ISO 22301 Business Continuity Management Certification

Flow chart of the ISO 22301 engagement, 6 phases in order, each one selectable. Phase 1, Scoping and Business Impact Analysis. We set the BCMS scope, then run a business impact analysis to find your critical activities and how long they can be down. Activities: Define the BCMS scope and critical services; Interview process owners on dependencies; Set maximum tolerable downtime for each activity; Map upstream suppliers and single points of failure. Hands over Business Impact Analysis Report. Phase 2, Continuity Risk Assessment. We assess the threats to those critical activities and agree which ones need continuity strategies. Activities: Identify disruption scenarios per critical activity; Score likelihood and impact of each threat; Assess current resilience and workarounds; Agree which risks need continuity strategies. Hands over Continuity Risk Register. Phase 3, Continuity Strategy and Plans. We design recovery strategies and write clear continuity plans with defined recovery time and recovery point objectives. Activities: Select recovery strategies for each critical activity; Set RTO and RPO targets with the business; Write continuity and disaster recovery plans; Define crisis roles and escalation paths. Hands over Business Continuity Plan Set. Phase 4, Exercising and Testing. We run tabletop and live exercises to prove the plans work and to train the people who will use them. Activities: Design exercise scenarios against real threats; Run tabletop walkthroughs with the crisis team; Conduct a live failover or recovery test; Capture lessons and update the plans. Hands over Exercise and Test Report. Phase 5, Internal Audit and Review. We audit the BCMS against the standard and hold a management review to confirm it is fit for purpose. Activities: Audit the BCMS against ISO 22301 clauses; Review exercise results and open actions; Log nonconformities and corrective actions; Run the management review with leadership. Hands over Internal Audit Report and Management Review Record. Phase 6, Certification and Maintenance. We support the certification audit and help you keep plans current as your business changes. Activities: Prepare evidence for Stage 1 and Stage 2 audits; Support auditor interviews and site visits; Close audit findings raised; Set the annual exercise and plan review cycle. Hands over ISO 22301 Certificate. Each phase begins from the artefact the phase before it produced.