BCM under ISO 22301: BIA, strategy, exercise

Scope: one continuity management system, scope to management review · Who: the officer who owns the plan · Prerequisites: a product and service list and a named sponsor · First result: one impact analysis

1. Why this exists (the failure mode it prevents)#

Most continuity programmes are a document, not a system. The plan exists, the call tree is current, and almost nothing behind it was ever decided.

The shape repeats. Recovery targets came from whoever configured the replication, so they describe the tool rather than the business. No analysis says which activities matter, or when their loss stops being tolerable. Strategies were never costed. Exercises are read-throughs: the plan is walked, nothing is timed, no report changes anything. Then a cyber event arrives, and the plan does not treat it as a disruption, because it was written for a fire.

Each is a specific gap against ISO 22301:2019. The standard requires a process for analysing business impacts. That process defines impact types and criteria, identifies the activities supporting products and services, and assesses impacts over time. It sets prioritised resumption time frames at a specified minimum acceptable capacity ¹. Exercising and testing must produce formalised post-exercise reports carrying outcomes, recommendations and improvement actions ². The analysis, the strategies and the plans are then evaluated in their own right, for suitability, adequacy and effectiveness ³.

The supervisory reason rests on the same evidence. NIS2 lists business continuity, such as backup management and disaster recovery, and crisis management, among the cybersecurity risk-management measures ⁴. DORA requires an ICT business continuity policy inside the ICT risk management framework ⁵. The obligation table sits in cyber resilience beyond continuity; the method sits here.

One loop, not three silos. How much disruption the organisation will carry is governance's decision. Top management establishes the policy, assigns the authority to run the system, and selects strategies against risk and cost ⁶. The instrument turning that into numbers is risk's. Impact analysis and disruption risk assessment sit in one clause, the second scoped to prioritised activities and their resources ⁷. Compliance later demonstrates the exercised plan and the evaluation record. Governance ensures protection, compliance demonstrates it, and both exist to manage risk.

2. Definitions (only the ones that cause disputes)#

Requirement text is copyright and is paraphrased throughout, never reproduced. Where the standard puts an abbreviation in a note rather than its terms clause, that is said, because it changes how the term is cited.

Term	Working definition	Source
Activity	One or more tasks that together produce a defined output. Departments and systems are not activities.	8
Product and service	An output or outcome provided to interested parties. Scope is expressed in these, then decomposed.	9
Disruption	An incident, expected or not, that knocks delivery of products and services off plan, for the worse.	10
Prioritised activity (the standard spells it "prioritized")	An activity given urgency so unacceptable impacts are avoided during a disruption.	11
Business impact analysis	Analysis of how a disruption's impact on the organisation grows over time. Its outcome justifies the continuity requirements.	12
MTPD and RTO	The point at which not resuming an activity does unacceptable damage, and the resumption target set inside that limit. Both abbreviations sit in notes, not the terms clause.	13
Minimum acceptable capacity	The output level resumption is measured against. Clause 1 frames applicability as delivery at an acceptable predefined capacity.	14
Strategy and solution	A strategy weighs options before, during and after a disruption, and holds one or more solutions.	15
Response structure	A team, or several, made accountable for the response to a disruption, with stated roles, named alternates and documented procedures.	16

Two distinctions are GRCIDE's. Clause 8.5 asks for one programme of exercising and testing without separating them, so treat a test as a pass-or-fail check on a component, and an exercise as a timed rehearsal of people and decisions. "Tolerable disruption" names the governance decision setting outer limits.

3. The method — numbered steps, each with input, activity, output and owner#

Scope before analysis, analysis before strategy, strategy before plans, plans before exercises, evaluation before the review that funds the next cycle.

3.1 Fix the scope on products and services, not on systems#

Scope is determined by considering the external and internal issues, the requirements of interested parties, and the organisation's mission, goals and obligations. It is held as documented information ¹⁷. The parts included are established with regard to location, size, nature and complexity, and the products and services in scope are identified. Exclusions are documented and explained, without undercutting the ability to provide continuity ¹⁸.

Legal and regulatory requirements get their own process. Identify them, have access to them, assess them against the continuity of products, services, activities and resources, and keep the record current ¹⁹. That is where NIS2 or DORA enters the system.

• Input: the service catalogue; the obligations register; the issues record ²⁰.
• Activity: list products and services; state the boundary; justify each exclusion.
• Output: a scope statement and an obligations record, dated.
• Owner: the continuity owner drafts; top management approves.

3.2 Policy, roles, and the tolerable disruption decision#

Top management establishes a policy appropriate to the organisation, providing a framework for objectives and committing to applicable requirements and continual improvement. It is documented, communicated internally and put before interested parties where that is appropriate ²¹. Responsibilities and authorities are assigned, including authority for conformity of the system and for reporting its performance to top management ²². Leadership also integrates the system into business processes and makes resources available ²³.

The decision worth extracting is the outer limit. How long may a service be down, and at what output, before the consequence is unacceptable to the board? The scales answering that are built in risk appetite and criteria. ISO 31000:2018 puts the same idea in its criteria clause. State how much risk of what kind may be carried against objectives, and set criteria for judging significance ²⁴.

• Input: the appetite statement; the scope statement.
• Activity: draft the policy; assign the two authorities; put tolerable disruption per service as a decision.
• Output: a continuity policy, a roles and authorities record, a minuted tolerable disruption decision.
• Owner: top management decides; the continuity owner prepares.

3.3 The business impact analysis, element by element#

This is the step most programmes skip and most auditors open with. Define the impact types and criteria that apply here, each with a written scale. Identify the activities supporting products and services, at activity level, not department level. Use those types and criteria to assess how impacts grow over time when the activities stop. Identify the time frame at which not resuming becomes unacceptable, which a note names the maximum tolerable period of disruption. Set prioritised resumption time frames inside that limit at a specified minimum acceptable capacity, which a second note names the recovery time objective. Then identify prioritised activities, determine the resources they need, and determine dependencies and interdependencies, partners and suppliers included ¹.

Three tests keep the record honest. Every recovery time objective sits inside the outer limit for the same activity. Every prioritised activity has a minimum acceptable capacity in units the business uses. Every dependency is a named resource, single suppliers marked. Analysis and risk assessment are reviewed at planned intervals and on significant change ²⁵.

For financial entities this analysis is a direct obligation. DORA requires a business impact analysis of exposures to severe business disruptions. It uses quantitative and qualitative criteria and scenario analysis as appropriate, and covers criticality of mapped functions, support processes, third-party dependencies and information assets ²⁶.

• Input: the scope statement; the tolerable disruption decision; process owners' time.
• Activity: run the analysis per service; record impacts over time; set both time frames and the capacity.
• Output: a BIA record per prioritised activity, listing resources and dependencies.
• Owner: the risk owner; each activity owner signs their own row.

3.4 The disruption risk assessment#

The clause's second half is a separate obligation and record. Put a risk assessment process in place and keep it running. Identify the risks of disruption to prioritised activities and to the resources they need, analyse and evaluate those risks, and determine which need treatment ⁷. A note points at ISO 31000 for the process. The note under clause 6.1.2 draws the line most registers blur: risks here concern disruption of business activities, while management-system effectiveness belongs to the planning clause ²⁷.

Scenarios come from this assessment, not a template. Choose a set that each break a different assumption: loss of a site, a supplier, a cloud region, corruption of data, and a cyber event making primary systems untrustworthy rather than merely unavailable. Building a defensible set is a method in itself: scenario-based risk assessment.

• Input: the BIA record; the risk criteria; the register.
• Activity: assess disruption risk against prioritised activities and their resources; select scenarios; mark treatment.
• Output: a disruption risk assessment and a scenario set, traceable to the register.
• Owner: the risk owner; the activity owner accepts or escalates.

3.5 Strategies and solutions: identify, select, resource, implement#

From both halves, identify and select strategies with options before, during and after a disruption, each made of one or more solutions ¹⁵. Identification is judged on whether an option meets the resumption requirements inside the time frames and capacity already agreed. It must also shield the activities that matter most, make disruption rarer and shorter, limit harm to products and services, and come resourced ²⁸.

Selection is where governance signs. Selection weighs the same resumption requirements, the kinds and amount of risk the organisation will carry, and cost against benefit ²⁹. A strategy with no cost attached has not been selected under this clause; it has been preferred.

Resource requirements are then determined for the selected solutions ³⁰. The standard leaves the set of resource types open but names the kinds: partners and suppliers, money, logistics, ICT, equipment, premises and utilities, information, and above all people. Solutions are then implemented and maintained ready for activation ³¹. An arrangement nobody has invoked in three years is a document again. Governance signs the strategy and its cost, risk chose the scenarios it answers, compliance later shows the exercise that proved it.

• Input: the BIA record; the disruption risk assessment; a cost model.
• Activity: put two or three costed options per prioritised activity to the approving body; record the reasoning.
• Output: a strategy decision record with cost, and an implementation plan.
• Owner: top management selects; the continuity owner implements.

3.6 Plans and procedures, including the response structure#

Implement and maintain a response structure enabling timely warning and communication, and provide plans to manage the organisation during a disruption. Procedures are specific about immediate steps, flexible as conditions change, focused on incident impact, and explicit about roles ³².

The structure identifies one or more teams and states their roles and relationships. Collectively they must be competent to assess a disruption and its impact, and to test that impact against pre-defined thresholds justifying a formal response. They activate the response and the solutions, set priorities with life safety first, monitor effects, and communicate with interested parties, authorities and the media. Each team has named personnel and alternates with the necessary authority and competence, plus procedures for activating, running, coordinating and communicating its response ¹⁶.

Warning and communication is a documented procedure set of its own. It covers what is communicated, when, to whom and by what means, and answering what interested parties send in, a national or regional risk advisory system included. It also covers keeping the means available, structured contact with emergency responders, the media response, and recording the disruption, actions and decisions. These are exercised inside the programme ³³.

Plans have required contents. Collectively they detail the actions teams take to continue or recover prioritised activities inside time frames fixed in advance. They reference the thresholds and the activation process, cover delivery at agreed capacity, and address welfare, further loss and the environment. Each states purpose, scope and objectives, team roles, actions implementing the solutions, activation criteria and supporting information, interdependencies, resources, reporting requirements and a stand-down process. Each is usable and available where and when needed ³⁴. Return is separate: documented processes bring business activities back from the temporary arrangements used during and after a disruption ³⁵.

Declaration, escalation and reporting are governed once. Reuse incident governance, sections 3.3 and 3.5, so a disruption and a reportable incident never run two clocks.

• Input: the strategy decision record; the roles record; the regime map.
• Activity: stand up teams with alternates; write plans to the required contents; wire communication to the incident process.
• Output: a response structure, a plan set, a communication procedure, a return process.
• Owner: the continuity owner; each team leader owns their plan.

3.7 The exercise programme#

The standard asks for a programme of exercising and testing that validates the effectiveness of strategies and solutions over time. Exercises and tests are consistent with the continuity objectives and built on appropriate scenarios, well planned with clearly defined aims. They build the knowledge, confidence and skill of those who hold a role in a disruption, and their ability to work as a team. Each produces a formalised post-exercise report with outcomes, recommendations and improvement actions, is reviewed for continual improvement, and runs at planned intervals and on significant change. Results are acted on ².

Four design rules make that testable. Draw the scenario from the risk assessment. Time the recovery against the objective recorded for that activity, and write the measured interval into the report even when it embarrasses the plan. Exercise the communication procedures in the same run. Rotate coverage so every prioritised activity and solution is exercised once a cycle.

Regulated programmes inherit a floor. DORA requires continuity and response and recovery plans to be tested at least yearly, and on substantive changes to systems supporting critical or important functions. The testing programme and threat-led testing sit alongside ³⁶. Detail: DORA implementation, sections 3.5 and 3.7.

• Input: the scenario set; the plan set; the recorded time frames.
• Activity: schedule the programme; run each exercise against a clock; write the report that week.
• Output: an exercise programme and one post-exercise report per run, with dated actions.
• Owner: the continuity owner; activity owners take part in their own scenarios.

3.8 Evaluation of documentation and capabilities#

Evaluation is a separate clause from exercising, and reading it that way removes a whole class of finding. Judge how suitable, adequate and effective the analysis, the assessment, the strategies and solutions, and the plans are. Use reviews and analysis, exercises and tests, reports from past incidents, and performance evaluation as the means. Evaluate the continuity capability of relevant partners and suppliers. Check conformity with the organisation's own policy and objectives, and compliance with the legal and regulatory requirements that apply. Update documentation promptly. Run these evaluations at planned intervals, after any incident or activation, and on significant change ³.

The supplier half is most often missing. An activity resting on one provider needs evidence of that provider's capability, not a contract clause about it: third-party risk lifecycle.

• Input: exercise reports; post-incident reviews; supplier evidence; the obligations record.
• Activity: judge each artefact on how suitable, adequate and effective it is; record what changed.
• Output: an evaluation report with a documentation update log.
• Owner: the continuity owner; the control function reviews independence.

3.9 Performance evaluation, internal audit, management review, corrective action#

Determine what is monitored and measured, the methods giving valid results, and when and by whom measurement and analysis happen. Retain the results as evidence, and evaluate performance and effectiveness ³⁷. Internal audits run at planned intervals against the organisation's own requirements and against the standard. The audit programme defines criteria and scope per audit, and selects auditors for objectivity and impartiality. It reports to relevant managers, retains evidence, and follows corrective actions through to verification ³⁸.

Management review has a named input list, and two entries close this playbook's loop: information from the impact analysis and risk assessment, and output from the evaluation of continuity documentation and capabilities. Outputs include decisions varying the scope, and decisions to update the analysis, the assessment, the strategies and solutions, and the plans ³⁹. Nonconformities are reacted to, causes examined, action implemented and its effectiveness reviewed, with documented evidence of both ⁴⁰. Improvement is continual, and is measured in both qualitative and quantitative terms ⁴¹.

An organisation certified to ISO/IEC 27001:2022 runs these clauses once. That standard names clause 9.1 "Monitoring, measurement, analysis and evaluation" and clause 9.3 "Management review" ⁴². One audit programme and one forum carry both: building an ISMS people actually use.

• Input: measurement definitions; the audit programme; the evaluation report.
• Activity: measure, audit, review, correct; verify each action closed rather than raised.
• Output: a measurement record, an audit report, a minuted review, a corrective action log.
• Owner: the continuity owner; internal audit stays independent of the plans it audits.

3.10 The cyber seam#

A continuity system written before ransomware treats availability as the only property at risk. Four controls close that seam. Their numbers are shared with ISO/IEC 27001:2022 Annex A, their titles cited from ISO/IEC 27002:2022.

Control 5.29 "Information security during disruption" asks that security be held at an appropriate level while disrupted, including compensating controls where primary ones cannot be maintained ⁴³. Control 5.30 "ICT readiness for business continuity" derives ICT continuity requirements from the impact analysis. It assigns recovery time objectives to prioritised activities and their supporting resources, and adds recovery point objectives for the information involved ⁴⁴. Control 8.13 "Information backup" asks for backups of information, software and systems, maintained and regularly tested against a topic-specific policy ⁴⁵. Control 8.14 "Redundancy of information processing facilities" asks for enough redundancy to meet the availability requirements identified, tested where practicable so failover is proven ⁴⁶.

Two obligations sit on the same seam. DORA sets backup scope and minimum frequency, and requires restoration from systems physically and logically segregated from the source. It ties recovery time and recovery point objectives per function to criticality and to the potential impact on market efficiency ⁴⁷. The CER Directive requires measures ensuring resilience, including recovery from incidents, for entities identified under it ⁴⁸. The clocks are in incident governance, section 3.5.

• Input: the BIA record; the control catalogue; the backup policy.
• Activity: set a recovery point objective per prioritised information set; run one timed restore from segregated systems; exercise one failover.
• Output: a restore-test record, a failover record, a compensating control list.
• Owner: ICT operations tests; the continuity owner accepts the evidence.

3.11 The operating calendar#

A system is a calendar with owners. "At planned intervals" is defensible only when the plan states the interval.

Cadence	Activity	Clause anchor	Output
Monthly	Backup check, one restore sample	8.6, control 8.13	Restore-test record
Quarterly	One timed exercise from the set	8.5	Post-exercise report
Quarterly	Continuity item at the risk forum	9.1	Minuted actions
Half-yearly	Supplier capability evaluation	8.6	Supplier evidence file
Yearly	Impact analysis and risk refresh	8.2.1	Updated BIA record
Yearly	Internal audit of the continuity system	9.2	Audit report
Yearly	Management review with the named inputs	9.3	Minuted decisions
On change	Re-run scope, analysis, plans	8.2.1, 8.5, 8.6	Change update

These decisions attach to existing forums: security operating model, section 3.5. Aggregation beside other exposures: security risk in enterprise risk management.

4. Deliverables (with template links)#

Deliverable	Format	Template	Retention
BIA record per prioritised activity	xlsx	pending	Three years
Disruption risk assessment and scenarios	xlsx	/templates/risk-register	Three years
Strategy decision record with cost	markdown	pending	Life of the strategy
Response structure and plan set	markdown	pending	Current plus one version
Exercise programme and reports	markdown	pending	Three years
Evaluation report and update log	markdown	pending	Three years
Management review pack and minutes	markdown	pending	Three years

Criteria and scales come from /templates/risk-criteria-and-appetite.

5. What the auditor (and the supervisor) will ask#

• "Show how you determined the time frame at which not resuming an activity becomes unacceptable." — evidence: the BIA record, with impacts over time.
• "Show a recovery time objective inside that limit, and an exercise in which it was met." — evidence: the BIA record and the post-exercise report.
• "How was the minimum acceptable capacity set, and by whom?" — evidence: the BIA row and the minuted tolerable disruption decision.
• "Show the costs and benefits considered when this strategy was selected." — evidence: the strategy decision record.
• "Show the report from your last exercise, and the evaluation of supplier continuity capability." — evidence: the exercise programme with its dated actions, and the evaluation report.
• "Where did the analysis and evaluation outputs enter management review?" — evidence: the review pack and the minutes.

6. Failure modes and how they surface as findings#

• Recovery targets set by the recovery tool — surfaces as: objectives tracing to no impact analysis, and no outer limit. Smallest fix: analyse the top five services and reset the objectives.
• Strategies preferred rather than selected — surfaces as: no record of cost, benefit or appetite behind the arrangement. Smallest fix: present two costed options, and minute the choice.
• Exercises with no report, and no evaluation behind them — surfaces as: exercises logged in a calendar, nothing carrying outcomes or improvement actions, and no judgement on how well any of it works. Smallest fix: one page per exercise with the measured interval and dated actions, plus an annual evaluation report.
• A cyber event outside the plan — surfaces as: plans assuming systems are intact but unavailable, with no compensating controls. Smallest fix: exercise one scenario in which primary systems are untrustworthy.
• Two clocks for one event — surfaces as: a disruption declared under the continuity plan while the reporting clock ran unnoticed. Smallest fix: one declaration record feeding both the response structure and the reporting decision.

7. Mapping to standards and instruments#

Clause numbers are cited as printed; requirement text is paraphrased. Control numbers are shared with ISO/IEC 27001:2022 Annex A. This management-system column uses clause numbers recorded in the source log ⁴⁹. Category names and identifiers are as printed ⁵⁰.

Step	ISO 22301:2019	ISO/IEC 27001:2022	ISO/IEC 27002:2022	NIS2 / DORA	CSF 2.0	Evidence
3.1 Scope	4.2.2, 4.3	8.1	—	NIS2 Art. 21(2)(c)	GV.OC	Scope statement
3.2 Policy and tolerance	5.1, 5.2, 5.3	6.1	—	DORA Art. 11(1)	GV.OC	Policy, minute
3.3 Impact analysis	8.2.2	8.1	5.30	DORA Art. 11(5)	RC.RP	BIA record
3.4 Disruption risk	8.2.3	6.1	—	NIS2 Art. 21(2)(c)	RC.RP	Assessment, scenarios
3.5 Strategies and solutions	8.3.1 to 8.3.5	6.1	8.14	DORA Art. 12(3)	PR.IR	Decision record
3.6 Plans and structure	8.4.1 to 8.4.5	8.1	5.29	DORA Art. 11(2) 51	RC.CO	Plan set, teams
3.7 Exercise programme	8.5	9.1	5.30	DORA Art. 11(6)	RC.RP	Post-exercise reports
3.8 Evaluation	8.6	9.2	5.29	DORA Art. 11(3) 52	RC.RP	Evaluation report
3.9 Review and correction	9.1, 9.2, 9.3, 10.1	9.3, 10.2	—	DORA Art. 11(6)	GV.OC	Minutes, actions
3.10 Cyber seam	8.3.4, 8.6	8.1	5.29, 5.30, 8.13, 8.14	DORA Art. 12(1)	PR.IR, RC.RP	Restore, failover

The DORA rows summarise; detail is in DORA implementation, section 3.5.

8. Checklist (interactive)#

• The scope statement names products and services, and every exclusion carries a written justification, with the record of applicable legal and regulatory continuity requirements current.
• The policy is approved and communicated, and the two authorities are assigned to named roles.
• Tolerable disruption per service is a dated decision of the approving body.
• Impact types and criteria are defined and applied across every prioritised activity.
• Each prioritised activity has an outer time limit, a resumption time frame inside it, and a minimum acceptable capacity.
• Resources and dependencies, partners and suppliers included, are listed per prioritised activity.
• The disruption risk assessment covers those activities and their resources, and marks what needs treatment.
• Each scenario comes from that assessment and breaks a different assumption.
• Every selected strategy has a recorded cost, benefit and risk consideration.
• The response structure names teams, alternates, response thresholds and stand-down.
• Every plan states purpose, roles, activation criteria, interdependencies, resources, reporting and stand-down.
• Each exercise produced a report with the measured interval and dated actions.
• Across one cycle, every prioritised activity and every selected solution has been exercised.
• The evaluation report covers analysis, plans, procedures and supplier capability, and one timed restore and one failover test are recorded this year.
• Management review minutes show the analysis and evaluation outputs as inputs, and record decisions.

References#

1. ISO. Business continuity management systems — Requirements. ISO 22301:2019. https://www.iso.org/standard/75106.html
2. ISO/IEC. Information security controls. ISO/IEC 27002:2022. https://www.iso.org/standard/75652.html
3. ISO/IEC. Information security management systems. ISO/IEC 27001:2022. https://www.iso.org/standard/27001
4. ISO. Risk management. ISO 31000:2018. https://www.iso.org/standard/65694.html
5. Directive (EU) 2022/2555 (NIS2). CELEX 32022L2555. https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng
6. Regulation (EU) 2022/2554 (DORA). CELEX 32022R2554. https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng
7. Directive (EU) 2022/2557 (CER). CELEX 32022L2557. https://eur-lex.europa.eu/eli/dir/2022/2557/oj/eng
8. NIST. Cybersecurity Framework (CSF) 2.0. NIST CSWP 29. https://doi.org/10.6028/NIST.CSWP.29

An amendment exists, ISO 22301:2019/Amd 1:2024; nothing about its content is stated here, because it was not read.

Standards and certification names are the property of their respective owners. GRCIDE is an independent publication and is not affiliated with, authorized, sponsored or endorsed by ISO, IEC, NIST or any other standards body.