All of these, from natural disasters to cyber incidents, equipment failures to power outages, supply chain issues, fires, pandemics, and more, can disrupt critical operations.
The key question is not, ‘Can an organisation avoid all the disruptions? The more practical question
is: can it effectively respond when disrupted and effectively continue its critical activities?
This is the purpose of ISO 22301.

What is ISO 22301 Certification?

ISO 22301 is an international standard for Business Continuity Management System (BCMS).
The current standard is ISO 22301:2019.
It offers a structure to help organisations get ready in advance for disruptive incidents, deal with
them and recover in a structured way.
What is the need of Business Continuity?
A disruption can impact not just production.
It can interrupt:
 Customer service
 IT systems
 Communication
 Supply chains
 Transportation
 Financial operations
 Human resources
 Production
DATA AVAILABILITY
It is therefore important for organizations to know what activities are most important and how those
activities can proceed in adverse circumstances.
BUSINESS IMPACT ANALYSIS
The Business Impact Analysis (BIA) is one of the important concepts in business continuity.
A BIA is used to provide an understanding of the consequences of disruption of important activities
to an organisation.
It can be used to detect:
 Critical processes
 Dependencies
 Important resources
 Potential impacts
 Recovery priorities

 Time-sensitive requirements
 This information will help develop realistic continuity strategies.
Assess and plan for continuity. Risk assessment and continuity plans.
It is important that organizations have an understanding of the kind of disruption that may be
experienced.
For instance, a manufacturing firm may think about:
 Power failure
 Critical machinery failure
 Supplier interruption
 Fire
 Flood
 Cyberattack
 IT system outage
 Voluntary employee turnover.
The organization can then decide on appropriate actions to ensure continued or recovery of critical
operations.
What is included in a Business Continuity Plan?
A business continuity plan can include the following:
 Roles and responsibilities
 Emergency communication
 Escalation procedures
 Recovery priorities
 Alternative resources
 Contact arrangements
 Response procedures
 Recovery activities
A plan that is only documented, but not tested, may not work well in case of an actual disaster.
That is why the exercises and testing are important.
What is the working process of ISO 22301 Certification?
Typically, the process of implementation includes:
 Setting up organization context.
 Defining scope of the BCMS.
 Identifying risks and opportunities.
 Performing a business impact analysis.
 Identifying continuity requirements.
 Forming response/recovery plans.
 Setting up plans and procedures.
 Training relevant personnel.
 Conducting exercises and tests.

 Performing internal audits.
 Conducting management review.
 Completing certification audit.
Benefits of ISO 22301
Properly designed BCMS can assist organizations to:
 Improve resilience
 Reduce disruption impacts
 Protect critical activities
 Improve emergency preparedness
 Clarify responsibilities
 Strengthen stakeholder confidence
 Improve recovery planning
 Identify operational dependencies
 Provide support for continuity of customers' requirements.
Business continuity can also help build the bonds with customers and partners as a business can
show that it has thought about disruption risks.
In the Digital Era: A Guide to ISO 22301.
Technology is an integral part of modern organizations.
When physical facilities are up and running, a cyber attack or IT outage can thus turn into a business
continuity problem.
Schools and other organizations should take into account technology requirements in their
continuity planning.
But business continuity should be more than just about cybersecurity.

Other resources such as people, facilities, suppliers, equipment and communications can also be
critical.
Testing is the only way to make the difference.
One of the most crucial rules of continuity management is a simple one: A plan should be tested.
Exercises can identify issues like:
 Incorrect contact information
 Unclear responsibilities
 Unrealistic recovery assumptions
 Communication gaps
 Missing resources
 Inadequate backup arrangements
 Testing can enable organisations to enhance prior to a crisis.
Conclusion

 With business so interconnected, ISO 22301 can help organisations to be better prepared, resilient and confident in the event of an unexpected incident.