After reading, you can see how the pieces of a continuity programme fit together, and what to do first.
Definition
ISO 22301 sets the requirements for a business continuity management system. Its reach goes well beyond IT, taking in people, sites, suppliers and information.
The trigger might be a fire, a cyberattack, a supplier failure, a flood or the sudden absence of key staff. Planners look at the effect, such as losing a site, because they could never list every cause.
Why it matters
Nobody sets priorities calmly in the middle of a crisis. Whatever was decided beforehand is what limits the loss.
It is a legal matter too. NIS2 Article 21(2)(c) names business continuity and crisis management, and DORA requires it of financial entities.
How it works
A business impact analysis comes first. It ranks activities and sets recovery targets, and only then do you assess the risks to those activities.
Next, choose a strategy for each resource: an alternative site, remote work, a second supplier, a manual process. The plans then say who does what, and in what order.
Exercises come last and never really end. Each one exposes something that needs correcting, and the plans change with the business.
A worked case
Ransomware takes down a logistics company's warehouse system. The plan names a crisis lead, moves priority orders to the paper picking lists printed each night, and brings in the second carrier.
Within six hours the company ships 60% of its volume, the level set in its impact analysis, while IT restores the system from backups.
Good practices
- Start from the services customers depend on, then trace what those services need.
- Keep the plans reachable when the network is down, including on paper.
- Name a deputy for each key role. People go on holiday, and crises do not wait.
- Exercise at least once a year with people from outside IT.
Common mistakes
- Treating continuity as an IT backup project, which leaves the business with working servers and nobody who knows what to do.
- Writing a plan so long that no one reads it before the day it is needed.
- Never testing it. The first test is where most plans fail, and it is better to fail in an exercise.
- Forgetting that the crisis team needs a way to communicate when email is down.
Questions
- Is ISO 22301 certifiable?
- Yes. It contains requirements that accredited certification bodies audit.
- What is crisis management?
- The way management takes decisions and communicates during a serious event. Continuity plans carry those decisions out in each operational area.
- How often should a continuity plan be tested?
- ISO 22301 requires exercises at planned intervals and when significant changes occur. Once a year is a common minimum.
- Does a small company need a continuity plan?
- Yes, in proportion. A few pages naming priorities, people, contacts and workarounds are often enough.
- What makes a good continuity exercise?
- A realistic scenario, the people who would really act, a time limit, and a written list of corrections at the end.