How can I help with ISO 22301?

Seeded with ISO 22301:2019 business continuity concepts and the shared vocabulary of the ISO 22300 family: the business continuity management system (BCMS) and the way the standard is organised, from understanding the organisation and its interested parties, through leadership, planning around risks and objectives, the support and operation the system needs, to evaluating performance and improving it over time. It covers running a business impact analysis and assessing the risks of disruption, prioritised activities and their recovery timeframes, recovery time and recovery point objectives and the minimum business continuity objective, continuity strategies and the solutions to deliver them, the incident response structure, business continuity plans, and the programme of exercises that validates them.

• Understand your organisation's context and the needs of interested parties, define the scope of your BCMS, and run a business impact analysis and assess the risks of disruption to identify your prioritised activities and the recovery timeframes they need, so the system protects what the organisation actually depends on.
• Set recovery objectives for your prioritised activities, including recovery time objectives, recovery point objectives, and a minimum business continuity objective, and choose continuity strategies and the solutions to deliver them so they can realistically meet those objectives, so your planning is driven by objectives rather than by documents.
• Set up an incident response structure, write your business continuity plans and the procedures teams follow, run a programme of exercises and tests to validate them, and evaluate the BCMS through internal audits and reviews by management, so you keep improving and are better prepared for a certification body's stage 1 and stage 2 audits and its ongoing surveillance.

It gives guidance to speed up your work. ISMS Copilot is not a certification body and cannot certify your business continuity management system; certification comes from an independent certification body after its own audit, and choosing an accredited body gives independent confirmation of its competence. This is not a certification service, and it is not legal advice.