ISO 22301 Business Continuity
ISO 22301 is the international standard for business continuity management, and it asks a question most companies have never answered honestly: if your primary site, your key supplier, or your critical application went down tomorrow, do you actually know what happens next? Not in theory — in the specific, written-down, tested sense. That's what the standard is built around: a management system for keeping the business running through disruption and recovering in a way you've actually rehearsed.
What it actually requires
ISO 22301 isn't a plan you write once. It requires a business impact analysis that identifies which processes matter most and how much downtime each one can tolerate, a risk assessment that looks at the realistic ways those processes could be disrupted, continuity strategies and plans for the processes that matter, and a testing and exercise program that proves the plans work under something resembling real conditions. On top of that sits the management system itself — leadership commitment, defined roles, documented objectives, and a cycle of internal audit and management review that keeps the whole thing from going stale.
How I work through it
I usually start with the business impact analysis, because everything else depends on getting it right. Until you know which processes are truly critical and what their recovery time objectives really are, your continuity plans are guesses. From there I help you build plans that your team can actually execute under pressure — not binders full of generic language, but specific, assigned, tested procedures. Then we run exercises: tabletop walkthroughs at minimum, and more realistic simulations where it makes sense, so gaps show up in a drill instead of during an actual outage.
If certification is the goal, I help you build the management system documentation an auditor expects — policy, scope, objectives, internal audit records, management review — and get you ready for the certification audit itself. If certification isn't the goal and you just want a continuity program that will hold up when something goes wrong, we build to the same rigor without the certificate.
Who needs this
Companies with customers or regulators asking for proof of business continuity, organizations that have had a near-miss and don't want a repeat, and anyone whose current "plan" is a document nobody has opened since it was written.
Want to find out how exposed your organization actually is? Get in touch and we'll talk through where to start.