What ISO 22301:2019 sets on each scheduled job
Sets planned intervals, never hours; the continuity rows read no period set by the text. Tick ISO 22301 on the register and every job in these classes carries its row below. A lit cell is a figure the clause states; a row that reads no clock stays that way, because the register never fills a blank the standard left open.
The clock each rule sets
| Consumer class | Clock | Clause |
|---|---|---|
| Backup, restore and replication | ||
| Backup restore test | no clock | ISO 22301 8.5 Exercise programmeplanned intervals |
| Full backup | no clock | ISO 22301 8.4.5 Recovery |
| Replication and failover sync | no clock | ISO 22301 8.4.5 Recovery |
| Incident and breach reporting | ||
| Incident response exercise or drill | no clock | ISO 22301 8.5 Exercise programmeplanned intervals |
| Customer-facing feeds and statements | ||
| Customer statement and notification feed | no clock | ISO 22301 8.4.4 Business continuity plans |
| Payment file and settlement batch | no clock | ISO 22301 8.4.4 Business continuity plans |
The clauses in full
Implement and maintain a programme of exercising and testing that validates the effectiveness of the continuity strategies and solutions over time, running exercises and tests consistent with the continuity objectives, based on well planned scenarios with clearly defined aims, that build teamwork, competence, confidence and knowledge in those with response roles, that taken together over time validate the strategies and solutions, that produce formal post exercise reports with outcomes, recommendations and improvement actions, that are reviewed in the context of continual improvement, and that are held at planned intervals and when significant change occurs; act on the results to implement changes and improvements.
What an assessor asks to see: Exercise programme showing scope, scenario and interval coverage over time; Exercise aims and objectives defined before each exercise; Formal post exercise reports with outcomes, recommendations and actions; Action tracking to closure with evidence of the resulting change. Where it usually falls short: The same comfortable scenario rehearsed annually, so rare failure modes are never stressed
Maintain documented processes to restore and return business activities from the temporary measures adopted during and after a disruption.
What an assessor asks to see: Documented restoration and return to normal processes; Criteria for deciding that temporary measures can be withdrawn; Evidence of use, from exercises or real events, including backlog clearance. Where it usually falls short: Recovery treated as implicit once the incident is closed, with no process behind it
Document and maintain business continuity plans that guide teams through response and recovery, collectively containing the actions to continue or recover prioritized activities within predetermined time frames, the means of monitoring the disruption and the response, the pre defined thresholds and process for activating the response, procedures to deliver products and services at agreed capacity, and how the immediate consequences are managed with regard to individual welfare, prevention of further loss and environmental impact; each plan must state purpose, scope and objectives, the roles and responsibilities of the implementing team, the actions implementing the solutions, the supporting information needed to activate, operate, coordinate and communicate including activation criteria, internal and external interdependencies, resource requirements, reporting requirements and a stand down process, and must be usable and available at the time and place it is needed.
What an assessor asks to see: Plan set with each plan carrying every required element; Activation criteria and thresholds stated in the plan itself; Interdependency and resource sections reconciled to the BIA; Stand down process defined. Where it usually falls short: Plans that cover activation and response but have no stand down, so the organization never formally returns to normal
Requirement text quoted from the standards themselves, published at compliance.theartofservice.com, the same publisher as this register, read against the held text of each standard: our statement of each clause, not the instrument verbatim. Every regime: the index.