ISO 22301: Business Continuity Management Systems (BCMS)

Name: ISO 22301: Business Continuity Management Systems (BCMS)
Rating: 4.5 (8555 reviews)

Master business continuity and disaster recovery — business impact analysis (BIA), BC strategies, plans and exercises

Bestseller

Role Play

Created byCristian Vlad Lupa, rigcert.education

Last updated 7/2026

English

Arabic [Auto],German [Auto],

What you'll learn

What is a business continuity management system
What are the requirements of ISO 22301:2019
Key tools for business continuity like the business impact analysis or the risk assessment
What is a business continuity strategy and what it should include
Concepts like the MTPD, RTO, RPO, MBCO
How a business continuity management system can be implemented

Course content

9 sections • 34 lectures • 2h 22m total length

Introduction2:30
The concept of Business Continuity3:26
What is the purpose of business continuity. General information about business continuity as a concept.
ISO 22301 and related standards4:28
About the ISO 22301 and other related standards. The structure of ISO 22301:2019.
The Business Continuity Management System (BCMS)3:15
What is a management system. General information about the business continuity management system.

Understanding the organization and it's context5:29
Examples of internal and external issues that are relevant to the organization.
Needs and expectations of interested parties3:09
Who are the interested parties (stakeholders). Examples of needs and expectations.
The scope of the Business Continuity Management System (BCMS)3:27
What is the scope of the BCMS. How the organization can decide the scope of its business continuity management system
Climate action changes. Amendment 1 from February 202410:49
About the 2024 amendment to ISO 22301:2019 about climate change. Determinig whether climate change is a relevant issue and acknowledging the relevant interersted parties can have requirements related to climate change

Leadership and commitment4:05
The top management shall demonstrate leadership and commitment with regards to the BCMS. How to do that.
The business continuity policy3:03
What should the business continuity policy include. What are the requirements with regards to the communication and availability of the policy.
Roles, responsibilities and authorities3:06
The persons responsible for managing the BCMS. What are their responsibilities and authorities.

Actions to address risks and opportunities4:37
Risks and opportunities related to the BCMS. Examples of risks and opportunities and the process for their identification and treatment.
Business continuity objectives and planning to achieve them3:37
There shall be business continuity objectives. The organization is required to monitor the achievement of its objectives. Examples of business continuity objectives and plans for their achievement.
Planning changes to the Business Continuity Management System1:55
The organization shall control the changes to its business continuity arrangements so that negative impacts are avoided or mitigated.

Resources2:03
The resources needed for the BCMS. Who should provide the resources.
Competence4:04
The process for ensuring competency. Actions to address the gap between existing and required competence.
Awareness3:11
The importance of awareness for business continuity. What should an awareness program include.
Communication5:05
Internal and external communications relevant for the BCMS.
Documented information4:30
The documentation that supports the Business Continuity Management System. Types of documents. Controls for documented information.

The Business Impact Analysis (BIA)9:50
How the business impact analysis can be performed. What impacts can be considered. Concepts like MTPD (Maximum Tolerable Period of Disruption), RTO (Recovery Time Objective), MBCO (Minimum Business Continuity Objective) or RPO (Recovery Point Objective).
The risk assessment6:16
The process to identify, analyze, assess and treat risks that can lead to disruptions. Aspects to consider in the risk assessment process and details as to how the risk assessment can be performed.
Business continuity strategies and solutions7:11
Using the information from the business impact analysis and the risk assessment the organization shall articulate its business continuity strategies and solutions. What elements should normally include a business continuity strategy.
The incident response structure4:17
An incident response structure shall be formally appointed. Who should be part of the incident response structure and what are the responsibilities of this structure
Warning and communication3:10
Communication is very important in case of a disruption. What and with whom the organization should communicate.
Business continuity plans and procedures5:20
The organization shall document and maintain business continuity plans and procedures. Those document detail how the organization will respond to a disruption and how activities are to be resumed. What should be included in a business continuity plan.
Exercise programme4:22
The business continuity arrangements shall be tested periodically. The organization shall develop and implement an exercise programme. Different types of exercises that can be performed.
Evaluation of business continuity documentation and capabilities3:42
The business impact analysis, the risk assessment, business continuity strategies and solutions, plans and procedures shall be evaluated periodically
We should consider investing in business continuity

Monitoring, measurement, analysis and evaluation2:14
The organization is required to monitor and measure its BCMS. The data generated from monitoring and measuring shall be analyzed and evaluated. Examples of key performance indicators for the BCMS.
Internal audit4:40
The BCMS shall be audited internally at planned intervals. About the internal audit programme, the auditors and the documents generated from the internal audit process.
Management review4:13
The top management of the organization is required to review periodically the BCMS to ensure that it remains suitable, adequate and effective. About the input elements to the management review and about what should be the outcomes of the reviews.

Requirements

No specific prior knowledge required.
Familiarity with management systems is helpful.
General knowledge on business continuity and disaster recovery is helpful.

Description

ISO 22301 is the international standard for business continuity management systems (BCMS) — the framework that prepares an organization to withstand disruption: to keep delivering its products and services through incidents, disasters and crises, and to recover quickly when operations are affected. In a world of cyber attacks, supply chain failures, power outages and extreme weather, business continuity has become a core discipline of organizational resilience — and ISO 22301 defines how it's done.

This course discusses the concept of business continuity and the requirements of ISO 22301:2019, following the structure of the standard:

Context of the organization — internal and external issues, the needs and expectations of interested parties, and the scope of the BCMS
Leadership — top management commitment, the business continuity policy, and roles, responsibilities and authorities
Planning — actions to address risks and opportunities, business continuity objectives, and the planning of changes
Support — resources, competence and awareness, communication, and documented information
Operation — the heart of the standard:
- The business impact analysis (BIA) — identifying prioritized activities and the impacts of disruption over time
- The risk assessment for business continuity
- Business continuity strategies and solutions
- Business continuity plans (BCPs) and procedures
- Warning and communication, and the incident response structure
- The exercise programme — testing plans before a real disruption does
- Evaluating business continuity documentation and capabilities
Performance evaluation — monitoring and measurement, analysis and evaluation, internal audits of the BCMS, and the management review
Improvement — nonconformities, corrective actions and continual improvement

After completing the lessons you will have a clear picture of how a business continuity management system is shaped, what its main elements are, what documentation it requires and how it is implemented.

Who this course is for

Business continuity managers and coordinators building or maintaining a BCMS
IT and information security professionals responsible for disaster recovery and IT continuity
Risk and resilience professionals connecting business continuity to enterprise risk management
Auditors assessing business continuity — of suppliers, partners, or for certification purposes
Professionals working toward certification as a business continuity professional
Anyone with BCMS responsibilities in an organization pursuing ISO 22301 certification

If your organization intends to certify to ISO 22301 and you have responsibilities for the BCMS, this course will give you the support you need.

Who this course is for:

Business continuity managers
Business continuity engineers
Risk specialists
Business continuity consultants
Management system auditors
Business owners
People involved in business continuity and disaster recovery related activities

ISO 22301: Business Continuity Management Systems (BCMS)

What you'll learn

Explore related topics

Course content

General aspects4 lectures • 14min

Context of the organization4 lectures • 23min

Leadership3 lectures • 10min

Planning3 lectures • 10min

Support5 lectures • 19min

Operation9 lectures • 44min

Performance evaluation3 lectures • 11min

Improvement2 lectures • 6min

Final words2 lectures • 5min

Requirements

Description

Who this course is for: