ISO 22301
A practical, scoped engagement for organisations seeking ISO 22301 support.
How we work
The ISO 22301 engagement follows the activities below. The scope and outputs are agreed with you before work starts.
- 01Agree continuity scope and identify critical activities.
- 02Analyse disruption impacts, dependencies and recovery objectives.
- 03Develop proportionate response and recovery arrangements.
- 04Exercise plans and review the continuity management system.
- 05Support independent assessment and finding closure.
What you can expect
- BCMS scope, continuity responsibilities and dependency map
- Business impact analysis, recovery priorities and continuity strategies
- Response plans, exercise results and corrective action tracker
What we need to get started
- Critical services, locations, suppliers and technology dependencies
- Existing continuity, incident and recovery plans
- Business continuity, operations and technology owners
From first discussion to delivery
Typical activities for this service. The agreed scope determines the work and outputs.
- 01Agree continuity scope and identify critical activities
- 02Analyse disruption impacts, dependencies and recovery objectives
- 03Develop proportionate response and recovery arrangements
- 04Exercise plans and review the continuity management system
- 05Support independent assessment and finding closure
ISO 22301:2019: scope and objectives
Build and exercise a continuity management system that supports the organisation’s response to disruption and recovery of critical activities.
The applicable 2024 climate action amendment should be considered alongside ISO 22301:2019. Certification does not guarantee uninterrupted service or recovery in every scenario.
Proposed scope of services
We agree the scope, delivery responsibilities and outputs for each engagement. The activities below describe a practical path and are tailored to your organisation.
| Engagement phase | Activities |
|---|---|
| Context and continuity scope | Identify products, services, locations, interested parties and responsibilities within the BCMS scope. |
| Governance and objectives | Agree leadership responsibilities, continuity policy, objectives, programme ownership and review arrangements. |
| Business impact analysis | Identify critical activities, disruption impacts over time, dependencies, recovery priorities and recovery objectives with business owners. |
| Continuity risk assessment | Assess disruptive scenarios, dependencies and existing safeguards; prioritise risks and treatment decisions. |
| Continuity strategies | Review response and recovery options for people, premises, technology, suppliers and other dependencies. |
| Plans and communications | Develop or improve incident response, escalation, communications and business continuity plans for the agreed scenarios. |
| Exercises and evaluation | Plan and facilitate proportionate exercises or walkthroughs, record outcomes and prioritise improvements. |
| Documentation and evidence | Organise analysis, plans, exercise results, training records, responsibilities and corrective action evidence. |
| Internal audit and management review | Review the BCMS and its operation, record findings, support leadership review and track corrective actions. |
| Independent assessment support | Support readiness, audit coordination, evidence requests and closure of assessment findings. |
Readiness and certification path
We work with your team to establish the management system, operate the agreed processes, review evidence and address internal findings. The selected independent certification body determines its own audit scope and conducts the assessment. Initial certification commonly includes a Stage 1 readiness and planning review followed by a Stage 2 assessment of implementation and effectiveness. We can support coordination, responses and corrective actions; the independent body makes the certification decision.
Typical deliverables
- BCMS scope, policy, objectives and ownership record
- Business impact analysis and dependency mapping
- Continuity risk register, strategies and response plans
- Exercise plan, results and corrective action tracker
- Internal audit, management review and assessment-support records
Our engagement approach
- Scope-led: tailor the management system to the organisation’s activities, boundaries and objectives.
- Evidence-driven: connect documented processes to responsible owners and evidence of operation.
- Practical implementation: prioritise gaps and improvements with agreed owners and timeframes.
- Independent assessment: support the audit process while preserving the certification body’s independent role.
- Continual improvement: hand over actions and review arrangements so the management system can continue to operate.
Reference: ISO guidance for ISO 22301:2019. The applicable edition, scope, assessment arrangements and deliverables are confirmed for each engagement.
Where an independent certification or attestation applies, the relevant independent body makes its own assessment and decision. Scope and availability are agreed individually.