This checklist is an implementation aid, not a replacement for the ISO 22301 publication. For each item, identify an owner, evidence source, status, gap and next action. “Document exists” is not enough where the requirement concerns an operating process or demonstrated capability.
What this means in practice
Implementation should be traceable end to end. Select an important service and follow it from scope and ownership through BIA, dependency mapping, strategy, plan, exercise, performance evaluation and corrective action. That service trace often exposes disconnects hidden by a clause-by-clause document review.
Decision and evidence map
| Area | Practical question | Evidence |
|---|---|---|
| Context | Are relevant issues, interested parties, requirements and scope established? | Context, obligations, climate relevance and scope records |
| Leadership | Are policy, accountability and roles operating? | Approval, governance and resource decisions |
| Planning | Are BCMS risks/opportunities and objectives managed? | Objectives, owners, measures and actions |
| Support | Are resources, competence, communications and documents controlled? | Training, communication and version evidence |
| Operation | Do BIA, strategies, plans and exercises form a coherent recovery capability? | Service trace and capability evidence |
| Evaluation/improvement | Do audit, management review and corrective action change the system? | Findings, decisions, closures and effectiveness checks |
Practical implementation checklist
- Identify context, interested parties and applicable requirements.
- Assess climate-change relevance and relevant interested-party climate requirements under the 2024 amendment.
- Approve and communicate a continuity policy with clear roles.
- Set measurable BCMS objectives and resources.
- Define controlled BIA and disruption-risk methods.
- Select continuity strategies against recovery requirements.
- Establish warning, communication, response and continuity procedures.
- Exercise capability and evaluate results.
- Run internal audit and management review.
- Correct nonconformities and verify improvement effectiveness.
Worked example
A readiness team selects a critical payments service and traces its approved BIA requirement to the chosen technology and supplier strategies, plan activation steps, most recent recovery exercise, current RTO evidence, open corrective actions and the management-review decision. Missing links are recorded as gaps rather than masked by a generic “clause compliant” checkbox.
Common mistakes
- Creating one separate document for every checklist line when existing controlled evidence would work.
- Scoring compliance based on template presence rather than implementation.
- Ignoring the age and scope of test evidence.
- Leaving requirement-versus-capability gaps outside management review.
- Using this checklist as authoritative clause text instead of consulting the standard.
Governance, review and improvement
Readiness improves when evidence is current, linked and sampled across real services. Prioritize gaps that could prevent important services meeting recovery needs as well as systemic leadership, audit or improvement weaknesses. Keep a record of corrections and effectiveness rather than repeatedly reopening the same finding.
Authoritative references
BCM.Center paraphrases standards and guidance; use the official publication for authoritative wording and current status.
- ISO 22301:2019 — BCMS requirements
- ISO 22301:2019/Amd 1:2024 — Climate action changes
- ISO 22313:2020 — Guidance on use of ISO 22301
- ISO/CD 22301 — Edition 3 under development
Frequently asked questions
Is this the ISO 22301 standard?
No. It is a practitioner checklist that paraphrases implementation themes; the ISO publication is the authoritative source.
Does each item need its own document?
No. Evidence can be integrated into existing governance and systems if the requirement and operation can be demonstrated.
What should be checked first?
Start with scope and leadership, then trace important services through BIA, strategy, plans, exercises and improvement.
Can it support internal audit?
Yes as a planning aid, but internal audit still requires defined criteria, objective evidence, suitable sampling and auditor competence/objectivity.
How should gaps be prioritized?
By consequence for important services, legal obligations and systemic weaknesses in the management system.