ISO 22301: Backups, Alternative Premises and Critical Suppliers
During a disruption, the organisation needs to know which service returns first, within what time and using which resources. Business continuity preparation extends beyond IT backups.
Questions for your situation
Are nightly backups sufficient for business continuity?
Backups support data recovery. Service may still stop if staff, premises, equipment, communications or suppliers are unavailable. Identify critical activity dependencies and tolerable disruption impacts first. Then test restoration time and environment. Having a file available does not demonstrate that the customer service can resume within its planned time.
Can all activities have the same recovery time?
Identical times can conceal priorities when disruption impacts differ. Consider customer commitments, seasonal peaks, obligations and downstream processes. Include the recovery time of systems or suppliers on which an activity depends. Set a resource-supported plan rather than merely a desired target.
Does an alternative office in the same area provide enough diversity?
Examine shared electricity, internet, transport and regional hazard exposure. Separate buildings do not necessarily mean independent risks. Test capacity, access, staff travel and connectivity at the alternative location. Suitability depends on the disruption scenario; do not assume a universal distance rule for every organisation.
Can continuity be planned if a sole supplier has no alternative?
Alternative sourcing is not the only option. Evaluate stock, maintenance, substitute materials, shared capacity or service prioritisation. If none is sufficient, present the remaining risk explicitly for management decision. Establish emergency communication and disruption reporting with the supplier. Do not list a nonexistent alternative as an available resource.
Does winning a large customer require changes to the continuity plan?
New commitments may change capacity, priorities and acceptable disruption impacts. Reassess business impacts, resources and recovery sequencing. Promising the same limited backup capacity to several customers creates conflicts. Check feasibility before contracting and notify the certification body of significant scope changes.
Will exceeding the recovery target during an exercise prevent renewal?
Exercises should reveal weaknesses and improve readiness. Identify the delay's causes, customer effects and required action, then plan to retest critical corrections. Hiding results or changing targets retrospectively does not produce reliable evidence. Certification assessment considers planning, implementation, responses to findings and ongoing system maintenance together.
Share the subject, organisation or product, target market, current evidence and target date. The team can then separate consultancy, official fees, independent evaluation and realistic timing.