In these situations, the key question goes beyond “How do we handle the incident?”to ask:

How can the organisation continue delivering its priority products and services during disruption and recover within an acceptable time?

This is the challenge that ISO 22301 – Business Continuity Management Systems (BCMS) is designed to address.

This article explains how to implement ISO 22301, from defining the BCMS scope and conducting Business Impact Analysis – BIAand risk assessment to setting RTO, BCP – Business Continuity Plan, running exercises, conducting internal audits and preparing for ISO 22301 certification.

For organisations that need specialist support, ITVC Global provides ISO 22301 consulting and trainingto build a BCMS that works in practice and is supported by appropriate documentation.

---

What Is ISO 22301?

ISO 22301:2019 – Security and resilience — Business continuity management systems — Requirements is the international standard specifying requirements for a Business Continuity Management System (BCMS).

ISO describes ISO 22301 as a framework for establishing, operating, reviewing and continually improving a management system that helps organisations prepare for disruption, respond effectively and recover. (ISO)

In Vietnam, TCVN ISO 22301:2023 is the national standard identical to ISO 22301:2019. (VSQI)

ISO 22301:2019 has Amendment 1:2024 on Climate Action Changes. ISO is developing a revision, while ISO 22301:2019 remains the published edition. (ISO)

---

Why Implement ISO 22301?

Reduce Business Downtime

Without advance preparation, departments may respond to an incident according to their own experience. This can result in:

• Unclear priorities;
• Delayed decisions;
• Uncertainty about who can activate emergency arrangements;
• Insufficient backup resources;
• Inconsistent communication;
• Recovery that is too slow to meet customer needs.

A BCMS helps the organisation establish in advance which activities must recover, when, to what level and with which resources.

Protect Customers and Revenue

For manufacturers, the interruption of a single operation can affect:

• Delivery schedules;
• Customer production lines;
• Revenue;
• Emergency logistics costs;
• Overtime costs;
• Contractual penalties;
• Supplier reputation.

ISO 22301 helps organisations identify the processes with the greatest disruption impacts and focus resources on protecting them.

Strengthen Organisational Resilience

ISO highlights benefits including stronger organisational resilience, better risk management, a systematic crisis response and greater stakeholder confidence. (ISO)

Address Customer and Supply Chain Requirements

Customers increasingly include business continuity considerations in:

• Supplier Audit;
• Supplier Quality Requirement;
• Risk Assessment;
• ESG;
• Information Security;
• Supply Chain Risk Management;
• Business Continuity Requirement.

This is particularly relevant in sectors such as:

• Automotive;
• Electronics;
• Semiconductors;
• IT;
• Logistics;
• Banking;
• Finance;
• Pharmaceuticals;
• Energy;
• Industrial manufacturing.

Support Supplier Assessment and Selection

An established BCMS can help an organisation demonstrate to customers that it has prepared arrangements for maintaining operations during unexpected events.

---

Are BCP and BCMS the Same?

This is a common misunderstanding when implementing ISO 22301.

BCP – Business Continuity Plan is a business continuity plan for addressing one or more disruption scenarios.

By contrast, BCMS – Business Continuity Management System is the overall management system, which includes:

• Policy;
• Scope;
• Responsibilities;
• Business Impact Analysis;
• Risk assessment;
• Business continuity strategies;
• BCP;
• Incident Response;
• Crisis Communication;
• Training;
• Exercises;
• Internal audits;
• Management Review;
• Corrective Action;
• Continual Improvement.

Therefore, writing several BCPs does not by itself mean that ISO 22301 has been implemented.

---

12 Steps to Implement ISO 22301

The following 12 steps are an implementation roadmap. Adapt them to the organisation’s context, scope and resources.

Step 1 – Establish the ISO 22301 Project Team and Leadership Commitment

BCMS responsibilities extend across the organisation, including IT and Quality.

An ISO 22301 project typically involves:

• Top management;
• Production;
• Quality;
• IT;
• Facility;
• Maintenance;
• Supply Chain;
• Purchasing;
• Logistics;
• HR;
• EHS;
• Finance;
• Sales/Customer  Service. 

The organisation should appoint:

• BCMS Leader;
• Process Owner;
• Crisis Management Team;
• BCP Owner;
• Internal Auditor.

Establish the following at the outset:

• Project objectives;
• Scope;
• Schedule;
• Responsibilities;
• Resources;
• Training plan.

Step 2 – Define the Context, Interested Parties and BCMS Scope

Identify issues that can affect the organisation’s ability to maintain operations.

Examples include:

External Factors

• Natural disasters;
• Customers;
• Suppliers;
• Logistics;
• Power infrastructure;
• Internet;
• Legal requirements;
• Security;
• Climate change.

Internal Factors

• Critical equipment;
• People;
• IT systems;
• Premises;
• Financial capacity;
• Warehousing;
• Utility;
• Specialist knowledge. 

Identify relevant interested parties, such as:

• Customers;
• Regulators;
• The parent company;
• Suppliers;
• Employees;
• Shareholders;
• Insurers;
• The community.

Use these findings to define the BCMS scope.

Step 3 – Map Processes and Identify Dependencies

Before conducting the BIA, prepare a Process Map to understand: Products/Services → Processes → Resources → Dependencies

A manufacturing organisation’s processes may include:

• Sales;
• Planning;
• Purchasing;
• Warehouse;
• Production;
• Quality Inspection;
• Maintenance;
• Shipping;
• IT;
• Facility.

For each process, identify dependencies on:

• Equipment;
• People;
• Electricity;
• Water;
• Compressed air;
• Server;
• Software;
• Suppliers;
• Contractors;
• Logistics;
• Facilities.

An important benefit of this analysis is identifying a single point of failure.

For example, if an entire factory depends on one air compressor, that compressor represents a significant business continuity risk.

Step 4 – Conduct a Business Impact Analysis (BIA)

BIA – Business Impact Analysis is a key part of ISO 22301 implementation.

The main BIA question is not:

“How likely is this incident?”

It focuses on:

“If this activity stops, how will the consequences increase over time?”

Assess impacts over time intervals appropriate to the organisation, for example:

• 1 hour;
• 4 hours;
• 8 hours;
• 24 hours;
• 48 hours;
• 3 days;
• 1 week. 

Impacts may relate to:

• Finance;
• Customers;
• Legal obligations;
• Safety;
• Production;
• Contracts;
• Reputation;
• Supply chains.

Important BIA Measures

• MTPD – Maximum Tolerable Period of Disruption: The period after which the impacts of disruption become unacceptable to the organisation.
• RTO – Recovery Time Objective: The target time for recovery of an activity.

Set the RTO so that the activity can recover before the impacts of disruption become unacceptable.

• MBCO – Minimum Business Continuity Objective: The minimum level of products or services the organisation needs to maintain during disruption.

Example: A factory normally produces 10,000 units per day. During disruption, it may set an MBCO of 4,000 units per day to maintain deliveries to priority customers.

RPO – Recovery Point Objective: This is particularly relevant to data and IT.

RPO defines the maximum acceptable data loss expressed as a period of time.

Example: With an RPO of 1 hour, backup and recovery arrangements need to limit data loss to no more than one hour in a disruption.

Step 5 – Assess Business Disruption Risks

BIA identifies the consequences of disruption.

Risk assessment identifies what could cause that disruption.

Scenarios to consider may include:

• Fire and explosion;
• Power outages;
• Equipment failure;
• Utility failures;
• Cyberattacks;
• Server failures;
• Data loss;
• Natural disasters;
• Epidemics;
• Strikes;
• Labour shortages;
• Supplier disruption;
• Logistics disruption;
• Major quality incidents;
• Environmental incident;
• Political/security event.

A separate BCP is not necessarily needed for every risk. Risks with similar impacts or recovery strategies may be managed together.

Step 6 – Develop Business Continuity Strategies

After the BIA and risk assessment, answer the question:

How will the organisation achieve its RTO and MBCO?

Strategies may include:

Equipment

• Standby equipment;
• Spare Part;
• Service contract;
• Outsourcing;
• Moving production to another line.

Suppliers

• Second source;
• Safety stock;
• Local sourcing;
• Alternative material;
• Emergency transportation.

IT

• Backup;
• Server redundancy;
• Cloud;
• Disaster Recovery Site;
• Alternative network.

People

• Cross-training;
• Multi-skill;
• Succession plan;
• Remote working;
• Temporary manpower.

Sites and Facilities

• Alternate site;
• Mutual support between factories;
• Outsourcing;
• Emergency warehouse.

A suitable strategy must demonstrate that it meets the RTO and minimum activity level identified through the BIA.

Step 7 – Develop Business Continuity Plans (BCPs)

Translate the selected strategies into business continuity plans (BCPs).

A practical BCP should specify:

• Activation criteria;
• Who is authorised to activate the plan;
• Responsible personnel;
• Contact lists;
• Immediate response actions;
• Priority activities;
• Required resources;
• Alternative locations;
• Backup suppliers;
• Customer communication arrangements;
• Criteria for ending the emergency response;
• Arrangements for returning to normal operations.

For example, a manufacturer may prepare plans for:

• BCP 01 – Production disruption
• BCP 02 – Power and utility outages
• BCP 03 – IT incidents/ERP downtime
• BCP 04 – Supply chain disruption
• BCP 05 – Logistics disruption
• BCP 06 – Widespread workforce shortages
• BCP 07 – Fire and explosion
• BCP 08 – Natural disasters
• BCP 09 – Major quality incidents

ITVC Global uses a disruption scenario approach in its BCMS consulting services. (ITVC Global)

Step 8 – Establish Incident Response and Crisis Communication

Link BCPs to the incident management arrangements.

Define: 

• Incident Team;
• Crisis Management Team;
• Escalation Level;
• Activation Criteria;
• Decision Authority.

Plan how to communicate with:

• Employees;
• Customers;
• Suppliers;
• Authorities;
• The media, where necessary;
• The parent company.

Keep contact lists up to date and test them periodically.

Step 9 – Establish ISO 22301 Documentation

An effective BCMS needs relevant, usable documented information. Focus on what is necessary to operate and control the system.

A typical set of documents may include:

• Business continuity policy and BCMS scope;
• Planning: risks and opportunities, and business continuity objectives;
• BIA (Business Impact Analysis);
• Risk (Business Continuity Risk Assessment);
• Strategy (Business Continuity Strategy);
• BCP (Business Continuity Plans);
• Crisis (Incident/Crisis Management Plan);
• Communication (Emergency/Crisis Communication);
• Exercise (Exercise & Testing Plan);
• Internal Audit;
• Management Review, Improvement - Corrective Action

These documents do not have to exist as separate procedures. They may be integrated into existing systems, provided the organisation can control them and demonstrate implementation.

Step 10 – Provide ISO 22301 Training and Awareness

A common reason why BCPs fail in practice is:

The plan is detailed, but the people who need to use it do not know what to do.

Provide ISO 22301 training for each relevant group.

Leadership – understand:

• Business Continuity Risk;
• Leadership responsibilities;
• Crisis Decision;
• Resources.

BCMS Team - need to understand:

• ISO 22301;
• BIA;
• Risk Assessment;
• BCP;
• Exercise;
• Improvement.

Process Owner - must understand:

• RTO;
• MBCO;
• Dependency;
• Recovery Procedure.

Employees – need to know:

• Who to contact;
• What to do when a plan is activated;
• Alternative locations;
• Communication channels.

Step 11 – Exercise and Test the BCPs

A BCP that has never been tested remains an assumption.

ISO 22301 requires an exercise and testing programme to verify business continuity solutions and plans.

Possible formats include:

Table-top Exercise

Participants work through a simulated scenario together. For example:

“At 08:30, the factory-wide ERP system stops working, and IT confirms it cannot be restored within 12 hours.”

The team must determine:

• Who activates the BCP;
• How production continues;
• How the warehouse is managed;
• How deliveries are made;
• Whether customers need to be notified.

Functional Exercise

Test part of the arrangements in practice, for example: 

• Running a generator;
• Restoring a backup;
• Switching to a standby server;
• Testing the notification system.

Full-scale Exercise

Simulate the response on a broader operational scale. After every exercise, follow the sequence:

Exercise → Lesson Learned → Corrective Action → BCP Update

This cycle supports practical BCMS improvement.

Step 12 – Conduct Internal Audits and Management Review; Prepare for Certification

Once the BCMS is operating, assess the whole system.

Internal Audit

Internal audits should examine both documentation and actual capability. Auditors should consider:

• Is the BIA reasonable?
• Are RTOs justified?
• Were RTOs achieved during exercises?
• Are backup suppliers ready?
• Are contact lists accurate?
• Can backups be restored?
• Do employees understand the BCPs?

Management Review

Top management should review:

• BIA results;
• Risks;
• Exercise;
• Audit;
• KPI;
• Incident;
• Resources;
• Corrective Actions;
• Opportunity for Improvement.

Corrective Action

Address weaknesses through: Correction → Root Cause → Corrective Action → Effectiveness Verification

After completing these activities, the organisation may choose to undergo an independent certification audit.

ISO 22301 can be used by organisations of all sizes and integrated with other ISO management system standards. (ISO)

---

How Long Does ISO 22301 Implementation Take?

The duration depends on:

• Organisation size;
• Number of sites;
• Number of processes;
• IT complexity;
• The supply chain;
• Existing management arrangements;
• Project resources.

For a medium-sized organisation, an indicative schedule is 4–6 months, depending on scope and the starting point. Avoid shortening operational trials or omitting BCP exercises simply to obtain certification sooner.

---

7 Common ISO 22301 Implementation Mistakes

1. Starting by Writing BCPs

Use the following sequence: Understand Operations → BIA → Risk Assessment → Strategy → BCP

Avoid reversing this sequence.

2. Assigning BCMS Only to IT

Business continuity concerns the whole organisation. IT disaster recovery is one component of a BCMS.

3. Setting RTOs Based on Current IT Capacity

RTOs must be based on business needs; then assess whether current capabilities can meet those needs.

4. Creating BCPs That Are Too Long and Difficult to Use

During an incident, users need:

• Clear actions;
• Contact lists;
• Decision-making authority;
• Checklist.

A BCP running to hundreds of pages can be difficult to use in practice.

5. Failing to Manage Dependencies

Even a well-planned process may fail to recover without:

• Electricity;
• IT;
• Materials;
• People;
• Logistics.

6. Not Conducting Exercises

An untested plan does not demonstrate that it will work in practice.

7. Implementing Only to Obtain a Certificate

The purpose of ISO 22301 extends beyond obtaining a certificate. The objective is:

To maintain priority activities during disruption and recover within the agreed time.

---

ITVC Global’s ISO 22301 Consulting Services

Effective BCMS implementation combines knowledge of:

• ISO 22301;
• Process management;
• Risk Management;
• Supply Chain;
• IT;
• Crisis Management;
• Internal Audit.

ITVC Global provides ISO 22301 consulting and training, from gap assessment through support for the certification audit.