ISO 22301 defines the requirements for the development and implementation of an efficient Business continuity management system (BCMS).

ISO 22301 describes the main elements of managing business continuity:
Planning, establishing, implementing, operation, monitoring, review, analysis and continual improvement. The standard requirements are intended to allow for the continuity of business activities of the organization, to protect against and decrease the likelihood of incidents, to prepare for an appropriate reaction and recovery after destructive incidents have occurred.
The business continuity management system underlines the importance of:

• Understanding the needs of the organization and the need to establish policies and objectives for the management of the continuity of operations;

• Implementing and applying control mechanisms and taking precautions to manage the ability of the organization to manage continuity, when destructive incidents happen;

• Monitoring and testing of the efficiency of BCMS;

• Constant improvement based on objective measurement.

 
Similar to other management systems, BCMS consists of the following elements:

1. Policy

2. Personnel with defined responsibilities

3. Processes to be managed, connected to:

• policy;

• planning;

• implementation and operation;

• evaluation of performance;

• leadership review;

• improvement.

4. Documentation providing reliable evidence for an audit.

5. All processes for the management of continuity of operation, applicable to the organization.

The international standard ISO 22301 applies the model "Plan-Do-Check-Act", typical for most of the ISO standards. This model allows the BCMS to be integrated with other standards for management systems, for example with: ISO 9001 "Quality management systems", ISO 14001 "Environmental management systems", ISO/IEC 27001 "Information security management", ISO/IEC 20000-1 "Information technology. Service management" and ISO 28000 "Specification for security management systems for the supply chain", and thus it assists the efficient functioning of processes in the organization and the processes of auditing of management systems, implemented by it.

The requirements defined in ISO 22301 are common and their application is intended for various organizations or parts of them, regardless of their kind, size or nature of work. The extent to which an organization applies these requirements, depends on the specific situation and the context of the organization.

Implementation of ISO 22301 in the business continuity management is particularly important for organizations working in high-risk environments, such as industrial enterprises with branches located in different regions, or ones in the public sector, finance, transportation, telecommunications, where the ability to ensure continuity of operations is essential, for the organization itself, for its clients, as well as for the stakeholders and society at large.

ISO 22301 is applicable for organizations wishing to:

• establish, implement, maintain and improve a BCMS;

• ensure correspondence with their stated polices for continuity of operations;

• demonstrate consistency with the applicable requirements of the stakeholders;

• receive approval (certification/registration) of their BCMS from an independent body;

• declare their responsibility and engagement for conformity to this international standard.

 
Advantages for the organization after implementation and certification according to ISO 22301:

• making a fast recovery of normal operations of the organization, in case an overwhelming crisis occurs;

• crisis readiness based on a reliable and objective risk analysis;

• continual engagement and readiness of staff for work in overwhelming circumstances;

• development of procedures, based on the good international practices forming the requirements of this standard;

• implementation and certification of a BCMS guarantees confidence in the ability of the organization to maintain continuity of operations and to be trusted by users, governmental, non-governmental and other stakeholders;

• increased confidence in the organization increases its competitiveness.

ISO 22301:2019 (BDS EN ISO 22301:2020) Security and resilience. Business continuity management systems. Requirements