ISO 22301
ISO 22301 in Practice: Business Impact Analysis, Recovery Objectives and Exercises
An ISO 22301 business continuity programme is a chain: the business impact analysis ranks what the organisation cannot afford to lose and how fast each activity must return; recovery objectives turn that into time and data-loss targets; strategies and plans are chosen to meet those targets; and exercises prove they work. Certification auditors follow the same chain, so every plan should trace back to the analysis and every objective should have been tested. SecureRoot runs the analysis, plans and exercises with your team; an accredited certification body audits and issues the certificate.
About this guide
Written by SecureRoot Risk Advisory LLP.
The standard
Which edition applies
The current edition is ISO 22301:2019, with a 2024 amendment adding climate action changes. ISO's catalogue marks the 2019 edition as due for revision, with a successor under development. Until a new edition is published, certification is against ISO 22301:2019 as amended. ISO 22313 gives guidance on using it.
Start here
Running the business impact analysis
The business impact analysis (BIA) is where a continuity programme starts and where an auditor starts reading. It turns "everything is critical" into a ranked list with numbers.
- 01
Set the scope and list the services
Decide which products, services, sites and business units the business continuity management system (BCMS) covers. List the services you deliver to customers inside that scope; activities are then traced to the services they support.
- 02
Interview the people who own each activity
Templates filled in by one central person tend to describe how things should work. Process owners know what actually stops when a system, site, supplier or key person is unavailable, and what workarounds exist.
- 03
Measure the impact over time
For each activity, record what happens after an hour, a day, a week: lost revenue, contractual penalties, regulatory exposure, customer harm, backlog. The point at which the impact becomes unacceptable sets the maximum tolerable downtime.
- 04
Record the dependencies
List what each activity needs to run: people and skills, applications, data, premises, equipment and upstream suppliers. Single points of failure, including the one person who knows how to restore a system, show up here.
- 05
Have the business sign it off
Priorities should come from the business, not from IT preference. A BIA approved by the people accountable for the services carries weight with an auditor; one written by IT alone usually does not.
Revisit the BIA when the business changes. A new product, site or major supplier quietly changes what matters most.
Recovery objectives
Setting recovery objectives you can actually meet
Two numbers come out of the BIA for each critical activity and the systems behind it. The recovery time objective (RTO) is how quickly it must be working again. The recovery point objective (RPO) is how much data you can afford to lose, which in practice sets how often you back up or replicate.
- Set the RTO inside the maximum tolerable downtime, with margin, not equal to it.
- Check each objective against what the infrastructure, backups and suppliers can deliver today. Where they cannot, record the gap and the plan to close it rather than writing a number nobody can meet.
- Write down the assumptions behind each objective, such as which staff and suppliers must be available, so the exercise tests the whole dependency and not only the technology.
- Make sure supplier contracts and service levels support the objectives that depend on them.
Strategies and plans
Choosing strategies and writing the plans
A continuity strategy is how you will keep or restore an activity within its objective: an alternate site or remote working, standby or replicated systems, manual workarounds, extra stock, or a second supplier. Before choosing, assess the threats to each critical activity and agree which risks need a strategy at all.
The plans then say who does what when a disruption happens:
- Who can declare an incident and invoke the plan, with named deputies for every role. The person who normally decides is often the one who is unreachable.
- The crisis team, its escalation path and how it meets if the office or the usual chat tool is down.
- Communication with staff, customers, regulators and the media, including who is allowed to speak.
- Recovery steps for each critical activity, linked to the existing IT disaster recovery runbooks rather than replacing them.
- How the organisation returns to normal operation once the disruption is over.
Disaster recovery restores systems and data. Business continuity covers the whole organisation, including people, premises, suppliers and decisions; the BCMS is the management system around both.
Exercising and testing
Exercising and testing the plans
Plans that have never been exercised are assumptions. Exercising is what reveals the out-of-date call tree, the backup that does not restore and the runbook that depends on someone who has left. Most programmes use a mix, at least once a year and after significant change:
- 01
Tabletop walkthrough
The crisis team talks through a realistic scenario, such as ransomware on a core system or the loss of a key supplier, decision by decision. It tests roles, escalation and communication at low cost.
- 02
Technical recovery or failover test
Restore a system from backup or fail over to standby, and time it against the RTO. Measure the data actually recovered against the RPO.
- 03
Wider simulation
Less often, a scenario that involves several teams and suppliers at once, run under time pressure, to test the plan end to end.
- 04
Report and follow up
Write up what happened, what worked, what did not and who will fix it by when. Where an exercise shows an objective cannot be met, record it as a finding with a remediation plan rather than quietly relaxing the target.
The audit
What auditors look for
A certification auditor tests whether the chain holds together and whether the system runs, not only whether documents exist. Expect them to look for:
- A BIA that covers the scope, is approved by the business and is current.
- Recovery objectives that trace back to the BIA, and strategies and plans that trace to the objectives.
- Exercise reports with dates, participants, results against objectives and tracked actions.
- Evidence that lessons from exercises changed the plans.
- Objectives that changed only with a recorded reason. An unexplained relaxation of a target is a common line of questioning.
- Internal audit results, nonconformities and corrective actions, and a management review in which leadership took decisions about the BCMS.
- Plans that name deputies, current contact details and supplier arrangements that match the plans.
| Link in the chain | What it produces | What the auditor looks for |
|---|---|---|
| Business impact analysis | A ranked list of activities, the impact of losing each over time, the maximum tolerable downtime and the dependencies | Coverage of the scope, approval by the business, and currency |
| Recovery objectives | An RTO and an RPO for each critical activity and the systems behind it | Objectives that trace back to the BIA, and that changed only with a recorded reason |
| Strategies and plans | How each activity is kept or restored within its objective, and who does what in a disruption | Strategies and plans that trace to the objectives, named deputies, current contact details and supplier arrangements that match |
| Exercises and tests | Evidence that the plans and objectives work, from tabletop walkthroughs to recovery or failover tests | Dated reports with participants, results against objectives and tracked actions, and lessons that changed the plans |
| Internal audit and management review | Nonconformities, corrective actions and leadership decisions about the BCMS | Internal audit results and a management review in which leadership took decisions |
How to organise records so they can be produced quickly is covered in the help article on evidence handling.
Where SecureRoot fits
What SecureRoot does in an ISO 22301 programme
SecureRoot's ISO 22301 work runs through scoping and the business impact analysis, a continuity risk assessment, continuity strategy and plans with defined RTO and RPO targets, exercising and testing (tabletop walkthroughs and a live failover or recovery test), internal audit and management review, and support through the certification body's Stage 1 and Stage 2 audits. The deliverables are a business impact analysis report, business continuity plans, exercise and test reports, a BCMS policy set and certification audit support.
Our published pricing row for ISO 22301: fee "Scoped, then quoted in writing"; third-party cost "The accredited certification body's two-stage audit, paid by you"; timeline "4 to 6 months to a first certificate". The pricing page shows the full row.
Scope boundaries
What this does not cover
- SecureRoot is not an accredited certification body and does not issue ISO 22301 certificates. The certificate comes from the certification body you appoint, after its own two-stage audit.
- No consultant can promise a certificate, and no BCMS guarantees that a real disruption will be recovered within its objectives. Exercises reduce that uncertainty; they do not remove it.
- Your process owners provide the BIA inputs and take part in exercises, and your IT team or providers run the technical recovery. That time is not inside any fee.
- Investment needed to meet the recovery objectives, such as standby infrastructure or a second supplier, is yours to decide and fund.
- The certification body's audit fee is contracted and paid by you directly.
- This guide describes ISO 22301 in our own words. It does not reproduce the standard, which you should buy from ISO or your national standards body.
Questions
Common questions
Which comes first, the risk assessment or the business impact analysis?
The BIA usually comes first, because it says which activities are critical. The continuity risk assessment then looks at the threats to those activities and decides which need a strategy.
Is a tabletop exercise enough for certification?
A tabletop exercise tests decisions and communication but not whether systems actually recover. Most programmes combine it with a technical recovery test of critical systems, timed against the objectives.
Is a new edition of ISO 22301 coming?
ISO's catalogue marks ISO 22301:2019 as due for revision, with a successor under development. Until a new edition is published, certification is against the 2019 edition with its 2024 amendment.
Does ISO 22301 replace our disaster recovery plan?
No. The disaster recovery runbooks stay, linked to the recovery objectives the BIA sets. ISO 22301 adds the business side: priorities, people, premises, suppliers, communications and the management system around them.
Primary Sources
Where the Figures on This Page Come From
Figures and requirements above are taken from the sources below, linked to the primary text wherever one exists rather than to a summary of it.
- ISO 22301:2019 - Business continuity management systems: requirements (catalogue entry, Amendment 1:2024 and life cycle)
International Organization for Standardization · Link checked 2026-11-13
- NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems (with business impact analysis template)
National Institute of Standards and Technology · Link checked 2026-11-13
Related
Services and help that go with this
- ISO 22301 certification
SecureRoot's phases, deliverables, timeline and who issues the certificate.
- Evidence handling
Keeping BIA, plan and exercise records audit-ready.
- Independent assessor involvement
Where the certification body comes in.
- ISO 27001 certification
If you also need an ISMS, the management system can be shared.
- Pricing
The published ISO 22301 row.
Building a business continuity programme?
Tell SecureRoot which services and sites you want covered and who is asking for ISO 22301. We will come back with a scope and a written quote, with the certification body's fee shown separately.