ISO 22301:2019

Document and maintain business continuity plans that guide teams through response and recovery, collectively containing the actions to continue or recover prioritized activities within predetermined time frames, the means of monitoring the disruption and the response, the pre defined thresholds and process for activating the response, procedures to deliver products and services at agreed capacity, and how the immediate consequences are managed with regard to individual welfare, prevention of further loss and environmental impact; each plan must state purpose, scope and objectives, the roles and responsibilities of the implementing team, the actions implementing the solutions, the supporting information needed to activate, operate, coordinate and communicate including activation criteria, internal and external interdependencies, resource requirements, reporting requirements and a stand down process, and must be usable and available at the time and place it is needed.

What an assessor asks to see: Plan set with each plan carrying every required element; Activation criteria and thresholds stated in the plan itself; Interdependency and resource sections reconciled to the BIA; Stand down process defined. Where it usually falls short: Plans that cover activation and response but have no stand down, so the organization never formally returns to normal

Maintain documented processes to restore and return business activities from the temporary measures adopted during and after a disruption.

What an assessor asks to see: Documented restoration and return to normal processes; Criteria for deciding that temporary measures can be withdrawn; Evidence of use, from exercises or real events, including backlog clearance. Where it usually falls short: Recovery treated as implicit once the incident is closed, with no process behind it

Implement and maintain a programme of exercising and testing that validates the effectiveness of the continuity strategies and solutions over time, running exercises and tests consistent with the continuity objectives, based on well planned scenarios with clearly defined aims, that build teamwork, competence, confidence and knowledge in those with response roles, that taken together over time validate the strategies and solutions, that produce formal post exercise reports with outcomes, recommendations and improvement actions, that are reviewed in the context of continual improvement, and that are held at planned intervals and when significant change occurs; act on the results to implement changes and improvements.

What an assessor asks to see: Exercise programme showing scope, scenario and interval coverage over time; Exercise aims and objectives defined before each exercise; Formal post exercise reports with outcomes, recommendations and actions; Action tracking to closure with evidence of the resulting change. Where it usually falls short: The same comfortable scenario rehearsed annually, so rare failure modes are never stressed