ISO 22301 addresses a business continuity management system, including priority activities after disruption. It extends beyond data backup. Certification is not a guarantee that disruption will never occur.

01

Translate services into activity boundaries

Identify the products and services that need to continue for customers. Map supporting activities, sites, people, information systems and suppliers. Covering the head office does not automatically cover the workshop or contact centre delivering the service. Explain external dependencies and the organisation’s limits of control.

02

Use impact analysis to set priorities

Business impact analysis examines how disruption consequences develop over time and which activities need recovery first. Risk assessment addresses disruption causes and their treatment; it is not the same list. ISO/TS 22317 guides a documented impact analysis without prescribing one uniform method. Management should justify time objectives and resource requirements.

03

Compare objectives with actual resources

Suppose a hypothetical order service should restart within four hours, while staff access and alternative system setup take eight. The plan has a gap. Possessing a backup does not mean the activity can operate within the same time. Evaluate alternative working, communication, authorisation and supplier arrangements together; use a suitable exercise to test feasibility.

04

Application and independent decision

Provide scope, sites, priority activities, dependencies and the status of analyses and exercises. ISO does not issue certificates; the relevant body evaluates evidence and makes an impartial decision. Consulting does not guarantee approval. ISO 22301 certification does not replace a specific information security or product conformity certificate. The applicant implements the system and prepares procedures specific to its own operations and operating records. A certification enquiry to Kayra concerns actual activities, sites, application information, authority and impartiality risks; this role does not include designing or implementing the client’s system. A management-system certification body, other parts of the same legal entity and controlled entities cannot offer or provide management-system consultancy; separate contracts do not remove this restriction.

Sources and application limits

Examples are hypothetical. Recovery objectives must follow the organisation’s impact analysis, resources and approved decisions.