Implementation walkthrough
How to implement ISO 22301: video walkthrough
A walkthrough of building an ISO 22301 business continuity management system, from the business impact analysis to the first exercise and the certification audit.
Key takeaways
- A business continuity system is broader than an IT disaster recovery plan.
- The business impact analysis decides which activities resume first and how quickly.
- Strategies and plans follow from the analysis, not the other way round.
- Plans must be exercised and the results acted on before the certification audit.
- An independent, accredited certification body audits and decides.
Continuity starts with the business, not the servers
ISO 22301 is the international standard for business continuity management systems. It sets the requirements for a management system that protects an organisation against disruption, reduces its likelihood and prepares it to respond and recover when disruption arrives anyway, whatever the cause: fire, flood, typhoon, ransomware, a supplier's collapse or a pandemic.
That makes it different from an IT disaster recovery plan, which restores systems, and from an emergency plan for the first hours. A business continuity system starts with the business: which activities must resume first, how quickly, with which people, sites, suppliers and systems, and what you are prepared to lose in the meantime. This short film walks through how those answers are found and turned into a capability.
How an ISO 22301 implementation runs
Define what the certificate must cover: the products and services whose continuity you are promising, the sites, the client and regulatory obligations and the certification scope. A gap analysis examines existing plans, recovery arrangements and exercise history against clauses 4 to 10, keeps what works and agrees actions, owners, dates and resources.
Then analyse, decide and build: run the business impact analysis and the risk assessment with process owners, select continuity strategies, write the plans and set up the response structure. The capability has to be exercised, and the results evaluated and acted on, before it can be audited. Internal audit and management review follow, findings are closed with evidence, and an independent certification body audits the system and decides.
Sterling's expert and experienced consultants support the analysis, the implementation and the first exercises with your people under Sterling OS™, with the business continuity management system held in Effivity. The current edition is ISO 22301:2019 with Amendment 1:2024.
Organisations usually start from one of a few triggers: a disruption that happened or nearly did, a client or regulator asking for evidence of continuity, or a tender that names the standard. Whatever the trigger, the business impact analysis is where the real decisions are made.
ISO 22301 at a glance
- Purpose
- Business continuity: the capability to keep delivering products and services at an agreed level and within agreed time frames during a disruption, and to recover
- Relevant to
- Any organisation whose clients, regulators or survival depend on uninterrupted delivery: BPOs, financial services and their providers, technology and data centres, logistics, utilities, healthcare
- Edition
- ISO 22301:2019 with Amendment 1:2024; a revision is in preparation, with no publication date announced
- Certification
- Assessed and decided by an independent, accredited certification body
- Sterling's role
- Implementation with your team, from the BIA to the first exercise, with Effivity, training, internal audit and certification readiness, then Sustain™
- Cost and timing
- Total investment for an ISO 22301 BCMS depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 8 months
ISO 22301: questions people ask
Is ISO 22301 only for large organisations?
No. It applies to organisations of any type and size, and to parts of one. A small BPO delivering a critical process for a regulated client may need a certified capability more urgently than a large group. It should be proportionate: a short list of prioritised activities, affordable solutions and plans people can run.
What is the difference between ISO 22301 and a disaster recovery plan?
A disaster recovery plan restores IT systems. ISO 22301 requires how the organisation keeps delivering its products and services when any resource is lost: people, workplace, suppliers, information or technology. IT recovery is one of the solutions a BCMS relies on, and its recovery objectives should come from the business impact analysis, not from IT's assumptions.
Is ISO 22301 certification mandatory?
No law requires it in general. Client contracts, tenders and insurers increasingly make it a condition, and financial-sector and critical-infrastructure regulators require continuity, recovery and testing arrangements that a BCMS is built to provide. Rules such as the EU's DORA set their own requirements for ICT continuity, response, recovery and testing rather than naming an ISO certificate; a certified BCMS is a structured way to meet and evidence them, not a substitute for the rule itself.
Does Sterling issue the ISO 22301 certificate?
No. Sterling's role is consulting and hands-on support. The certification audit and the certification decision belong to an independent, accredited certification body. A provider offering both is selling paper.
Do we have to run an exercise before we can be certified?
The standard requires an exercise programme, and a certification auditor will want to see it working, not just planned. In a Sterling engagement at least one exercise is run before the Stage 2 audit, with its report and actions closed, so the plans are tested by you before an auditor or an event tests them.
Keep exploring
Related to this video
Read next
The complete guide
Everything on ISO 22301
Start with the ISO 22301 page, or go straight to the guide you need.
On the ISO 22301 page
Guides
- ISO 22301 BIA and exercise planning checklist
- ISO 22301 business impact analysis
- ISO 22301 certification process, step by step
- ISO 22301 certification cost
- ISO 22301 documentation
- Effivity ISO 22301
- ISO 22301 business continuity exercises
- ISO 22301 internal audit
- Ransomware recovery plan
- ISO 22301 requirements explained
- ISO 22301 vs ISO 27001
- ISO 22301 and ISO 27001
More videos: Governance, risk and resilience
- How to implement ISO 37001Implementation walkthrough · 3 min 14 s
- ISO 37001 requirements explainedTwo-minute brief · 2 min
- ISO 37500 guidance explainedTwo-minute brief · 2 min
- How to implement ISO 31000Implementation walkthrough · 3 min 15 s
- ISO 31000 guidelines explainedTwo-minute brief · 2 min
- How to implement ISO 37301Implementation walkthrough · 3 min 15 s
- ISO 37301 requirements explainedTwo-minute brief · 2 min
Talk to a consultant
Plan your ISO 22301 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice