ISO 22301:2019 · Business continuity
Build a BCMS that is tested, not just written.
A continuity plan is only as good as the impact analysis behind it and the last exercise that tried it. ILSERIS links services, assets, recovery objectives, plans, exercises and corrective actions, so each one shows the others.
Requirements
What ISO 22301 asks of you
ISO 22301 specifies the requirements for a business continuity management system (BCMS). In broad terms, it covers six areas.
Context and scope of the BCMS
Understand your organisation, its interested parties and their requirements, and define the scope of the BCMS.
ILSERIS modules
Business impact analysis and risk assessment
Analyse the impact of disruption on your activities, set recovery priorities and time frames, and assess the risks of disruption.
ILSERIS modules
Business continuity strategies and plans
Choose strategies and solutions to continue and recover prioritised activities, and document them in plans and procedures.
ILSERIS modules
Exercising and testing
Exercise and test your continuity strategies and plans regularly, and use the results to improve them.
ILSERIS modules
Performance evaluation and internal audit
Monitor and measure the BCMS, audit it at planned intervals and have top management review it.
ILSERIS modules
Improvement
Act on nonconformities with corrective action and continually improve the BCMS.
ILSERIS modules
Mapping
How ILSERIS maps to ISO 22301
Five steps, each in a module you already use, all on the same records.
- Step 01
Set up the standard
Record ISO 22301 in Govern's frameworks and set which requirements apply to your scope.
- Step 02
Analyse impact
Run the business impact analysis: tiers, RTO and RPO per service, and the dependency map down to assets.
- Step 03
Write and link plans
Keep BCM and DR plans linked to the services and assets they recover, and to the playbooks and war rooms you use in a crisis.
- Step 04
- Step 05
Review and report
Show RTO gaps, overdue corrective actions and plan status in reports and in the board view.
Outputs
What you can show
To top management and your certification auditor.
- Impact analysis per service: RTO, RPO, tier and dependencies.
- BCM and DR plans linked to the services and assets they recover.
- Exercise plans, results and evaluations.
- Findings and corrective actions followed through to closure.
ILSERIS supports your compliance programme. It does not provide legal advice or certify compliance.
See ILSERIS in action.
A focused walkthrough, built around your regulatory landscape and operating model.