ISO 22301:2019 - Business Continuity Management (BCMS)

Explore terms and definitions in ISO 22301:2019 part 1, including activity, auditing, business continuity, business continuity plan, and business impact analysis, with practical workflow examples.

Explore terms and definitions in ISO 22301:2019 Part 2, including competence, conformity, continual improvement, corrective action, nonconformity, and the difference between continual and continuous improvement with root cause analysis.

Explore six ISO 22301:2019 definitions—disruption, incident, documented information, effectiveness, impact, and interested parties—and their roles in managing unplanned disruptions to product and service delivery.

Define the core terms of ISO 22301:2019 for bcms, including management, management system, measurement, monitoring, and nonconformity, and explain their link to policies, objectives, and recovery processes.

Explore key terms in ISO 22301:2019 part 5: objective, organization, outsourcing, performance, policy, and prioritized activity, with smart objectives aligned to stakeholders and business continuity needs.

Explore terms and definitions in ISO 22301:2019 business continuity management, including processes that transform inputs into outputs, products and services, requirements, resources, risk, and top management.

Identify internal and external issues in the organization's context relevant to its BCMS under ISO 22301 clause 4.1, and address interested parties and legal requirements with documented, up-to-date processes.

Define the bcms scope by setting boundaries for locations and processes, including products and services, considering internal and external issues, legal or regulatory requirements, and interested parties, with documented exclusions.

Top management demonstrates leadership and commitment by aligning the business continuity policy and objectives with the strategic direction, integrating them into core processes, and promoting ownership across stakeholders.

Establish and communicate a business continuity policy that sets objectives, commits to applicable and legal requirements, enables continual improvement, and is communicated within the organization and available to interested parties.

Define roles, responsibilities, and authorities under clause 5.2.3 by assigning and communicating ownership to top management, and establishing reporting on system performance.

Explore clause 6 of ISO 22301: identify risks and opportunities, plan actions, set measurable business continuity objectives, and plan changes to the BCM for continual improvement.

Explore ISO 22301 clause 7 on resources, competence, and awareness. Learn how to determine resources, ensure staff competence with training, and foster policy awareness before, during, and after disruptions.

Describe communicating the business continuity policy to interested parties and controlling documented information under clauses 7.4 and 7.5, including creation, control, and access.

Plan, implement, and control processes under clause 8 using clause 6.1 inputs, establish criteria, and manage planned and unplanned changes and outsourced processes through business impact analysis and risk assessment.

Learn to perform a business impact analysis to identify critical activities and the recovery time objective. Then conduct a risk assessment to identify, analyze, and treat disruption risks.

Identify and select business continuity strategies and solutions from the outputs of the business impact analysis and risk assessment, prioritizing activities before, during and after disruptions to continue and recover.

This lecture explains implementing a responsive structure for business continuity plans and procedures (clause 8.4), detailing activation, role assignments, response teams, and clear communications.

Document and maintain procedures for internal and external communication during disruptions, including how to alert interested parties, coordinate with emergency responders, and manage media communications.

Define and maintain the business continuity plan and procedures under clause 8.4.4, detailing activation thresholds, priority activities, health and safety, and response, with roles, resources, and standing down procedures.

Understand recovery (clause 8.4.5) with documented restoration processes, and exercise program (clause 8.5) to validate continuity strategies, followed by evaluation (clause 8.6) of BIA, risk, and suppliers for continual improvement.

Plan and document monitoring, measurement, and analysis for ISO 22301 performance evaluation, including RTO testing and evidence. Conduct impartial internal audits with defined scope, criteria, corrective actions, and follow-up verification.

Explore the management review under clause 9.3 of ISO 22301 BCMS. Learn inputs, such as action status, performance data, audits, and stakeholder feedback, and outputs for continual improvement.

Outlines ISO 22301 clause 10 improvements, detailing improvement opportunities, nonconformity correction, root-cause analysis, corrective actions, and continual improvement via management reviews, audits, and performance evaluation.

Apply for our custom certificate using the application form with your email, completion date, and full name, plus progress evidence and a short takeaways note; certificates are issued monthly.