the whole job

ISO 22301: the whole job, in order

Customers and tenders ask for an ISO 22301 certificate when they depend on your service staying up. A certificate shows that a certification body looked at your business continuity management system, within a scope you chose, at a point in time. It does not show compliance with a law. This plan takes you from the decision to certify to the yearly cycle, in seven stages.

last checked 2 November 2026

how to read this plan

ISO 22301 is a standard for running business continuity as a management system, so most steps set up analysis, owners, exercises and checks that repeat. The standard is paid and was not read for this plan, which is why every step says practice and no clause is cited: check clause numbers against your licensed copy. Where a step also feeds NIS2 or DORA, the step links the work page, and the basis stays practice because the certificate does not make you compliant. The order follows dependencies. Under each step a small note names the basis.

  • decide and documentchoices, policies and records that someone with authority signs
  • build and configuresystems, settings and procedures that make the choice real
  • prove and operatechecks, logs and records that show it keeps working
01

decide whether to certify, and what for

Find out who needs the certificate, what they would accept instead and which part of the company it should cover.

  1. ask who requires the certificate

    Ask the customers and tenders that raised it whether they require a certificate or would accept a continuity plan and a restore record. Record each answer with the date. No rule on this site requires the certificate.

    • owner board
    • decide and document
    what it produces
    a short list of customers, what each asked for and what each would accept
    the proof it leaves
    the list, with the source of each answer

    the work page

    basis working practice. No legal text sets this.

  2. set the scope in writing

    Decide which services, sites and teams the certificate covers, and write down what is out. A certificate covers only its scope, so choose the services that customers depend on.

    • owner board
    • decide and document
    what it produces
    a scope statement that names what is in and what is out
    the proof it leaves
    the statement, approved by management

    basis working practice. No legal text sets this.

  3. name who answers for continuity

    Name one accountable owner at management level and one operational lead, and give them time and a budget line. If NIS2 or DORA covers you, management already answers for the related measures, and this can be the same decision.

    • owner board
    • decide and document
    what it produces
    a decision naming the accountable owner and the operational lead
    the proof it leaves
    the minutes of that decision

    the work page

    basis working practice. No legal text sets this.

you are done with this phase when you can show a board decision to certify or not, the customers behind it and a written scope.
02

find what the business cannot lose

List the activities that matter, measure what an interruption costs and set the limits you will recover to.

  1. list the activities and what they depend on

    List the activities inside the scope, and for each one the systems, people, suppliers and sites it needs. Start from the services customers pay for.

    • owner everyone
    • build and configure
    what it produces
    a list of activities with their dependencies
    the proof it leaves
    the list, with the owner of each activity

    the control: asset-inventory

    basis working practice. No legal text sets this.

  2. run the business impact analysis

    For each activity, ask the business what happens as the interruption grows: lost revenue, broken contracts, harm to customers. Write the answers down, because IT cannot supply them alone.

    • owner everyone
    • prove and operate
    what it produces
    a business impact analysis per activity
    the proof it leaves
    the analysis, signed by each activity owner

    basis working practice. No legal text sets this.

  3. set recovery objectives

    For each activity, decide how long it may be down and how much data it may lose, and decide what comes back first. These are business decisions that you take before the day they matter.

    • owner board
    • decide and document
    what it produces
    recovery objectives and a recovery order per activity
    the proof it leaves
    the decision record

    the work pagethe control: backup-recovery

    basis working practice. No legal text sets this.

  4. assess what could interrupt them

    List the disruptions that could hit the activities in scope, such as a failed supplier, ransomware, a lost site or a lost key person, and record what you decide to do about each.

    • owner head of IT
    • build and configure
    what it produces
    disruption risks entered in the risk register with decisions
    the proof it leaves
    the register, dated and owned

    the work pagethe control: risk-register

    basis working practice. No legal text sets this.

you are done with this phase when you can show a business impact analysis, agreed recovery objectives and a list of disruption risks.
03

write the plans and build the ability to recover

Turn the objectives into plans that other people can follow and into recovery that works.

  1. build the recovery capability

    Set backup scope and frequency from the recovery objectives, keep one copy out of reach of normal administrator accounts, and write a restore procedure that someone other than its author can follow.

    • owner head of IT
    • build and configure
    what it produces
    a backup policy and a restore procedure matched to the objectives
    the proof it leaves
    the policy and the procedure, approved by the head of IT

    the work pagethe control: backup-recovery

    basis working practice. No legal text sets this.

  2. write a plan for each activity

    For each activity, write the steps to bring it back, in order, with owners, contacts and the workaround in the meantime. Keep a paper copy outside your own systems.

    • owner everyone
    • build and configure
    what it produces
    a continuity plan per activity
    the proof it leaves
    the plans, each with an owner and a date

    basis working practice. No legal text sets this.

  3. set crisis roles and how you talk

    Decide who declares a crisis, who speaks to customers and how the team talks when email is down. Link the crisis plan to the incident process, so one event does not start two separate responses.

    • owner board
    • decide and document
    what it produces
    a crisis plan with roles and a contact sheet
    the proof it leaves
    the plan and the printed contact sheet

    the work pagethe control: incident-management

    basis working practice. No legal text sets this.

  4. check the continuity of key suppliers

    For each supplier an activity depends on, ask what it does to stay up and what it promises you in the contract. Write down the activities that have no workaround if a supplier fails.

    • owner procurement
    • prove and operate
    what it produces
    a list of critical suppliers with their continuity answers
    the proof it leaves
    the answers and the contract extracts

    the work pagethe control: supplier-management

    basis working practice. No legal text sets this.

you are done with this phase when you can show plans per activity, named crisis roles and a recovery capability that meets the objectives on paper.
04

practise it

Test the plans with the people who would carry them out and fix what fails.

  1. restore one real system and time it

    Restore one real system from backup to a clean place, with a clock running, and compare the time with the objective. Write down what was missing.

    • owner head of IT
    • prove and operate
    what it produces
    a restore test record: date, system, time taken, gaps
    the proof it leaves
    the record

    the work pagethe control: backup-recovery

    basis working practice. No legal text sets this.

  2. walk through a scenario with the crisis team

    Pick a realistic scenario for an activity in scope, such as the loss of a main system, and walk the people through their plan. Note every place where the plan was unclear or wrong.

    • owner everyone
    • prove and operate
    what it produces
    an exercise record with the scenario, the people and the findings
    the proof it leaves
    the record

    the control: incident-management

    basis working practice. No legal text sets this.

  3. fix the plans and exercise again

    For each finding, change the plan or the setup, name an owner and record when it was done. Schedule the next exercise on a different activity.

    • owner everyone
    • prove and operate
    what it produces
    a list of fixes with owners and dates, and an exercise calendar
    the proof it leaves
    the list and the calendar

    basis working practice. No legal text sets this.

you are done with this phase when you can show exercise records with findings and the fixes that closed them.
05

check the system and let management review it

Find out whether the system runs as written, and put the result in front of management.

  1. run an internal audit

    Have someone who did not build the system check it against the scope, the plans and the standard. Check what is written against what people do, and against the exercise records.

    • owner everyone
    • prove and operate
    what it produces
    an internal audit report with findings
    the proof it leaves
    the report, dated and signed by the auditor

    basis working practice. No legal text sets this.

  2. fix the findings at the cause

    For each finding, decide the fix, an owner and a date, and record when it was done. Fix the cause as well as the symptom, so that it does not return next year.

    • owner everyone
    • prove and operate
    what it produces
    a corrective action list with owners and dates
    the proof it leaves
    the list, with each item closed or dated

    basis working practice. No legal text sets this.

  3. hold the management review

    Put the audit result, the exercise results, incidents and open gaps in front of management, and record what they decide. The standard asks for this review, so check its inputs against your copy.

    • owner board
    • prove and operate
    what it produces
    a management review record with decisions and actions
    the proof it leaves
    the record and the minutes

    the work page

    basis working practice. No legal text sets this.

you are done with this phase when you can show an internal audit report, closed findings and a management review record.
06

pass the external audit

Choose a certification body, go through its audit and deal with what it finds.

  1. choose a certification body and check its accreditation

    Ask each candidate whether it is accredited for this standard and by which body, and check the answer with that body. ISO says accreditation is not compulsory and advises checking it. Ask which edition it audits against, and get the answers in writing.

    • owner procurement
    • decide and document
    what it produces
    a chosen certification body and its accreditation scope
    the proof it leaves
    the written answers and the accreditation check

    basis working practice. No legal text sets this.

  2. prepare the evidence and the people

    Gather the scope, the impact analysis, the objectives, the plans, the exercise records, the audit report and the review record in one place, and brief the people who will be interviewed.

    • owner everyone
    • prove and operate
    what it produces
    an evidence folder and a list of interviewees
    the proof it leaves
    the folder, with each item dated

    basis working practice. No legal text sets this.

  3. go through the audit and answer the findings

    Give the auditor access, answer what is asked and note every finding. For each, agree the fix with the certification body and carry it out in the time it sets.

    • owner everyone
    • prove and operate
    what it produces
    the audit report, the finding responses and the fixes
    the proof it leaves
    the report, the responses and the closing records

    basis working practice. No legal text sets this.

  4. read the certificate and say what it covers

    Check the scope, the dates and the issuer printed on the certificate, and use them as written when you answer a customer. Say plainly what it covers and what it does not, and do not describe it as compliance with a law.

    • owner legal or DPO
    • decide and document
    what it produces
    a short statement of what the certificate covers, for sales and legal
    the proof it leaves
    the certificate and the statement

    basis working practice. No legal text sets this.

you are done with this phase when you can show a certification body's decision and the scope it states.
07

keep it alive each year

Run the system through the year, repeat the exercises, audit and review, and meet the certification body's follow-up.

  1. ask what follows the certificate

    Ask the certification body what it checks after the certificate is issued, how often, how long the certificate runs and what happens if findings stay open. ISO's pages give no cycle. Put the dates in the same calendar as your own exercises and audit.

    • owner procurement
    • decide and document
    what it produces
    a calendar of the body's follow-up and your own internal dates
    the proof it leaves
    the written answer and the calendar

    basis working practice. No legal text sets this.

  2. repeat the exercises, the audit and the review

    Run exercises, the internal audit and the management review again on a fixed rhythm, with a different system or scenario each time. Redo the impact analysis when the business, the systems or the suppliers change.

    • owner everyone
    • prove and operate
    what it produces
    a yearly exercise programme, internal audit and management review
    the proof it leaves
    the records, the reports and the minutes, dated

    the control: backup-recovery

    basis working practice. No legal text sets this.

  3. change the scope on purpose

    When the company adds a service, a site or a critical supplier, decide whether it joins the scope and tell the certification body. If a customer later asks for more, widen the scope by decision, with a plan.

    • owner board
    • decide and document
    what it produces
    a scope change decision with its reason
    the proof it leaves
    the decision and the notice to the body

    basis working practice. No legal text sets this.

you are done with this phase when you can show a second internal audit, a second management review and the body's follow-up outcome.

who carries what

The same steps, grouped by the person who has to act.

board

everyone

head of IT

procurement

legal or DPO

controls you will need

Each control has its own page: what it is, what to look for, where it goes wrong and the proof it leaves.

    check it yourself

    your next step

    Ask your largest customers whether they want a certificate or would accept a restore record and a continuity plan, and write the answers down before you scope anything.

    open the backups and recovery page