs in a conference room with the team poring over the plan, looking for gaps and ensuring that all business units are represented therein.

In a structured walk-through, each team member walks through his or her components of the plan in detail to identify weaknesses. Often, the team works through the test with a specific disaster in mind. Some organizations incorporate drills and disaster role-playing into the structured walk-through. Any weaknesses should be corrected and an updated plan distributed to all pertinent staff.

Some experts also advise a full emergency evacuation drill at least once a year.

Meanwhile, disaster simulation testing — which can be quite involved — should still be performed annually. For this test, create an environment that simulates an actual disaster, with all the equipment, supplies and personnel (including business partners and vendors) who would be needed. The purpose of a simulation is to determine whether the organization and its staff can carry out critical business functions during an actual event.

During each phase of business continuity plan testing, include some new employees on the test team. “Fresh eyes” might detect gaps or lapses of information that experienced team members could overlook.

Reviewing and updating the business continuity plan should likewise happen on an ongoing basis.

“It should be a living document. It shouldn’t be shelved. It shouldn’t be just a check-the-box exercise,” Renner says.

Otherwise, plans go stale and are of no use when needed.

Bring key personnel together at least annually to review the plan and discuss any areas that must be modified.

Prior to the review, solicit feedback from staff to incorporate into the plan. Ask all departments or business units to review the plan, including branch locations or other remote units.

Furthermore, a strong business continuity function calls for reviewing the organization’s response in the event of an actual event. This allows executives and their teams to identify what the organization did well and where it needs to improve.

How to ensure business continuity plan support, awareness

One way to ensure your plan is not successful is to adopt a casual attitude toward its importance. Every business continuity plan must be supported from the top down. That means senior management must be represented when creating and updating the plan; no one can delegate that responsibility to subordinates. In addition, the plan is likely to remain fresh and viable if senior management makes it a priority by dedicating time for adequate review and testing.

Management is also key to promoting user awareness. If employees don’t know about the plan, how will they be able to react appropriately when every minute counts?

Although plan distribution and training can be conducted by business unit managers or HR staff, have someone from the top kick off training and punctuate its significance. It’ll have a greater impact on all employees, giving the plan more credibility and urgency.

What’s holding CTOs back?

Baldor’s first-ever CIO sets the transformation agenda

CIO Leadership Live with Satya Jayadev, Vice President & CIO, Skyworks Solutions

Principal Financial CIO Kathy Kay on balancing traditional AI and genAI

CIO Leadership Live Middle East with Ramadan Mohamad, Digital infrastructure specialist at Public Transport Corp.

Alteryx adds genAI to enable analytics creation via no-code platform

ISO 22301 Documentation Toolkits

Iso 22301 training.

Documentation Toolkits
White Papers
Templates & Tools

Where to Start

New ai tool.

Live Consultations
Consultant Directory
For Consultants

Dejan Kosutic

Get Started

Business continuity plan: How to structure it according to ISO 22301

In my experience, companies usually find two things in their business continuity or information security management to be the most difficult: risk assessment, and business continuity planning. Here I’ll give you some tips on business continuity plans (BCP).

ISO 22301 business continuity plan should include Purpose, scope and users, Reference documents, Assumptions, Roles and responsibilities, Key contacts, Plan activation and deactivation, Communication, Incident response, Physical sites and transportation, Order of recovery for activities, Recovery plans for activities, Disaster recovery plan, Required resources, and Restoring and resuming activities from temporary measures.

What is a business continuity plan?

According to ISO 22301 , business continuity plan is defined as “documented procedures that guide organizations to respond, recover, resume, and restore to a pre-defined level of operation following disruption.” (clause 3.5)

This basically means that BCP focuses on developing plans/procedures, but it doesn’t include the analysis that forms the basis of such planning, nor the means of maintaining such plans – all these are required elements of business continuity management that are necessary for enabling successful contingency planning.

To read more about analysis, see Five Tips for Successful Business Impact Analysis , and to find out how to interpret the analysis, read Can business continuity strategy save your money? .

Business continuity plan example

Here’s what I found to be the optimal structure for the business continuity plan for smaller and midsize companies, and what each section should include:

Purpose, scope and users – why this plan is developed, its objectives, which parts of the organization it covers, and who should read it.

Reference documents – to which documents does this plan relate? Normally, these are Business Continuity Policy, Business Impact Analysis, Business Continuity Strategy, etc.

Assumptions – the prerequisites that need to exist in order for this plan to be effective.

Roles and responsibilities – who will be responsible for managing the disruptive incident, and who is authorized to perform certain activities in case of a disruptive incident – e.g. activation of the plans, urgent purchases, communication with media, etc.

Key contacts – contact details for persons who will participate in the execution of the business continuity plan – this is usually one of the annexes of the plan.

Business Continuity Plan (BCP) Structure According to ISO 22301

Plan activation and deactivation – in which cases can the plan be activated, and the method of activation; which conditions need to exist to deactivate the plan. Communication – which communication means will be used between different teams and with other interested parties during the disruptive incident. Who is in charge of communicating with each interested party, and the special rules of communication with media and government agencies.

Incident response – how to react initially to an incident in order to reduce the damage – this is very often an annex to the main plan.

Physical sites and transportation – which are the primary and alternative sites, where the assembly points are, and how to get from primary to alternative sites.

Order of recovery for activities – list of all the activities, with precise Recovery Time Objective (RTO) for each.

Recovery plans for activities – description of step-by-step actions and responsibilities for recovering manpower, facilities, infrastructure, software, information, and processes, including interdependencies and interactions with other activities and external interested parties – these are very often annexes to the main plan. To read more about them, see How to write business continuity plans?

Disaster recovery plan – this is normally a type of recovery plan that focuses on recovering the information and communication technology infrastructure. To read more about the relationship between disaster recovery and business continuity, see Disaster recovery vs business continuity .

Required resources – a list of all the employees, third-party services, facilities, infrastructure, information, equipment, etc. that are necessary to perform the recovery, and who is responsible to provide each of them.

Restoring and resuming activities from temporary measures – how to restore business activities back to business-as-usual once the disruptive incident has been resolved.

What I like about ISO 22301 is that it requires all the elements that are necessary for this plan to be useful in case of a disaster (or any other disruption in a company’s activities). However, no standard can help you unless you understand this task seriously – a properly written and comprehensive plan can save your company in tough times, while a superficially written plan will only make things worse.

Click here to see a sample Business Continuity Plan .

Writing a business continuity plan according to ISO 22301

Free webinar explains the basics about business continuity plans and how to structure them

Related Products

ISO 27001 Premium Documentation Toolkit

ISO 27001 Lead Auditor Course

Upcoming free webinar, related articles.

You may unsubscribe at any time. For more information, please see our privacy notice .

Advisory boards aren’t only for executives. Join the LogRocket Content Advisory Board today →

Product Management
Solve User-Reported Issues
Find Issues Faster
Optimize Conversion and Adoption

How to craft an effective business continuity plan

Let me take you back in time to the United Kingdom in the 1970s. Punk music was gaining popularity, and the Sex Pistols entered the punk rock scene with the force of a shooting star, capturing fans’ attention.

How To Craft An Effective Business Continuity Plan

But as quickly as they arrived, they quickly left the scene. When they broke up in 1978 after a period of internal conflicts, legal troubles, and their frontman’s imprisonment, fans were left both shocked and surprised.

Just like the Sex Pistols, plenty of companies experience rapid growth and success, only to face unexpected challenges and internal conflicts that result in their downfall.

In this article, we’ll draw inspiration from the Sex Pistols’ turbulent journey to explore the concept of business continuity planning (BCP). We’ll look at what a BCP is, why you need one and delve into the strategies and contingency measures that can help you maintain your rhythm and continuity, even when faced with the inevitable storms that can disrupt your operations.

What is a business continuity plan?

A business continuity plan describes how you’ll continue your business when disaster hits. It is a structured strategy outlining how your organization will maintain essential functions when disaster strikes, to ensure minimal downtime and guarantee that operations continue.

Why do you need a BCP in place?

The BCP is crucial and revolves around ensuring your resilience and ability to continue operating in the face of unexpected disruptions, such as natural disasters, cyberattacks, or other emergencies.

Let’s look at it a bit closer, and understand some of the key reasons to have a BCP better:

Minimize downtime

Protect revenue and reputation, compliance and legal requirements, resource allocation, maintain customer service, employee safety.

A BCP helps you minimize downtime. It does this by providing a structured approach to quickly recover and resume your critical business functions.

Example: You’re a retail company with an extensive online presence. If your website experiences a cyberattack that takes it offline, a well-prepared BCP outlines the steps to take to mitigate the attack, get your website back up in no time, and allow you to continue serving your customers.

No one likes disruptions as they result in revenue loss and can damage your reputation. A BCP helps you protect against financial losses and keep customer trust.

Example: You’re the owner of a restaurant chain with multiple locations and one of your branches has a food safety crisis. A BCP can guide you in managing the crisis, ensuring food safety compliance, and communicating effectively with customers to maintain trust in the brand and other locations.

Some industries, like the financial, and pharma industries, have regulatory requirements that mandate businesses to have BCPs in place. Failure to do so has legal and financial consequences.

Example: You’re the owner of a FinTech company. You are required by regulators to have robust BCPs to ensure customer data security and financial system stability.

When a crisis hits you need the right resources to get you back up and running. A BCP helps allocate resources effectively during a crisis, ensuring that personnel, equipment, and materials are used efficiently to address the most critical needs.

Over 200k developers and product managers use LogRocket to create better digital experiences

Example: You’re a manufacturing company hit by a sudden supply chain disruption because the Suez Canal is blocked again. You use your BCP to allocate available resources to meet customer demands and minimize production delays.

When all hell breaks loose you want to make sure customer experience takes a minimum blow. A BCP outlines measures to maintain customer service and communication, so customers receive timely updates and support.

Example: You run an airline and there is a labor strike. Your BCP tells you how to manage customer inquiries, rebook affected passengers, and maintain a level of service.

Let’s not forget about the well-being of your employees. During a crisis, this is a top priority. A BCP includes procedures for evacuations, remote work arrangements, and employee support.

Example: There is a fire at your workplace. The BCP outlines evacuation routes, assembly points, and contact information for employees to report their safety status.

Business continuity planning: Steps for success

That’s a lot of reasons, right? Now that we addressed the necessity and urgency of having BCP, let’s look at 5 steps to creating a successful one:

Analyze your company
Assess the risk
Create the procedures
Get the word out
Iterate and improve

1. Analyze your company

In this phase you conduct an analysis to identify critical activities, determine which activities must continue, which can be temporarily paused, and which can operate at a reduced capacity.

You then assess the financial impact of disruptions. This involves asking yourself the question, “How long can I operate without generating revenue and incurring recovery costs?”

As this step covers your whole company, it’s important to get key stakeholders involved from the beginning.

2. Assess the risk

Now you have a good overview of your critical processes and the impact of disruption. At this point, pivot your attention to the risks they face, how well you can handle when things don’t work as usual, and how long you can manage if things go wrong.

The goal here is to understand what could go wrong and find ways to avoid, reduce, or transfer them. This assessment will help you strengthen your preparedness and resilience.

3. Create the procedures

Once you analyze and assess, you need to create procedures.

Develop detailed, step-by-step procedures to minimize risks to your organization’s people, operations, and assets. This can include changes to your operating model, such as using alternative suppliers or implementing remote work options.

4. Get the word out

A plan is just a plan and no one will know how to act if you don’t communicate.

This step is all about communication. Integrate the BCP into your operations, policies, and company culture, and train, test, and communicate with your employees.

And don’t forget that communication is not limited to your company only. Communicate with external stakeholders, customers, suppliers, and so forth.

5. Iterate and improve

Before implementing your BCP ensure its effectiveness.

Don’t worry there are plenty more options to test your BCP. Consider involving external stakeholders or vendors as it makes exercises more realistic. Frequently train those who are accountable for executing the BCP.

After experiencing a real incident or conducting a training exercise, update your plan to improve its ability to protect your business. Keep in mind that both your organization’s development and the circumstances you operate in change, so a regular review isn’t a luxury but a necessity.

How to structure your continuity plan

Now you have a high-level understanding, let’s look at how to structure your business continuity plan.

You can find a copy of the template I use here .

Make sure to include the following sections in your BCP:

Version history

Executive summary, functions and process prioritization, plan activation, governance and responsibilities, recovery plans, crisis communication plan, emergency location and contents, review and testing.

This section shows the revision history. It includes the version numbers of the changes made, by whom, when, and who approved the changes. The revision history allows anyone reading the BCP to understand how it has evolved over time.

The executive summary provides a brief summary of the key objectives, goals, scope, and applicability of the BCP.

This chapter outlines the critical functions and processes in scope of continuation in case of a disastrous event.

This section refers to the risk and business impact assessment outcome. Its aim is to set out what triggers the activation of the plan.

Governance and responsibilities talks about who has to act when the BCP is activated. It includes the members, a description of their responsibilities, contact details of the BCP team, and the chain of command during a crisis.

This section builds upon the business continuity strategies, specifically the one chosen when a disaster occurs. It describes the detailed recovery plans for each critical function, the procedures for restarting operations, resource allocation, and recovery time objectives (RTOs).

Here you cover the internal and external communication strategies. You also address employee awareness and training activities.

Now there is a good chance the disaster will require your crucial activities to temporarily continue at a different location. This section covers all details about the location and what needs to be available at the location.

The BCP is to be tested to reduce the risk of missing things or even worse failing. Here jot down the testing procedures and document results and lessons learned.

This section includes all appendices. Think about the following

Supporting documents, such as contact lists, maps, and technical specifications
References to external standards, guidelines, or regulations
Training programs for BCP team members
Review of insurance policies
Financial reserves and funding for recovery efforts
Procedures for keeping the BCP documentation up to date

Business continuity plan example

Earlier this year, the Koninklijke Nederlands Voetbal Bond (KNVB), which is the Royal Dutch Football Association, was hit by ransomware. The cyberattackers threatened to share personally identifiable information captured and the KNVB paid over one million euros to avoid this from happening.

What could have been done to mitigate the ransomware attack risk?

The Risk of the attack to succeed could have been mitigated with:

Regular data backups
Segmentation of networks
Intrusion detection systems

How to ensure business continuity in case of ransomware?

In response to the ransomware incident, and to allow for continued business as usual as soon as possible, steps could include:

Isolating affected systems
Activating backups
Notifying law enforcement
Engaging with a cybersecurity incident response team

Key takeaways

A business continuity plan (BCP) is like a safety net for your business when things go haywire. It helps you keep going, avoiding downtime, revenue loss, and reputation hits. On top of that, it’s a legal must in certain industries.

To make a solid BCP, just follow five steps: figure out what’s crucial for your business, spot the risks, plan how to bounce back, make sure everyone knows the plan, and keep fine-tuning it.

Structurally, your BCP should have sections like history, a quick guide, what’s most important, when to activate it, who’s in charge, the nitty-gritty recovery plans, how communication is done, where to go in a crisis, how to test the BCP works, and some extra info.

Featured image source: IconScout

LogRocket generates product insights that lead to meaningful action

Get your teams on the same page — try LogRocket today.

Stop guessing about your digital experience with LogRocket

Crafting a successful product launch strategy: Key tips and steps

A launch strategy builds anticipation, maximizes initial sales, and establishes a strong market presence early on.

Leader Spotlight: Having a bias for action, with Anish Chadda

Anish Chadda discusses the importance of having a “bias for action” — iterating quickly instead of focusing on creating a perfect prototype.

DSDM: The dynamic systems development method

The dynamic system development method (DSDM) was first released in 1994 as a software development method to provide some discipline to RAD.

Leader Spotlight: Enabling a vision-led product mindset, with David Krell

David Krell, VP of Product at Going, talks about the fallacy that PMs have to be in a position of authority to do vision-led work.

ISO 22301 - Business continuity

Year of publication: 2019 | Edition: 1

A free publication about ISO 22301, Security and resilience – Business continuity management systems – Requirements , the International Standard for implementing and maintaining effective business continuity plans, systems and processes.

Related Standards

ISO 22301:2019 Security and resilience — Business continuity management systems — Requirements

This may also interest you

Got a question?

Check out our FAQs

Opening hours: Monday to Friday - 09:00-12:00, 14:00-17:00 (UTC+1)

Publications and products
ISO 22301 - Business continuity …

Add to cart

ISO 22301 – The Business Continuity Management Standard, Simplified

The ISO 22301 business continuity management standard helps organisations identify and prioritise threats. It allows them to implement their business continuity management system effectively so they are ready to respond to and recover from incidents with the least disruption to business.

Jump to topic

What is iso 22301, and why do you need it.

In a world where cyberattacks, data breaches and natural disasters can interrupt business continuity and quickly damage reputation, organisations and businesses need to implement, maintain and keep refining their business continuity management system (BCMS). ISO 22301 certification of their continuity management ensures they are doing so.

ISO 22301 helps organisations identify and prioritise threats. It allows them to implement their business continuity management system effectively so they are ready to respond to and recover from incidents with the least disruption to business.

Studies have shown that almost 1 in 5 organisations experience significant business disruptions every year. Therefore, a robust and resilient organisation is one that can change with the times, has an understanding of where its vulnerabilities are and have plans in place to mitigate risk as well as respond if it needs to do so. Compliance or certification to ISO 22301 business continuity management allows your organisation to achieve all of the above in a straightforward and structured manner.

The latest version of the standard

On 31 October 2019 the latest version of the ISO 22301 standard was published – ISO 22301:2019. This is a revised version of ISO 22301:2012. It aims to make the standard “more streamlined and practical”, according to the ISO. According to the United Kingdom Accreditation Service (UKAS), companies will be able to transition from ISO 22301:2012 to ISO 22301:2019 up until 30 April 2023. The deadline was, as an exception, extended due to the Covid-19 situation. The 2019 version has been generally well received and transitions from old to new versions of the standard are seen as a not overly onerous value adding exercise.

You can find the ISO 22301 business continuity management standard documentation on the official ISO website .

ISO 22301:2019 provides businesses with the most up-to-date security and resilience certification to be sure their business continuity management systems meet the international standard, set out by the ISO.

The Relationship With ISO 22301:2012

There’s not a radical difference between ISO 22301:2012 and ISO 22301:2019. Both versions necessitate senior management involvement, and the updated model reflects on what is required to sustain a successful BCMS.

That sustainability becomes much more comfortable with a technology-based business continuity management systems such as ISMS.online.

ISO 22301:2012 was published in May 2012 and amended in June of the same year. The management system requirements established in ISO 22301 business continuity management had meant to extend to all organisations. The degree to which the criteria becomes implemented depends on the operating environment and the scope of the organisation, similar to how one would develop their range for other management system standards like ISO 27001.

While several concepts and terminology of business continuity management have been revised to expand context and reflect established procedures, Clause 8; Operation, is the main area where changes have occurred.

ISMS.online offers ISO 22301 business continuity management frameworks within its packaged services. That means organisations who wish to migrate their existing business continuity management systems can, as well as those embarking on ISO 22301 for the first time.

What is Business Continuity Management?

If your company was affected by a catastrophe or a crisis, would your business be able to continue? When incidents and natural disasters strike, there is little time to prepare a response structure, particularly when the key people, processes, networks, infrastructure and other essential services get disrupted.

A disaster has no bounds. It could impact your business continuity internally and externally, affecting your customers and the supply chain too. Whether you are a small or a large business, you can face impact. The primary purpose of business continuity management is to reduce the likelihood of threats and guarantee that the company reacts to significant disturbances that could endanger its future.

Business continuity management is about responsible and effective leadership. It should provide a foundation for developing resilience to incidents as well as the ability to respond successfully, safeguarding the interests of your key stakeholders, reputation, and value-creating operations of your company.

A business continuity strategy with a documented management system should ensure that workers are mindful of their roles and responsibilities. In the case of an unexpected occurrence, it is essential to be able to adapt to established processes and approved procedures.

Business continuity plans within ISMS.online

Many of our customers develop simple yet effective business continuity plans within ISMS.online for meeting ISO 27001 and protecting their valuable information assets. Other customers take that even further with ISO 22301 and introduce more sophisticated resilience planning and prevention, as well as response mechanisms to incidents.

The benefits of Business Continuity Management

Business continuity management helps organisations reduce the likelihood and impact of disruption and downtime, protect assets if something does go wrong, continue operating through the disruption, and recover as quickly as possible from any incidents that do occur. Having business continuity plans in place will help your organisation in the following ways:

Comply with legal requirements

ISO 22301 is used for legal and regulatory certification of continuity management, ensuring all the required elements of a business continuity management system are being met.

Achieve marketing advantage

Brand reputation is precious for any organisation and should be protected at all costs. With a continuity management system, it’s possible to build customer confidence and trust, reducing the likelihood of a PR disaster that could damage relationships with stakeholders including customers, clients and suppliers.

Reduce dependence on individuals

Through planning, training, awareness programmes and testing, everyone in an organisation should understand what is expected of them. This breeds confidence that the business continuity plans will deliver in the event of a disruption.

Prevent large-scale damage

It’s vital to keep your business trading during and after an incident. By recovering business operations quickly after interruptions, it’s possible to reduce the cost of damaging incidents, protect the organisation’s reputation and even save lives, if dangerous events, such as fire or flooding, occur.

Operational resilience

Mishaps and unplanned events vary in scale, speed and impact, possibly only hitting a single department or location. Identifying and planning for possible smaller-scale issues that could escalate into major operational difficulties for the entire organisation will keep the wheels turning.

Manage all your compliance in one place

ISMS.online supports over 100 standards and regulations, giving you a single platform for all your compliance needs.

Business Continuity Risk

Business continuity management using a well-documented management system helps you to identify better and reduce the likelihood of disruptive incidents or address business continuity risks. Business continuity management leads to the growth of a more stable environment, although companies with no successful business continuity management systems will increase chances significantly. A well-developed, organised and rehearsed Business Continuity Plan (BCP) can help the business rebound from an incident as quickly as possible.

All of your procedures must be up-to-date, accurate and efficient. Methods include but are not limited to corporate risk assessments, information security risk reviews, and addressing your health and safety policies, as well as your continuity management plan.

Examples of business continuity risks include:

Cyberattacks and data breaches
Unplanned IT and telecom outages
Interruption to utility supply
Adverse weather and other environmental causes
Pandemics and epidemics
Acts of terrorism
Security incidents
Loss of key personnel
Physical property destruction or material loss

Emergency preparedness

Business continuity management details the steps you need to take in an emergency in the form of a Disaster Recovery Plan (DRP). A Disaster Recovery Plan is a documented, organised business continuity strategy that demonstrates how to respond to disruptive incidents.

The Disaster Recovery Plan begins its formation following a more detailed business impact analysis, which helps demonstrate where the most significant impact and consequences are from an event. ISMS.online gives you the tools you need to manage your business impact analysis, disaster recovery plans, and much more using information technology.

Your DRP should include a short-term arrangement to fix and rebuild critical business systems, and a plan to address problems such as root cause identification and a long-term prevention approach. There are many options available to ensure that an organisation has a setup with a contingency system that provides the best solution.

For example, the on-site recovery system would ensure that data can be retrieved more efficiently with data backups and other means. Your prevention measures should also protect from potential server failure and consider the risk of external contractors. You would then build contingency plans and alternative business continuity strategies for the absence of supplies that are vital to business operations long before they even become a disaster recovery issue.

What is a BCMS?

A business continuity management system, put very simply, is a recognised approach for ensuring an organisation can continue business operations and respond effectively to disruptive incidents.

ISO 22301 provides a constant and established method of business impact analysis with a framework based on recognised good practice. Anyone implementing and achieving certification for an ISO 22301 based business continuity management system will find instant recognition and understanding from influential customers, including educated experts, auditors and other interested parties.

When based on ISO 22301, ISO itself emphasises the importance of business continuity management systems:

Showing the organisation understands the needs and necessity for a stated business continuity policy and objectives
Implementation and execution of processes, incident response mechanisms and other interventions to ensure the organisation survives a disruption
Monitoring and continuous improvement of the business continuity management system

Demonstrating good practice for business continuity management

Following ISO 22301 as a basis for your BCMS will provide proof that the company has taken the necessary steps to meet regulatory requirements in addition to the recognised good practices.

A best practice in business continuity incorporates the lifecycle of business continuity management as you can make it possible to maximise the efficiency and quality of your business continuity management systems. ISO 22301 provides a framework regarding international best practices on the well-understood concept of Plan/Do/Check/Act. This concept applies to organisations that implement, maintain and improve their business continuity management systems, which seeks to ensure compliance with the stated policy on business continuity.

With a business continuity management system based on the requirements of ISO 22301, both internal and external interested parties can be made aware that the organisation operates with good practices in business continuity management.

Disaster recovery and BCMS

In developing effective business continuity plans, an organisation will be well-placed to implement practices that reduce the likelihood of incidents and damage to the organisation. Not only this, but effective business continuity plans help you better understand your organisation and run it more effectively.

ISO guidance helps organisations identify and manage compliance, typically using a series of procedures, policies, process diagrams or similar. This guidance helps them plan for and rebound from disruptions in their business activities. However, it’s still better to avoid them entirely, although that is not always possible or feasible financially or technically. It is also essential to clarify priorities if an incident occurs, for example: what is the goal of recovery time? What is the highest endurable downtime? You can use the answer to these questions to prepare your disaster recovery plan. Speed of recovery must be a consideration. An ISO 22301-aligned business continuity management system will include disaster recovery and effective business continuity plans to help your company recover your critical operations as rapidly as possible.

BCMS and cyber-resilience

Implementing a business continuity management system (BCMS) is imperative to developing cyber resilience in today’s cyber security environment. Part of the ISO 27001 Information Security Standard contains a clause about business continuity – ISO 22301 more than satisfies this ISO 27001 requirement.

Cyberattacks routinely have hit the headlines in the last decade. For instance, the infamous global WannaCry ransomware attack in May 2017 left a trail of devastation as organisations were denied access to their own data and forced to halt business operations until large ransoms were paid.

Such incidents demonstrate the importance of ensuring your business can respond to and recover from disruptions, by implementing an effective business continuity management system (BCMS).

The benefits of ISO 22301

There are many advantages of ISO 22301, including returning the organisation to ‘business as usual’ with minimal disruption from any crisis.

Having the ability to continue business operations regardless of any minor or major incident taking place is becoming increasingly important to businesses in all sectors. A Business Continuity Management System (BCMS) allows a company to plan for these incidents. This leads to greater competitiveness and decreases the amount of operational down time a business will have, should the unexpected occur.

ISO 22301 gives businesses and organisations the ability to respond appropriately in the event of disruptive incidents and avoid waste or unnecessary loss. Through proactively assessing the effect of the disruption, business continuity management recognises the products and services that are essential to the organisation’s survival. It seeks to determine what solutions and contingency planning will be required if an incident was to occur.

Corporate governance

Compliance with ISO 22301 helps with meet the requirements of corporate governance. Essentially the standard can provide evidence that the organisation has taken the necessary steps to comply with regulatory requirements that call for an effective business continuity management programme.

Crisis management

Crisis Management (CM) refers to the overall coordination of an organisation’s response to a crisis, in an effective, timely manner. For those responsible for handling crisis management, the goal is to avoid or at least minimise damage to the organisation’s profitability, reputation, or ability to operate. Meeting the ISO 22301 standard confirms the appropriate measures are in place for this to happen.

Disaster recovery

Disaster recovery activities concentrate on returning the organisation to “business as usual” after a traumatic event and putting it on track towards complete recovery. It’s important to recognise that this is different from business continuity management, which is about ensuring that the enterprise can continue to reduce the likelihood of natural disasters and function during a crisis.

Protection of reputation in a crisis

ISO 22301 certification shows stakeholders that your business continuity capability is appropriate for the scale and scope of your organisation. Like ISO 27001, it engenders more trust, especially when certified by an independent certification body. It aids your understanding of business needs by identifying potential failures and risks. Businesses can then demonstrate to stakeholders, consumers, vendors and regulators, that they have a robust business continuity management system and processes in place.ISO 22301 will also increase stakeholder trust in the organisation’s ability to respond to disruptive incidents and events, and to sustain critical business processes should a catastrophe occur.

Preparation for technology failures

From telecommunications breakdown to loss of access to stored data, technology failures can be hugely damaging to an organisations profitability and reputation. ISO 22301 ensure all measurements are in place to mitigate such disruption and ensure all departments are prepared for the worst-case scenario.

Reduce business interruption insurance costs

With a BCMS in place that conforms with ISO 22301, an organisation has more meaningful insights into the impacts of a potential disaster. This enables the business to better evaluate the type and value of insurance cover it requires, potentially reducing costs in the long term.

Plan for the sudden loss of critical resources

It follows that if there is proactive identification of the impact of disruption, an organisation will be a strong position to maintain business continuity. Business continuity management systems help to establish what responses will be needed if a disruption occurs and ISO 22301 further provides the capability to adequately react in case of any such disruption.

How does ISO 22301 work?

ISO 22301 works by setting out how to build a management system that helps an organisation to plan for any type of incident that might affect its ability to operate effectively.

This standard provides a framework for an organisation to define responsibilities and makes it possible to assess and review business continuity performance over time. With ISO 22301 you can create the documents necessary to provide auditable evidence of contingency capabilities, as part of ongoing compliance requirements.

Performance assessment, audits and continual improvement are central to the management system standard set out by ISO 22301:2012 and ISO 22301:2019.

Who can implement ISO 22301?

The ISO/IEC 22301 BCMS standard extends to organisations of all sizes, across all markets and all experience levels. Implementing ISO 22301 business continuity management includes reviewing operational structures to identify potential shortfalls and allowing the organisation to concentrate on its goals and business continuity objectives.

The business needs of the implementation project are specific to the company implementing the standard and ISMS.online makes that straightforward. There’s no need to concentrate on ‘how’ you’ll implement and manage ISO 22301, you can simply focus on the activities within the standard and focus on ‘what’ you need to do for prevention and cure.

How to Implement ISO 22301?

When you implement ISO 22301 business continuity management, the first simple step is to think about addressing the primary requirements of the standard. This starting point will encourage you to take a strategic approach (hence why leadership is so important) and set the context, the scope, as well as develop a stated business continuity policy and objectives of the business continuity management systems.

Developing a business continuity policy will help identify your areas of risk and opportunity. From here, you can consider the impacts of those risks and what it might mean for consequences and the time to failure, recovery etc. Doing so will help you discover any holes or shortcomings in your current ISO management systems standards requirements. You will also identify and provide practical suggestions for improving them. ISO describes this as business continuity strategies and solutions.

Get help with implementation

ISMS.online has partners that can help with your ISO 22301 implementation, from achieving a pragmatic and straightforward business continuity management systems approach to a highly sophisticated BCMS.

Book a demo today to explore available options

Once you’ve completed your implementation, it is essential to undertake regular audits of the business continuity management system. Internal audits are mandatory for achieving independent certification of the BCMS too. Performance reviews also complement internal audits to make sure that your management systems are operating as expected at all times.

The ISO auditor would also expect to see a record of improvements your organisation has made over time. Having a method for addressing nonconformities, corrective actions and other enhancements is a crucial requirement.

Getting started with ISO 22301

We encourage organisations to buy the ISO international standard and digest that to understand the ISO management system standards requirements fully. We recommend starting at the beginning (4.1 understanding the organisation and its context) and avoid jumping into developing incident response plans until you’ve considered the scope, risks and impacts.

ISMS.online is also pre-configured with a range of tools that helps follow the process easier and means you retain a focus on the business. It also maps into the more comprehensive tools and features set for ISO 27001, meaning you can also achieve many of the ISO 22301 management systems requirements. You will be able to manage tasks like audits, performance reviews, management meetings, staff education etc. all at the same time.

You will reduce costs, simplify learning for staff and make the administration of the broader business management system that much more comfortable too. External auditors also find that much more effective and take great confidence when they see consistent operating practices across the ISO standards.

Compliance doesn’t have to be complicated.

We've done the hard work for you, giving you an 81% Headstart from the moment you log on. All you have to do is fill in the blanks.

The ISO 22301 framework

Here we summarise the framework that is set out in ISO 22301:

The ISO 22301 framework is for all types and sizes of organisations that implement, maintain and improve a BCMS. It should be adopted as a strategic intent by any business that wants to conform with stated business continuity policy and is committed to enhancing resilience through the effective application of the business continuity management systems.

Fundamentally, business continuity management systems planning begins with assessing and determining the risks and opportunities regarding business continuity management. The organisation must also establish business continuity objectives for the relevant functions and levels. These objectives must be monitored, clearly communicated, and updated as appropriate.

In every industry, it’s vital that the management team can demonstrate leadership and commitment to the BCMS. This can be achieved by ‘ensuring the business continuity policy and business continuity objectives are established and are compatible with the strategic direction of the organisation’ says ISO. Leadership should use communication channels to show its people and partners the importance of effective business continuity and of conforming to the business continuity management systems requirements. The leadership strategy must also promote continual improvement and development of a culture of business continuity.

Business continuity strategy relies on operational processes being in place for incident preparedness and incident response across all functions of the business. That means establishing criteria for the processes and implementing control of the processes in line with agreed criteria. From having in place a media and communication strategy to tightly managing site risk in the aftermath of disruptive incidents, disaster recovery is reliant on continuity plans. A crucial step is keeping documented information for the purpose of proving that processes and BC testing have been carried out as planned and improved where needed.

Performance evaluation

Performance assessment means a great deal can be learnt from incidents taking place. By monitoring successes and limitations, knowledge builds up. Interested parties have a responsibility to keep records, and use the results of audits to help them make the right decisions about how to manage business disruptions going ahead. By establishing an audit programme the organisation can ensure that any necessary corrective actions are taken. The aim is to eliminate detected nonconformities and their causes.

Improvement

Continual improvement is central to the documented management system standard set out by ISO 22301. Any revisions and improvements to the way the BCMS is managed will enhance the business continuity management plan over time.

ISO 22301 policies and procedures

Policies and procedures for an ISO 22301 business continuity management compliance project must be carefully managed.

An organisation must demonstrate compliance with the ISO business continuity standard by providing appropriate documentation. This includes a scope, a detailed business continuity policy, a formal risk assessment procedure and business continuity plans that show how the organisation will respond to and recover from disruption.

Terms and definitions

The standard talks in detail about security and resilience. It uses a wide range of either specialist technical terms, or common terms that have a specific meaning in a security and resilience context.

To help you understand them, it includes definitions of the 31 most important ones. It also points you towards “ISO 22301 Security and Resilience – Vocabulary”, which lists and defines almost 300 security and resilience terms.

There are some associated guideline documents that add more detail to the requirements in ISO 22301. Some of these are listed inside ISO 27001, standout guides are:

ISO 22313 – Guidance on the use of ISO 22301 ISO 22317 – Guidelines for Business Impact Analysis (BIA) If you need to understand a term that isn’t listed here, you should check in ISO 22301 to see what it means.

You can also find terms and definitions online.

ISO and IEC maintain terminological databases for use in standardisation at the following addresses:

ISO Online browsing platform
IEC Electropedia

Understanding these terms is very important. For those who are not already expert in this field, they can be a little difficult to get to grips with.

If you choose to work with us we’ll make sure you understand them. We explain them in our own support materials, and if you need more targeted help we can either answer your questions ourselves or find the right independent partner to work with you.

Auditing & Compliance

An audit is an evidence gathering process with the purpose of evaluating how well key criteria are being met. Audits must be objective, impartial, and independent, and the audit process must be both systematic and documented.

Internal audits are a mandatory part of a certified BCMS. In addition, the chosen certification body will undertake periodic ‘external’ audits in order to firstly certify the BCMS and then ensure it remains compliant to the standard. It’s also possible to carry out combined audits. This is when two or more documented management systems of different disciplines are audited together at the same time. An ISO auditor will expect to see a record of improvements your organisation has made over time. Having a method for addressing nonconformities, corrective actions and other enhancements are crucial requirements.

The importance of testing the BC arrangements

There are various ways to test the documented arrangements and plans contained in the BCMS. Examples include tabletop exercises, full or part-scale exercises and also harnessing learning from real events. ISO 22301 mandates these processes happen regularly as appropriate to your organization’s activities and risk profile.

Having achieved certification, you need to put in place a maintenance plan to ensure continued compliance to the ISO 22301 standard. At ISMS.online we have particular expertise in this.

We also understand that continuous improvement is an important part of maintaining an ISO 22301 certification. Clause 10 focuses on this, covering all actions taken within an organisation to:

Deliver business continuity goals more effectively Increase the reliability of security procedures and controls Create increased security benefits for the organisation and its stakeholders

ISO 22301 Requirements

ISO 22301:2019 implements the framework, fundamental text and definitions of Annex L, formerly Annex SL. Annex L establishes a high-level framework for ISO management system standards. The Annex was drawn up to incorporate a similar core text and common terminology and concepts.

Except for Clause 8, the Annex L requirements address many of the same areas as the core requirements of ISO 27001, covered in Section 4.1 through to 10.2.

ISO 22301: The Business Continuity Standard
Clause 1 – Scope
Clause 2 – Normative references
Clause 3 – Terms and definitions
Clause 4 – Context of the Organization
Clause 6 – Planning
Clause 7 – Support
Clause 8 – Operations
Clause 9 – Performance Evaluation
Clause 10 – Improvement

What is ISO 22301?

ISO 22301:2012 was the first version of this standard and was revised to ISO 22301:2019 on 31 October 2019. ISO 22301:2019 is also the first ISO standard to implement Annex L, from ISO/IEC Directive 1, which offers a common foundation for all new ISO management system standards.

Why is ISO 22301 Important?

retaining essential functions in times of crisis
demonstrating resilience to consumers, suppliers and tender requests
detecting and handling current and potential risks to your business
taking a proactive approach to mitigating the effect of disruptive incidents

If well done, it is possible to implement ISO 22301 and business continuity management while adopting other management system standards.

What is a Business Continuity Management System (BCMS)?

demonstrate the company recognises the importance and requirements of business continuity policies and objectives
introduce and execute procedures for incident management strategies and other measures to ensure that the organisation effectively manages and recovers from a disruption
track and continuously improve the business continuity system

Using a BCMS compliant with ISO 22301 communicates to stakeholders that your business continuity capability is acceptable for your organisation’s size and scope.

What are business continuity risks?

A well-developed, organised and regularly-reviewed Business Continuity Plan (BCP) can help the business or organisation rebound from an incident as quickly as possible.

It’s essential for procedures to be up-to-date, accurate and efficient. Methods include but are not limited to corporate risk assessments, information security risk reviews, and addressing your health and safety policies, as well as your continuity management plan.

Are you prepared to respond to and recover from a disruptive incident?

To manage such risks, organisations need effective business continuity management plans to help them quickly recover from any event.

Organisations that invest in business continuity management systems reduce the likelihood of damage to revenues and reputations when emergencies arise.

What is an ISO 22301 certificate?

The ISO 22301 standard has a ‘high-level structure’, shared with other ISO management systems standards. This creates a consistency which can help organisations integrate several management systems to meet their business continuity needs.

What is business continuity management ISO 22301?

How many key clauses are there in iso 22301.

Normative references

What is the latest version of ISO 22301?

You can find the ISO 22301:2019 standard documentation on the official ISO website here: https://www.iso.org/standard/75106.html

Why Choose ISMS.online?

ISMS.online provides a comprehensive and intuitive range of Business Continuity Management tools to help you plan for the unexpected, and then respond accordingly. Our BCM tools allow you to put all of your work relevant to ISO 22301 and Business Continuity Management System (BCMS) together. Additionally, you can easily combine ISO 22301 and ISO 27001 with ISMS.online, and obtain certification for both in our powerful all-in-one platform.

complete compliance solution

Want to explore start your free trial..

The State of Information Security Report 2024 Now Live - Read Now

+1 (800) 826-0777
VIRTUAL TOUR
Mass Notification
Threat Intelligence
Employee Safety Monitoring
Travel Risk Management
Emergency Preparedness
Remote Workforce
Location and Asset Protection
Business Continuity
Why AlertMedia
Who We Serve
Customer Spotlights
Resource Library
Downloads & Guides

A woman uses a white board to guide a discussion of business continuity strategy with her team in a conference room

A Deming Cycle Approach to Business Continuity Strategy

Building your business continuity strategy on a Design-Test-Reflect-Iterate cycle lays a solid, adaptable foundation to manage dynamic risks.

Blog-CTA-Sidebar-Graphic-BusinessContinuity-Checklist

How to Build Your Business Continuity Strategy

It’s not a question of if but when a business will encounter disruption. Challenges are inevitable, whether natural disasters, cybersecurity breaches, or other unforeseen emergencies. How your company responds will determine its trajectory.

Forty-three percent of small businesses affected by a natural disaster never reopen. But a business continuity strategy can prevent your business from living the statistics. We’ve talked to financial, aerospace, and telecom industry leaders to understand their business continuity strategies. Read on to learn about crafting an adaptable, systemic approach to navigating expected and unforeseen challenges.

Download Our Business Continuity Checklist

A cyclical approach to business continuity.

Business is not static, and neither are the threats to operations. Organizations need dynamic frameworks to navigate uncertainty in an environment characterized by constant change and evolving risks. That’s why many companies turn to the Deming Cycle, also known as PDCA (Plan-Do-Check-Act).

A diagram of the Deming Cycle's four steps: Plan, Do, Check, Act

Plan: Develop a robust continuity strategy
Do: Execute the preparedness measures
Check: Assess effectiveness through testing
Act: Adjust based on feedback for continual improvement

A business continuity strategy ensures your organization can maintain operational resilience during and after a crisis. With a systematic approach, you can manage various disruptions effectively. But first, you need to understand the potential threats to your business and how those threats would disrupt operational continuity.

This assessment process is critical for your initial planning and as an ongoing pulse check to ensure your business continuity strategy is effective—considering how your organization’s vulnerabilities and risks are changing.

A cyclical diagram of our business continuity strategy in four steps: design, test, reflect, and iterate

Design: Develop the initial framework
Test: Implement controls to assess functionality and performance
Reflect: Evaluate outcomes and identify critical optimizations
Iterate: Adapt the strategy for improved business continuity management

Better business continuity planning with SAC Wireless

On The Employee Safety Podcast , we spoke with Larry Pomykalski, Director of National Programs & Business Continuity at SAC Wireless. Larry underscores the need to cast a wide net when planning for interruptions. The plan should be broad enough to encompass a broad range of scenarios while maintaining business processes. By continuously evaluating and adjusting plans based on feedback and changing circumstances, it’s possible to minimize business disruption and speed recovery.

Larry notes that while it’s impossible to foresee every disruption, having a variety of plans enables organizations to modify strategies quickly to suit the current situation. By identifying critical business functions and establishing recovery time objectives, businesses can prioritize risks as they develop effective mitigation strategies tailored to their specific needs.

“Remain open-minded; be imaginative about what you can and can’t see impacting your organization.[…] That’s the first step in tracking potential threats,” Larry advises.

1. Design a working business continuity management strategy

Identify stakeholders and plan leaders.

A business continuity management (BCM) team is responsible for implementing your plan, so choosing the right people is vital to success. It’s typically an interdisciplinary team made up of individuals from various departments and roles within the organization, including:

Business Continuity Manager: This individual leads the continuity program’s development, implementation, and maintenance.
Risk Management Specialist: They identify, assess, and prioritize risks to the organization’s operations.
IT Director/Manager: This leader ensures critical IT systems and infrastructure resilience.
Operations Manager: Their role involves coordinating continuity efforts across departments and ensuring operational readiness.
Human Resources Manager: They are responsible for developing employee safety, communication, and workforce continuity plans.
Facilities Manager: This leader addresses physical security and facility-related risks.
Supply Chain Manager: They are responsible for assessing supply chain risks and developing strategies for continuity.
Legal and Compliance Officer: Their responsibilities include continuity plan compliance with regulatory requirements and contractual obligations.
Communications Coordinator: Their main task is to develop communication protocols and channels for internal and external stakeholders during emergencies.
Team Leaders: These individuals act as boots on the ground, providing direction and guidance to workers on the floor, in the field, or wherever they’re located.

By assembling a diverse and capable team with representation from these key areas, organizations can effectively address all aspects of business continuity planning and enhance their resilience to disruptions.

Assess potential risks and impacts

Only by knowing your risk profile inside and out can you manage and mitigate the risks to business continuity. The more you know, the more proactive you can be.

Assessments come in different forms. A threat or risk assessment considers the potential causes of disruptions, such as natural disasters, cyberattacks, power outages, supply chain interruptions, public demonstrations, public health risks, and many more. On the other hand, a business impact analysis focuses on the impacts that arise from these emergencies and disruptions, such as downtime, travel delays, compromised data, increased costs, facilities damage, delayed or lost income, regulatory fines, reputational damage, and more.

Begin with both types of assessment to understand the vulnerabilities and risks that could threaten business continuity.

Navigate resiliency challenges with regular assessments

Regular vulnerability assessments are crucial to maintaining business continuity, especially in the face of evolving challenges, such as a geographically dispersed workforce and climate-related disruptions. Jeff Dow, Manager of Protection and Resiliency at a major financial organization, highlighted the importance of staying vigilant during a recent interview on The Employee Safety Podcast .

Jeff’s team recognized that transitioning to a hybrid work model, with employees across 49 states, introduced new risks and vulnerabilities. They conducted thorough risk assessments to identify potential threats related to remote work, like extreme weather events.

They concentrated on three assessment methods to adapt their plans supporting business continuity:

Set your recovery time objective (RTO)

When setting a recovery time objective (RTO), you must consider your organization’s specific needs and priorities. Start by evaluating the criticality of each business process or system, considering factors such as customer expectations, regulatory requirements, and financial implications. Determine the maximum tolerable downtime for each function, keeping in mind that mission-critical systems may require a shorter RTO than less essential processes.

Once you’ve defined the RTOs for your key business functions, develop comprehensive strategies to achieve them. This may involve implementing redundant systems, establishing backup procedures, and investing in technologies that minimize downtime. Review and update your RTOs to ensure they remain relevant and aligned with your evolving business needs.

Remember to conduct tests and simulations regularly to validate the achievability of your RTOs and identify areas for improvement in your recovery strategies. Setting realistic and achievable recovery time objectives can enhance your organization’s preparedness for disruptions and minimize their impact on your operations and stakeholders.

Develop plans to prevent, mitigate, respond to, and recover from business disruptions

You might as well consider every version of your business continuity plan (BCP) a rough draft. Until it has been tested, you can’t be sure it’s comprehensive or effective enough to safeguard your business operations. Here are some necessary elements to consider for your dynamic strategy:

The tools and the team to monitor threats and determine their potential impacts on your organization
An emergency communication plan and a software system to keep everyone connected during expected and unexpected crises
Backup plans, equipment, locations, power, and any other redundancies that will keep operations running

Read more about the business continuity planning process on our blog.

2. Test your plan during actual and simulated emergencies

Train employees.

In the previous step, you determined which stakeholders need to be involved in the planning and preparedness efforts, risk mitigation, response procedures, disaster recovery, and any other elements of your business continuity strategy. This next phase involves preparing these people for their responsibilities. Here are suggested trainings tailored to each stakeholder’s role within the business continuity framework:

Business Continuity Manager: Training should cover developing and maintaining the continuity program, including risk assessment methodologies, plan development, testing protocols, and coordination with departmental stakeholders.
Risk Management Specialist: Offer detailed training on risk assessment techniques such as scenario analysis, impact assessment, and probability assessment.
IT Director/Manager: Conduct technical training on data backup and recovery procedures, system redundancy configurations, cybersecurity best practices, and incident response protocols.
Operations Manager: Provide training on crisis management principles, including incident response procedures, business impact analysis, and resource allocation strategies.
Human Resources Manager: Offer comprehensive training on crisis communication strategies, employee safety protocols, and workforce continuity planning. Include modules on remote work arrangements, employee assistance programs, and psychological support during crises.
Facilities Manager: Review building security systems, access control protocols, emergency response drills, and facility maintenance procedures.
Supply Chain Manager: Provide training on supply chain risk management techniques, including supplier assessment methodologies, inventory management strategies, and alternative sourcing options.
Legal and Compliance Officer: Cover topics such as data protection laws, industry standards, contractual obligations for continuity services, and legal implications of business disruptions.
Communications Coordinator: Provide comprehensive training on crisis communication strategies, including message development, media relations, stakeholder engagement techniques, and communication channel management.

By providing detailed and targeted training to each stakeholder, you ensure they have the necessary knowledge and skills to contribute to the organization’s business continuity efforts effectively. Of course, a significant part of that training is testing the skills they’ve learned.

Conduct drills and other exercises

Emergency drills , full-scale simulations, and tabletop exercises can test your preparedness, response, and recovery plans. These exercises allow you to identify weaknesses and gaps in your plans in a controlled environment, enabling you to address them proactively before a real crisis occurs. By simulating various scenarios, you can evaluate the effectiveness of your communication protocols, decision-making processes, and resource allocation strategies.

Involving key stakeholders in these exercises fosters collaboration, enhances coordination, and increases familiarity with their roles and responsibilities during emergencies. Regularly conducting drills and exercises ensures your team remains well-prepared and agile in responding to unexpected events, strengthening your organization’s resilience and ability to navigate challenges effectively.

After-action reviews following exercises, not just actual emergencies, are essential for continuous improvement and learning. These reviews provide an opportunity to evaluate the effectiveness of your response and recovery plans in a structured manner before putting them to the test with your business on the line. By examining what went well and what could be improved, you can identify lessons learned and best practices to incorporate into future planning efforts.

On top of that, conducting after-action reviews fosters a culture of accountability and transparency within your organization, encouraging open communication and constructive feedback among team members. This process allows you to iterate on your strategies and capabilities, ensuring you are better prepared to handle real emergencies when they arise.

Activate the plan as any actual threats or disruptions arise

Hopefully, you’ve been able to prioritize training and exercises before a significant crisis hits. Doing so ensures that your team is well-prepared to execute the plan with confidence and efficiency when it matters most.

However, even if you haven’t had the opportunity to conduct extensive training beforehand, your preparation through drills and simulations will still significantly enhance your response capabilities. Remember to remain agile and adaptable during emergencies, leveraging the knowledge and experience gained from training to make informed decisions and effectively manage the situation.

3. Reflect on the plan’s effectiveness and its need to evolve

Perform after-action reviews.

After-action reviews (AARs) enhance business resilience by providing a structured post-crisis evaluation and improvement framework. These reviews thoroughly examine the response to a crisis or disruption, aiming to identify strengths, weaknesses, and opportunities for enhancement. They allow you to test your business continuity plan and management systems in real-time to address any gaps. Typically conducted shortly after the event, AARs gather input from key stakeholders involved in the response effort, including frontline responders, managers, and support staff.

Conducting an AAR begins with a comprehensive review of the incident, including the timeline of events, actions taken, and outcomes achieved. This retrospective analysis allows participants to understand what transpired during the crisis and how the organization responded. Facilitators guide discussions by prompting participants to reflect on their experiences, share observations, and identify successes and improvement areas.

Central to the AAR process is emphasizing open and honest communication, creating a safe space for participants to voice their perspectives and insights without fear of retribution. This collaborative approach fosters a culture of continuous learning and improvement within the organization. By soliciting feedback from all levels of the organization, AARs capture diverse perspectives, enriching the insights gained from the review process.

Determine gaps and necessary contingency plans

The ultimate goal of conducting AARs is to distill lessons learned from the crisis response and translate them into actionable improvements to the organization’s business continuity plan and risk management strategy. This may involve updating procedures, refining communication protocols, or investing additional resources to address identified gaps. By leveraging the insights gleaned from AARs, organizations can strengthen their preparedness for future crises, enhancing their resilience and ability to navigate adversity effectively.

Boeing’s all-hazards approach to business continuity

An effective business continuity plan relies heavily on the team’s ability to collaborate seamlessly, even across physical and geographic boundaries. On The Employee Safety Podcast , we spoke with Keith Berthiume, Enterprise Emergency Preparedness Program Manager at Boeing, to understand why Boeing is an excellent example of an agile, collaborative approach.

Keith underscores the significance of assembling diverse teams to evaluate impacts, recognize critical needs and functions, and coordinate responses promptly. This real-time collaboration has proven instrumental for Boeing, enabling the company to swiftly adapt and respond to evolving situations, such as the challenges posed by the COVID-19 pandemic.

Boeing’s success highlights the importance of effective communication and coordination within the organization and with external stakeholders, including service providers and off-site teams. Businesses can enhance their resilience and readiness to navigate complex, unforeseen disruptions by fostering collaboration across boundaries.

“Having senior leaders all together on a team is a significant force multiplier because the executives at the highest level of the company are able to ensure implementation of integrated and coordinated response, seamless coordination, and a unified direction from the leadership team,” Keith told us.

4. Iterate on your strategy in light of dynamic risks

Adapt to company changes.

The after-action reviews are what keep the cycle turning. While the advance threat and impact assessments help you align with and prioritize what you know, post-event reviews are about opening up to what you don’t know—or what you didn’t know with the most recent iteration of your plan.

You may only know about certain vulnerabilities once you are in an actual or simulated emergency. So, looking back and acting on those learnings is foundational to business continuity.

Adapt to changing risk

Twenty years ago, businesses rarely considered the effect that a prolonged pandemic could have on their ability to operate. Continuity plans were based more on immediate threats like natural disasters or economic downturns.

However, the landscape has shifted dramatically, emphasizing the need for organizations to adapt and expand their risk management strategies to encompass emerging threats such as pandemics. The global impact of COVID-19 has underscored the importance of proactive planning and preparedness for unforeseen events that can disrupt operations on a massive scale. As businesses navigate the complexities of this evolving risk landscape, it becomes increasingly crucial to prioritize resilience and agility in their continuity planning efforts.

In response to the lessons learned from COVID-19 and other emerging risks, business leaders can take proactive steps to stay ahead of future challenges. To adapt to changing risks, you should:

Conduct regular risk assessments to identify vulnerabilities.
Diversify supply chains to mitigate disruptions.
Prioritize employee well-being and flexible work arrangements.
Implement cross-training programs to ensure redundancy in critical roles.
Maintain adequate financial reserves to weather economic uncertainties.
Strengthen cybersecurity measures for remote work environments by implementing multi-factor authentication, encryption, and regular security training.

Organizations can also make use of various technologies for proactive threat monitoring. Threat intelligence platforms can help them discover cyber risks, while real-time alert tools can keep them ahead of natural disasters or other widespread disruptions.

Strategic Planning to Keep the Wheel Turning

Business continuity planning is not a nice-to-have but a necessity in today’s unpredictable world. Whether it’s a natural disaster, cybersecurity breach, or other unforeseen emergency, the ability to respond effectively can make or break a business. As industry leaders and best practices highlight, adopting a structured approach like the PDCA cycle is essential for building resilience and adaptability.

Learning from business continuity strategy examples, companies can prioritize collaboration, real-time communication, and flexibility in their response efforts. Download our business continuity checklist for a template to help guide you on solid business continuity planning.

Business Continuity Checklist

Please complete the form below to receive this resource.

Check Your Inbox!

The document you requested has been sent to your provided email address.

Cookies are required to play this video.

Click the blue shield icon on the bottom left of your screen to edit your cookie preferences.

An official website of the United States government

Here’s how you know

Official websites use .gov A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS A lock ( Lock A locked padlock ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

https://www.nist.gov/mep/business-continuity-planning

Manufacturing Extension Partnership (MEP)

Business continuity planning.

Business continuity planning enables you to create an easy-to-use, actionable business continuity planning solution to prepare for the impact of a broad range of threats including natural disasters, disease outbreaks, accidents and terrorism. In addition business continuity planning can help when you face technology-related hazards like the failure of systems, equipment or software. MEP Centers can assist you in developing a plan unique to your needs.

If your company needs to create or tweak a business continuity plan, I highly suggest reaching out to Purdue MEP!

—Doug Ellington, Director of Finance, Estes Design and Manufacturing Read the Success Story

Businessman holding tablet and showing the best quality assurance with golden five stars

Illuminating Possibilities to Achieve ISO Certification

Business Continuity Plans: Lessons Learned From Puerto Rico

For more information or assistance with business continuity planning, please contact your local MEP Center .

If you would like someone to contact you about business continuity planning , please complete the form below.

For General Information

MEP Headquarters [email protected] (301) 975-5020 100 Bureau Drive, M/S 4800 Gaithersburg, MD 20899-4800

7 Benefits of Working with a Business Continuity Consultant

D id you know that 90% of small businesses fail within a year unless they can continue operations within five days after a disaster? Businesses without a disaster recovery plan in place will likely never re-open their doors.

If you don’t have a solid business continuity plan, this could be your fate. To avoid this problem and resume operations as normal during an emergency, hire a business continuity consultant.

Keep reading to learn the seven benefits of working with these professionals.

1. Regulatory Compliance

A business continuity consultant will help you meet regulatory requirements. Regulatory requirements are costly if you breach them.

Legislations are continuing to grow to support business mitigation strategies. Additionally, governance regulations emphasize reasonable care in the face of potential business risks.

There are many potential cyber-attacks and risks businesses should be aware of. When you are equipped to respond to these attacks, you protect more data.

Regulatory compliance compels businesses to prioritize cybersecurity and business continuity strategies. This can protect assets and your reputation as well.

Making risk assessments a habit can help your business stay clued up on the rules.

Keep in mind that even as cyberattacks become more sophisticated, insurance doesn’t protect your data. Insurance usually isn’t enough to cover all of the damages that come from a disaster.

2. Valuable Business Data

Business continuity plans generate a wealth of data to help you understand business operations. Some of the data you can collect includes:

Critical tasks
Recovery time objectives
Financial impact of disruptions

This data will help you prepare and recover from unexpected events. Your business will be equipped to navigate any challenge thrown your way.

Data is a valuable asset that can be used in various ways. When you analyze the data, you can make informed decisions that help drive your business toward long-term success.

Additionally, this valuable business data is more than you can get with backups. Most companies have a form of data backup, but this does no good if you don’t have access to it.

How can you access data in the event of an outage? If your business continuity plan leverages cloud technology and virtual servers, your business can run critical applications in the cloud. This also helps keep downtime to a minimum.

3. Minimize Downtime

Business continuity planning is a great investment because it can minimize downtime during a disruption.

A business continuing consultant helps you identify potential risks and develop contingency plans. These allow you to respond to an unexpected event and reduce downtime.

Your business can continue to operate during times of crisis. This also helps with maintaining your reputation because it keeps your customers happy.

Reducing downtime saves you a considerable amount of cash. When operations slow, you lose revenue, productivity decreases, and your overall business reputation takes a hit.

To avoid these negative consequences, minimize your downtime through business planning with a continuity consultant.

4. Rise in Trust and Confidence

A business continuity consultant increases trust and confidence in two ways. First, your customers are more trusting of your business. Second, your workforce has more confidence in their training during an emergency.

Your buyers aren’t likely to learn about a disaster until you have no choice but to tell them. They will notice if you are responding quickly to the problem.

Giving your customers a rundown of your protection strategy can help them feel more confident in your work. This can create an invaluable sense of trust.

Employees will also be more confident in their work through better training and effective responses. In the event of a crisis, employees can stay calm knowing how to handle the situation.

Business continuity and disaster recovery planning can be tailored to fit the goals of your business and the needs of your customers.

5. Strengthens Your Brand

Similarly to building trust and confidence, business continuity creates a lasting mark on your brand. People will remember your choices and what they represent to them as customers in the future.

For instance, how you handle production challenges or new communications platforms will say a lot about your business.

Brands survive on consistent values. A business continuity consultant will help you create a plan that ensures you don’t do anything to undermine your reputation.

6. Supply Chain Protection

Suppliers need to know about risks just as your company does. They should be completing assessments to create their own disaster plans as well.

A business continuity consultant will encourage you to talk to your suppliers about disaster planning. Ask suppliers about the protections they can offer your business, such as:

Cyber defenses
Remote business communications
Multiple locations for production

Business continuity management has to work in both directions. You need to understand the potential threats and how they impact day-to-day operations. Share your own business continuity plan with suppliers too.

7. Get Ahead of the Competition

Some companies miss out on business continuity; don’t be one of them. Other businesses may fail to prepare and take stock of resources, agility, skills, and weak spots.

Instead of future-proofing, they look at the present. This will eventually affect how they stay relevant.

You will have a huge advantage over the competitors if you can restore business operations while they are trying to figure things out. Getting your network back up and running quickly will make you stand out as a leader in the industry.

When times change, you’ll race ahead of the competition with a business continuity consultant. Focus on the longer term instead of only worrying about what is happening at the moment.

Work With a Business Continuity Consultant Now

A business continuity consultant will learn about your company and create a business continuity plan tailored to your needs. These plans help business operations and customer relations.

By keeping operations going, you keep employees working and keep your customers happy.

When choosing a business continuity consultant, find one who has experience helping multiple companies develop and implement a successful plan of action. In the event of a disaster, your business will be protected as much as possible.

Are you looking for more business advice? Keep coming back to our blog for regular new posts.

This article is published by NYTech in collaboration with Syndication Cloud.

7 Benefits of Working with a Business Continuity Consultant

COMMENTS

Business Continuity Planning (BCP)
FINRA requires firms to create and maintain written business continuity plans (BCPs) relating to an emergency or significant business disruption. Rule 4370—FINRA's emergency preparedness rule — spells out the required BCP procedures. A firm's BCP must be appropriate to the scale and scope of its business. BCP procedures must be reasonably designed so the firm can meet its existing ...
What Is A Business Continuity Plan? [+ Template & Examples]
A business continuity plan is important because regular operations will need to continue in the event of a crisis —and sometimes, especially during a crisis. Having a business continuity plan in case of each type of crisis will be helpful in maintaining your operations. ... Strategies and Requirements. 1. [Proactive strategies to prevent ...
Business Continuity Planning
Learn how to create and test a business continuity plan to manage a business disruption. Find videos, resources and instructions on the planning process and the benefits of having a plan.
All about Business Continuity Planning
Business continuity planning (BCP) refers to the work a company does to create a plan and system to deal with risks. Thorough planning seeks to prevent problems and ensure business processes continue during and after a crisis. Business continuity planning ensures that the company deals with disruptions quickly, and minimizes the impact on operations.
What Is a Business Continuity Plan (BCP), and How Does It Work?
Business Continuity Planning - BCP: The business continuity planning (BCP) is the creation of a strategy through the recognition of threats and risks facing a company, with an eye to ensure that ...
ISO 22301 Business Continuity Management Made Easy
ISO 22301 Simplified Cheat-Sheet. Use this simplified cheat-sheet to understand the basic elements of creating a business continuity plan. The template walks you through the process of determining critical aspects of your organization, writing the recovery plan, and exercising the plan to ensure proficiency.
Business continuity plan (BCP) in 8 steps, with templates
Step 1: Establish an emergency preparedness team. Assign a team the responsibility for emergency preparedness. Select a few managers or an existing committee to take charge of the project. It's advisable to assign one person to lead the planning process.
How to create an effective business continuity plan
A business continuity plan (BCP) is a strategic playbook created to help an organization maintain or quickly resume business functions in the face of disruption, whether that disruption is caused ...
ISO 22301:2019
ISO 22301 is the international standard for Business Continuity Management Systems (BCMS). It provides a framework for organizations to plan, establish, implement, operate, monitor, review, maintain, and continually improve a documented management system to protect against, reduce the likelihood of, and ensure recovery from disruptive incidents.
ISO 22301:2019(en), Security and resilience ? Business continuity
0.1 General. This document specifies the structure and requirements for implementing and maintaining a business continuity management system (BCMS) that develops business continuity appropriate to the amount and type of impact that the organization may or may not accept following a disruption.
5 Step Guide to Business Continuity Planning (BCP) in 2021
Learn what a BCP is, why it is important, and how to create one for your organization. This article covers the key steps, benefits, and differences of BCP and disaster recovery (DR) plans.
Business Continuity Compliance Requirements
Business continuity planning is essential for compliance because it helps organizations meet regulatory requirements, ensure the continuity of critical operations, and protect sensitive information. A strong BCP can also solidify a business's reputation and help avoid legal and financial penalties in the case of unexpected downtime.
Business Continuity Plan: Example & How to Write
Step 3: Establish the business continuity plan objectives. Step 4: Evaluate the potential impact of disruptions to the business and its workers. Step 5: List actions to protect the business. Step 6: Organize contact lists. Step 7: Maintain, review, and continuously update the business continuity plan.
Business Continuity Plan (BCP) Structure According to ISO 22301
According to ISO 22301, business continuity plan is defined as "documented procedures that guide organizations to respond, recover, resume, and restore to a pre-defined level of operation following disruption." (clause 3.5) This basically means that BCP focuses on developing plans/procedures, but it doesn't include the analysis that forms ...
How to craft an effective business continuity plan
Create the procedures. Get the word out. Iterate and improve. 1. Analyze your company. In this phase you conduct an analysis to identify critical activities, determine which activities must continue, which can be temporarily paused, and which can operate at a reduced capacity.
PDF Creating a Business Continuity Plan
Business continuity planning is the process of identifying critical business functions of an organization, developing ... and the resource requirements and availability for successfully recovering afterward. A BCP is not intended to be an exhaustive "how to" manual, but rather to act as a realistic guide for good decision making, and to ...
ISO
A free publication about ISO 22301, Security and resilience - Business continuity management systems - Requirements, the International Standard for implementing and maintaining effective business continuity plans, systems and processes.
PDF The Definitive Guide to Business Continuity Planning
Welcome to the Definitive Guide to Business Continuity Planning—the. indispensable resource for developing your business continuity plan. This handbook can be used to guide you in developing a BC plan from start to finish, or as a tool to test and improve your existing plan, or for anything in between.
Business Continuity Planning FAQ
Business Continuity Planning FAQ. 1. What is the purpose of the disclosure requirement in FINRA Rule 4370 (e)? The purpose of the disclosure requirement in FINRA Rule 4370 (e) is to assist customers in making educated decisions about whether to place their funds and securities at a specific firm. The disclosure may state that the firm's BCP is ...
ISO 22301
When based on ISO 22301, ISO itself emphasises the importance of business continuity management systems: Showing the organisation understands the needs and necessity for a stated business continuity policy and objectives. Implementation and execution of processes, incident response mechanisms and other interventions to ensure the organisation ...
What is a Business Continuity Plan (BCP)?
A business continuity plan (BCP) is a document that consists of the critical information an organization needs to continue operating during an unplanned event. The BCP states the essential functions of the business, identifies which systems and processes must be sustained, and details how to maintain them.
Business Continuity Strategy Guide [+Free Checklist]
An effective business continuity plan relies heavily on the team's ability to collaborate seamlessly, even across physical and geographic boundaries. On The Employee Safety Podcast , we spoke with Keith Berthiume, Enterprise Emergency Preparedness Program Manager at Boeing, to understand why Boeing is an excellent example of an agile ...
Business Continuity Planning
Manufacturing. For General Information. MEP Headquarters. [email protected]. (301) 975-5020. 100 Bureau Drive, M/S 4800. Gaithersburg, MD 20899-4800. Created June 4, 2020, Updated December 1, 2022. Business continuity planning enables you to create an easy-to-use, actionable business continuity planning soluti.
How to write a business continuity plan
Business continuity planning refers to the systems and procedures that allow businesses to maintain or quickly resume functions in the event of a major disruption. Essentially, business continuity is like having a back-up plan. A business continuity plan should outline procedures and instructions for staff members in the event of a disaster.
7 Benefits of Working with a Business Continuity Consultant
Business continuity planning is a great investment because it can minimize downtime during a disruption. A business continuing consultant helps you identify potential risks and develop contingency ...

What Is A Business Continuity Plan? [+ Template & Examples]

What is a business continuity plan?

Business Continuity Plan Template

Crisis Communication and Management Kit

You're all set!

Business Continuity Planning

Don't forget to share this post!

How to Navigate Customer Service During a Business Closure

10 Crisis Communication Plan Examples (and How to Write Your Own)

I Tried 7 Crisis Management Software to See if They’re Worth It (Results & Recommendations)

20 Crisis Management Quotes Every PR Team Should Live By

Social Media Crisis Management: Your Complete Guide [Free Template]

De-Escalation Techniques: 19 Best Ways to De-Escalate [Top Tips + Data]

Situational Crisis Communication Theory and How It Helps a Business

What Southwest’s Travel Disruption Taught Us About Customer Service

Showcasing Your Crisis Management Skills on Your Resume

What Is Contingency Planning? [+ Examples]

Business Continuity Planning

Business Continuity Plan Supporting Resources

Business Continuity Training Videos

Frequently Asked Questions

The Bottom Line

What Is a Business Continuity Plan (BCP)?

Key Takeaways

Understanding Business Continuity Plans (BCPs)

Benefits of a Business Continuity Plan

How To Create a Business Continuity Plan

Business Continuity Impact Analysis

Business Continuity Plan vs. Disaster Recovery Plan

Why Is Business Continuity Plan (BCP) Important?

What Should a Business Continuity Plan (BCP) Include?

What Is Business Continuity Impact Analysis?

ISO 22301 Business Continuity Simplified: Fortify Your Business Against Disruption

What Is ISO 22301?

The Business Manager’s Quick-Start Guide to ISO 22301

ISO 22301 Requirements

Key Definitions Related to ISO 22301

Benefits of ISO 22301 and Business Continuity Management System

ISO 22301 in Action

How a Management System Helps Business Continuity

ISO 22301 and PDCA

ISO 22301 and Maturity Models

BCM Lifecycle ISO 22301

ISO 22301 Audit Checklist Template (Excel)

ISO 22301 Self-Assessment Checklist

ISO 22301 Implementation Guide

ISO 22301 Simplified Cheat-Sheet

ISO 22301 Business Continuity Policy Template

ISO 22301 Business Continuity Template

ISO 22301 Business Continuity Sample

Disaster Recovery Plan Templates

ISO 22301 Versus ISO 27301

General Requirements Across Management System Standards

Historical Foundations of ISO 22301

Guidance Documents for ISO 22301

What Is the Latest Version of ISO 22301?

Build Powerful, Automated Business Processes and Workflows with Smartsheet

Discover why over 90% of Fortune 100 companies trust Smartsheet to get work done.

Our Network

How to create an effective business continuity plan

What is a business continuity plan?

Why business continuity planning matters

Building (and updating) a business continuity plan

The importance of testing the business continuity plan

Types and timing of tests

How to ensure business continuity plan support, awareness

Related content

What’s holding CTOs back?

Baldor’s first-ever CIO sets the transformation agenda

CIO Leadership Live with Satya Jayadev, Vice President & CIO, Skyworks Solutions

Principal Financial CIO Kathy Kay on balancing traditional AI and genAI

CIO Leadership Live Middle East with Ramadan Mohamad, Digital infrastructure specialist at Public Transport Corp.

Alteryx adds genAI to enable analytics creation via no-code platform

ISO 22301 Documentation Toolkits

Where to Start

Dejan Kosutic

Business continuity plan: How to structure it according to ISO 22301

What is a business continuity plan?

Business continuity plan example

Related Products