ISO 22301 requirements explained: what clauses 4 to 10 ask of a business continuity management system

How are the ISO 22301 requirements arranged?

ISO 22301:2019 opens with an introduction and three clauses that set the ground rules: clause 1 gives the scope, clause 2 the normative references and clause 3 the terms and definitions. Everything a certification auditor tests is in clauses 4 to 10.

Anyone who knows ISO 9001 or ISO/IEC 27001 will recognise six of those seven clauses, which carry the common management system wording adapted to continuity. Clause 8, Operation, has no equivalent elsewhere and takes most of the audit time.

Clauses 4 to 6: context, leadership and planning

Clause 4: context of the organisation

Clause 4 asks what you are protecting and why. You identify the internal and external issues that affect the system (4.1), the interested parties who matter and what they require (4.2), including the legal and regulatory requirements that apply to continuity (4.2.2), and then the boundaries of the BCMS (4.3). Since Amendment 1:2024, clause 4.1 also requires you to decide whether climate change is a relevant issue, and a note under 4.2 points out that interested parties can hold climate-related requirements.

For a continuity system, the scope is more than a list of sites. It names the products and services whose delivery you are committing to protect, because every later requirement is measured against them.

Clause 5: leadership

Top management demonstrates leadership and commitment (5.1), establishes and communicates a business continuity policy (5.2.1 and 5.2.2) and makes sure roles, responsibilities and authorities are assigned (5.3). The authority that counts most in practice is the power to invoke a plan and release money in the middle of a disruption.

Clause 6: planning

Clause 6.1 deals with risks and opportunities to the management system: whether it will achieve its intended outcomes, not the risk of a fire or an outage. The risk of disruption to your activities belongs to clause 8.2.3. Clause 6.2 requires business continuity objectives with plans to achieve them, and 6.3 requires changes to the BCMS to be made in a planned way.

Clause 7: support

Clause 7 covers what the system needs to run: resources (7.1), competence (7.2), awareness (7.3), communication (7.4) and documented information (7.5), which must be created, updated and controlled. The unusual test in a BCMS: auditors ask how a response team member would open the current plan at night, from home, with the network down.

Competence here includes the response teams, not only the continuity coordinator. The ISO 22301 documentation guide lists which documented information the standard names and which is merely common practice.

Clause 8: business impact analysis and risk assessment

Clause 8.1 requires operational planning and control of the processes the BCMS needs. Clause 8.2 then asks for the analysis that drives every other continuity decision. It has three parts: a general requirement to implement and maintain systematic processes (8.2.1), the business impact analysis (8.2.2) and the risk assessment (8.2.3).

The BIA sets the impact types and criteria that matter to you, identifies the activities that support your products and services, assesses how the impact of a disruption grows over time, and uses that to set priorities and the time frames within which activities must resume. It also identifies the resources and the internal and external dependencies, suppliers included, that prioritised activities rely on. The risk assessment then looks at what could disrupt those prioritised activities and their resources, analyses and evaluates those risks, and decides which need treatment.

Impact comes before threat, so the risk work protects what the business cannot do without. The business impact analysis guide explains how to run the workshops so management accepts the results, and the hub explains the recovery time terms.

Clause 8: strategies, solutions, plans and procedures

Clause 8.3 moves from analysis to decision. You identify possible strategies and solutions (8.3.2), select them (8.3.3), determine the resources they need (8.3.4) and implement them (8.3.5). Selection weighs whether an option keeps prioritised activities within the agreed time frames and capacity, what it needs in people, information, premises, ICT, finance and suppliers, and whether its costs are justified. The word "implement" is what auditors test: a second site that exists only in a slide is not a solution.

Clause 8.4 turns the chosen solutions into a response. It requires a response structure of one or more teams able to manage a disruption (8.4.2), procedures for warning and communication (8.4.3), business continuity plans setting out what each team does (8.4.4), and recovery arrangements to return to normal operations afterwards (8.4.5).

Clause 8: exercise programme and evaluation

Clause 8.5 requires a programme of exercises and tests that is consistent with your continuity objectives, uses realistic scenarios with defined aims, runs at planned intervals and produces post-exercise reports with outcomes, recommendations and improvement actions. The business continuity exercises guide covers formats from a desk-top walk-through to a full invocation.

Clause 8.6 closes the loop. The BIA, the risk assessment, the strategies, the solutions, the plans and the procedures are evaluated for adequacy and effectiveness at planned intervals, after an incident or an invocation, and when significant changes occur. A new supplier or a move of building is a trigger, and the auditor will ask what was re-evaluated.

Clauses 9 and 10: performance evaluation and improvement

Clause 9.1 requires you to decide what to monitor and measure, how and when, and to analyse and evaluate the results. Clause 9.2 requires internal audits at planned intervals, run from an audit programme. Clause 9.3 requires management review at planned intervals, with defined inputs and outputs recorded. The ISO 22301 internal audit guide covers planning and conducting those audits.

Clause 10.1 covers nonconformity and corrective action: react, find the cause, act so it does not recur and check the action worked. Clause 10.2 requires continual improvement of the BCMS.

ISO 22301 requirements: questions buyers ask