| A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z | ||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1 | Standard clause | ISO 22301:2019 + Amd 1:2024 Requirement excerpt (original English) | Plain-language explanation, examples and evidence | Documentary evidence required? Yes / No | Yes | No | Not applicable | Client document / evidence, findings or N/A justification | |||||||||||||||||||
2 | 4.1 | The organization shall determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended outcome(s) of its BCMS. | Have factors affecting the business continuity management system (BCMS) been identified: sites, people, IT, supplies and markets? No separate document is prescribed. Evidence: interviews, context analysis and strategy. “No” in D does not remove record requirements under other clauses; “Yes” may refer to documentation to the extent necessary under 8.1, as explained in the row. | No | — | ||||||||||||||||||||||
3 | 4.1 (Amd 1:2024) | The organization shall determine whether climate change is a relevant issue. | Has climate-change relevance to continuity been assessed: heat, flooding, power and supply disruptions? A separate climate programme is not required. Evidence: a reasoned conclusion, interviews and context/risk assessment. “Not relevant” may be the conclusion; the assessment itself cannot be omitted. | No | — | ||||||||||||||||||||||
4 | 4.2.1 | When establishing its BCMS, the organization shall determine: a) the interested parties that are relevant to the BCMS; b) the relevant requirements of these interested parties. | Are relevant customers, employees, authorities, partners and their continuity requirements identified? A separate register is not prescribed. Evidence: contracts, interviews and a requirements matrix. The Amd 1:2024 note to 4.2.1 highlights that relevant parties may have climate-related requirements. | No | — | ||||||||||||||||||||||
5 | 4.2.2 a)–c) | The organization shall: […] implement and maintain a process to identify, have access to, and assess the applicable legal and regulatory requirements […] document this information and keep it up to date. | Are continuity requirements for products, services, activities and resources identified, accessible and assessed? Are applicable legal, regulatory and other requirements considered in the BCMS? Yes: current documented information, such as a register with sources, applicability and how requirements are addressed. No particular format is prescribed. | Yes | — | ||||||||||||||||||||||
6 | 4.3.1 | The organization shall determine the boundaries and applicability of the BCMS to establish its scope. […] The scope shall be available as documented information. | Are boundaries defined using 4.1, 4.2, mission, goals and internal/external obligations? Yes: documented BCMS scope, such as a scope statement or manual section clearly identifying covered sites and activities. | Yes | — | ||||||||||||||||||||||
7 | 4.3.2 a)–b) | The organization shall: a) establish the parts of the organization to be included in the BCMS, taking into account its location(s), size, nature and complexity; b) identify products and services to be included in the BCMS. | Are included units, sites, products and services identified? Yes: details in the documented scope under 4.3.1. For example, specific logistics services and warehouses rather than simply “company continuity”. | Yes | — | ||||||||||||||||||||||
8 | 4.3.2 | When defining the scope, the organization shall document and explain exclusions. They shall not affect the organization's ability and responsibility to provide business continuity […]. | If organizational parts, products or services are excluded, is this justified against BIA, risks and applicable requirements? Yes, where exclusions exist: their description and justification. N/A applies to this check only if there are no exclusions. This is not general permission to omit standard requirements. | Yes | |||||||||||||||||||||||
9 | 4.4 | The organization shall establish, implement, maintain and continually improve a BCMS, including the processes needed and their interactions, in accordance with the requirements of this document. | Do analysis, solutions, plans, exercises, evaluation and improvement form a functioning system? A separate BCMS manual is not prescribed. Evidence: process-owner interviews and traceability from BIA through exercises to improvements. | No | — | ||||||||||||||||||||||
10 | 5.1 a)–c) | Top management shall demonstrate leadership and commitment with respect to the BCMS by: […] ensuring the integration of the BCMS requirements into the organization's business processes; […] ensuring that the resources needed for the BCMS are available; | Are policy and objectives aligned with strategy, requirements integrated into business processes and resources provided? No separate leadership declaration is needed. Evidence: budget decisions, appointments and management involvement. Policy and objectives are documented under 5.2.2 and 6.2.1. | No | — | ||||||||||||||||||||||
11 | 5.1 d)–h) | […] communicating the importance of effective business continuity and of conforming to the BCMS requirements; […] promoting continual improvement; | Does management ensure intended outcomes, support people and other managers and promote improvement? No separate record is prescribed. Evidence: management communications, removal of obstacles, interviews and completed improvements. | No | — | ||||||||||||||||||||||
12 | 5.2.1; 5.2.2 a) | Top management shall establish a business continuity policy that: […] includes a commitment to satisfy applicable requirements; […] includes a commitment to continual improvement of the BCMS. […] The business continuity policy shall: a) be available as documented information; | Is the policy appropriate to the organization’s purpose, providing a framework for objectives and including both commitments? Yes: a current documented policy established by top management. It may be part of an integrated policy. | Yes | — | ||||||||||||||||||||||
13 | 5.2.2 b)–c) | […] be communicated within the organization; […] be available to interested parties, as appropriate. | Is the policy communicated internally and available externally as appropriate? A separate acknowledgement sheet is not prescribed. Evidence: intranet, communications, interviews and a customer-accessible version. The policy document is required by 5.2.2 a). | No | — | ||||||||||||||||||||||
14 | 5.3 | Top management shall ensure that the responsibilities and authorities for relevant roles are assigned and communicated within the organization. | Are responsibilities and authority assigned for BCMS conformity and reporting performance to top management? Are they understood? A separate appointment order is not prescribed. Evidence: job descriptions, RACI, workflow assignments and interviews. | No | — | ||||||||||||||||||||||
15 | 6.1.1 | […] determine the risks and opportunities that need to be addressed to: a) give assurance that the BCMS can achieve its intended outcome(s); b) prevent, or reduce, undesired effects; c) achieve continual improvement. | Are context and interested-party requirements used to identify BCMS risks and opportunities, such as skills gaps or alerting automation? A separate register is not prescribed. Evidence: planning, discussions and decisions. Disruption risks are separately assessed under 8.2.3. | No | — | ||||||||||||||||||||||
16 | 6.1.2 | The organization shall plan: a) actions to address these risks and opportunities; b) how to: 1) integrate and implement the actions into its BCMS processes […] 2) evaluate the effectiveness of these actions […]. | Are actions, process integration and effectiveness checks planned? A separate plan document is not prescribed. Evidence: assigned tasks, deadlines and outcome criteria. Operational records are retained to the necessary extent under 8.1. | No | — | ||||||||||||||||||||||
17 | 6.2.1 | The organization shall establish business continuity objectives at relevant functions and levels. […] The organization shall retain documented information on the business continuity objectives. | Are objectives consistent with policy, measurable where practicable, informed by applicable requirements, monitored, communicated and updated? Yes: documented objectives, such as recovery targets and exercise coverage. The standard does not prescribe universal target values. | Yes | — | ||||||||||||||||||||||
18 | 6.2.2 | When planning how to achieve its business continuity objectives, the organization shall determine: a) what will be done; b) what resources will be required; c) who will be responsible; d) when it will be completed; e) how the results will be evaluated. | For each objective, are actions, resources, responsibility, completion dates and evaluation defined? No separate plan format is mandatory. Evidence: tasks, budgets, action plans or details within the objectives register. | No | — | ||||||||||||||||||||||
19 | 6.3 | When the organization determines the need for changes to the BCMS […] the changes shall be carried out in a planned manner. The organization shall consider: a) the purpose of the changes and their potential consequences; b) the integrity of the BCMS; c) the availability of resources; d) the allocation or reallocation of responsibilities and authorities. | Are changes, including those arising from Clause 10, planned considering consequences, BCMS integrity, resources and roles? No particular form is prescribed. Evidence: transition plans, tickets and approvals. If no changes occurred, assess process readiness. | No | — | ||||||||||||||||||||||
20 | 7.1 | The organization shall determine and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the BCMS. | Are sufficient people, time, funding and infrastructure provided? A separate resource plan is not mandatory. Evidence: actual resource availability, budget decisions and staff participation. | No | — | ||||||||||||||||||||||
21 | 7.2 a)–d) | […] determine the necessary competence […] ensure that these persons are competent […] evaluate the effectiveness of the actions taken; […] retain appropriate documented information as evidence of competence. | Are competence needs identified and met for people affecting continuity, including contractors under organizational control? Is development effectiveness evaluated? Yes: skills assessments, education, experience and practical-training/exercise results. Attendance alone may be insufficient. | Yes | — | ||||||||||||||||||||||
22 | 7.3 a)–d) | Persons doing work under the organization's control shall be aware of: […] their own role and responsibilities before, during and after disruptions. | Do people know the policy, their contribution, nonconformity implications and roles before, during and after disruption? Separate logs are not prescribed. Evidence: interviews, scenario questions and exercise observation. | No | — | ||||||||||||||||||||||
23 | 7.4 a)–e) | The organization shall determine the internal and external communications relevant to the BCMS, including: a) on what it will communicate; b) when to communicate; c) with whom to communicate; d) how to communicate; e) who will communicate. | Are topics, timing, recipients, channels and communicators determined? A separate matrix is not mandated by 7.4. Evidence: interviews, functioning channels and actual communications. Documented disruption communication procedures are separately required by 8.4.3. | No | — | ||||||||||||||||||||||
24 | 7.5.1 | The organization's BCMS shall include: a) documented information required by this document; b) documented information determined by the organization as being necessary for the effectiveness of the BCMS. | Does the BCMS contain mandatory documented information and other information determined necessary? Yes: the documents and records themselves. A separate manual or register is not mandatory; electronic systems and combined documents are acceptable. | Yes | — | ||||||||||||||||||||||
25 | 7.5.2 a)–c) | When creating and updating documented information the organization shall ensure appropriate: a) identification and description […] b) format […] and media […] c) review and approval for suitability and adequacy. | Can the document/version be identified, with appropriate format and approval? Yes: identifiable documents and review/approval information, such as metadata and electronic approval. A separate paper signature sheet is not mandatory. | Yes | — | ||||||||||||||||||||||
26 | 7.5.3.1 | Documented information […] shall be controlled to ensure: a) it is available and suitable for use, where and when it is needed; b) it is adequately protected […]. | Are current documents accessible and usable, including during disruption, and adequately protected? A separate control procedure is not prescribed. Evidence: access tests, protected copies, recovery checks and current versions. | No | — | ||||||||||||||||||||||
27 | 7.5.3.2 | […] the organization shall address the following activities, as applicable: a) distribution, access, retrieval and use; b) storage and preservation, including preservation of legibility; c) control of changes […]; d) retention and disposition. | Are distribution, access, storage, legibility, versions, retention and disposal controlled, including necessary external documents? A separate log is not prescribed. Evidence: repository settings, version history, permissions, external instructions and contracts. | No | — | ||||||||||||||||||||||
28 | 8.1 a)–c) | The organization shall plan, implement and control the processes […] by: a) establishing criteria for the processes; b) implementing control of the processes in accordance with the criteria; c) keeping documented information to the extent necessary to have confidence that the processes have been carried out as planned. | Are process criteria and controls established, including actions under 6.1? Yes, to the necessary extent: assignments, BIA and risk-assessment outputs, decisions and check records. A separate document for every operation is not mandatory; one system may hold the information. | Yes | — | ||||||||||||||||||||||
29 | 8.1 | The organization shall control planned changes and review the consequences of unintended changes, taking action to mitigate any adverse effects, as necessary. | Are planned changes to sites, IT, suppliers and processes controlled and unintended effects reviewed? Yes, to the necessary extent under 8.1: impact assessment, approvals, tests and mitigation decisions. If none occurred, assess established arrangements. | Yes | — | ||||||||||||||||||||||
30 | 8.1 | The organization shall ensure that outsourced processes and the supply chain are controlled. | Are outsourced processes and supply-chain dependencies controlled? Yes, to the necessary extent under 8.1: supplier requirements, agreements, monitoring and dependency assessments. No outsourcing does not necessarily mean no supply chain. | Yes | — | ||||||||||||||||||||||
31 | 8.2.1 a)–b) | […] implement and maintain systematic processes for analysing the business impact and assessing the risks of disruption; […] review the business impact analysis and risk assessment at planned intervals and when there are significant changes […]. | Are systematic BIA and risk-assessment processes maintained and reviewed at planned intervals and after significant organizational/contextual changes? Yes, to the necessary extent under 8.1: methods, outputs and review evidence. No universal frequency or mandatory order of BIA and risk assessment is prescribed. | Yes | — | ||||||||||||||||||||||
32 | 8.2.2 a)–b) | The process shall: a) define the impact types and criteria relevant to the organization's context; b) identify the activities that support the provision of products and services; | Are relevant impact criteria and supporting activities identified? Examples include financial, legal, reputational and safety impacts. Yes, to the necessary extent under 8.1: BIA criteria and activity inventories linked to products and services. | Yes | — | ||||||||||||||||||||||
33 | 8.2.2 c) | […] use the impact types and criteria for assessing the impacts over time resulting from the disruption of these activities; | Are impacts assessed as they develop over time? Yes, to the necessary extent under 8.1: time-based BIA results with supporting reasons, for example at 2, 8, 24 and 72 hours. The organization selects suitable intervals; a single severity rating is insufficient. | Yes | — | ||||||||||||||||||||||
34 | 8.2.2 d) | […] identify the time frame within which the impacts of not resuming activities would become unacceptable to the organization; | Is the time frame before impacts become unacceptable identified (MTPD)? Yes, to the necessary extent under 8.1: BIA values and reasons. For example, unacceptable contractual impacts after 24 hours. Derive the limit from business impacts, not current IT recovery speed. | Yes | — | ||||||||||||||||||||||
35 | 8.2.2 e) | […] set prioritized time frames within the time identified in d) for resuming disrupted activities at a specified minimum acceptable capacity; | Are recovery time frames (RTOs) set within MTPD with minimum acceptable capacity? Yes, to the necessary extent under 8.1: BIA values. For example, with a 24-hour MTPD, resume within 8 hours at 30% capacity. These numbers are examples, not standard requirements. | Yes | — | ||||||||||||||||||||||
36 | 8.2.2 f)–g) | […] use this analysis to identify prioritized activities; […] determine which resources are needed to support prioritized activities; | Are prioritized activities derived from BIA and their required resources identified? Yes, to the necessary extent under 8.1: priorities and resources such as people, data, workplaces, IT, equipment and materials. Priorities should follow the impact analysis. | Yes | — | ||||||||||||||||||||||
37 | 8.2.2 h) | […] determine the dependencies, including partners and suppliers, and interdependencies of prioritized activities. | Are internal/external dependencies, shared resources and single points of failure identified? Yes, to the necessary extent under 8.1: dependency maps or BIA outputs. For example, several activities rely on one provider or specialist team. | Yes | — | ||||||||||||||||||||||
38 | 8.2.3 a)–c) | The organization shall implement and maintain a risk assessment process. […] identify the risks of disruption to the organization's prioritized activities and to their required resources; […] analyse and evaluate the identified risks; […] determine which risks require treatment. | Are disruption risks to activities and resources assessed: people, sites, IT, connectivity, data and supplies? Is treatment need determined? Yes, to the necessary extent under 8.1: method, results and treatment priorities. These are disruption risks, not only BCMS risks under 6.1. | Yes | — | ||||||||||||||||||||||
39 | 8.3.1 | Based on the outputs from the business impact analysis and risk assessment, the organization shall identify and select business continuity strategies that consider options for before, during and after disruption. The business continuity strategies shall be comprised of one or more solutions. | Are strategies selected from BIA and risk assessment for before, during and after disruption? Yes, to the necessary extent under 8.1: decisions linked to BIA. Examples: an alternate supplier/site or manual processing. Clause 8.3 is not ISO 9001 design and cannot be excluded by that analogy. | Yes | — | ||||||||||||||||||||||
40 | 8.3.2 a)–f) | Identification shall be based on the extent to which strategies and solutions: […] meet the requirements to continue and recover prioritized activities within the identified time frames and agreed capacity; | Are options assessed for time/capacity requirements, activity protection, reduced disruption likelihood/duration, limited product/service impacts and resource availability? Yes, to the necessary extent under 8.1: option assessments or decision rationales covering these criteria. | Yes | — | ||||||||||||||||||||||
41 | 8.3.3 a)–c) | Selection shall be based on the extent to which strategies and solutions: […] consider the amount and type of risk the organization may or may not take; […] consider associated costs and benefits. | Do selected solutions meet time/capacity requirements and consider acceptable risk, costs and benefits? Yes, to the necessary extent under 8.1: selection rationale and management decisions. Low cost does not replace meeting BIA requirements. | Yes | — | ||||||||||||||||||||||
42 | 8.3.4 a)–h) | The organization shall determine the resource requirements to implement the selected business continuity solutions. The types of resources considered shall include, but not be limited to: […]. | Are people, information/data, premises/utilities, equipment/consumables, ICT, transport/logistics, finance, partners and suppliers considered? Yes, to the necessary extent under 8.1: resource needs and availability, including simultaneous demand from multiple activities. | Yes | — | ||||||||||||||||||||||
43 | 8.3.5 | The organization shall implement and maintain selected business continuity solutions so they can be activated when needed. | Are solutions actually implemented, maintained and ready to activate? Yes, to the necessary extent under 8.1: standby agreements, site availability, configurations and resource checks. A purchase plan alone does not demonstrate implementation. | Yes | — | ||||||||||||||||||||||
44 | 8.4.1 | The organization shall implement and maintain a response structure that will enable timely warning and communication to relevant interested parties. […] The organization shall identify and document business continuity plans and procedures based on the output of the selected strategies and solutions. | Is there a response structure with documented plans linked to selected solutions? Yes: plans/procedures for managing disruption and activating solutions. They should specify immediate steps, be flexible, focus on incident impacts, minimize those impacts and assign roles. | Yes | — | ||||||||||||||||||||||
45 | 8.4.2.1–8.4.2.2 | The organization shall implement and maintain a structure, identifying one or more teams responsible for responding to disruptions. […] The roles and responsibilities of each team and the relationships between the teams shall be clearly stated. | Are teams, responsibilities, authority, interfaces and escalation clear? Yes: roles in documented plans under 8.4.1 and 8.4.4.3. Examples include a crisis team, IT recovery and operational teams. A small organization may have one team. | Yes | — | ||||||||||||||||||||||
46 | 8.4.2.3 a)–e) | Collectively, the teams shall be competent to: […] assess the nature and extent of a disruption and its potential impact; […] establish priorities (using life safety as the first priority); | Can teams assess disruption, compare impacts with thresholds, activate a response, plan actions and prioritize? Life safety is the first priority. Yes: competence evidence under 7.2, such as scenario-exercise results and practical decision assessments. | Yes | — | ||||||||||||||||||||||
47 | 8.4.2.3 f)–h) | […] monitor the effects of the disruption and the organization's response; […] activate the business continuity solutions; […] communicate with relevant interested parties, authorities and the media. | Can teams monitor disruption and response, activate solutions and communicate with parties, authorities and media? Yes: competence evidence under 7.2, such as exercise results, coordinator assessments and spokesperson preparation. | Yes | — | ||||||||||||||||||||||
48 | 8.4.2.4 a)–b) | For each team there shall be: a) identified personnel and their alternates with the necessary responsibility, authority and competence […] b) documented procedures to guide their actions […]. | Are primary personnel and alternates designated? Yes: documented procedures for activation, operation, coordination and communication, team rosters in plans and competence evidence. Check arrangements when primary members are unavailable. | Yes | — | ||||||||||||||||||||||
49 | 8.4.3.1 a)–b) | The organization shall document and maintain procedures for: a) communicating internally and externally […] b) receiving, documenting and responding to communications from interested parties […]. | Are topics, timing, recipients and methods defined? Are incoming communications, including national/regional risk advisories, received, documented and addressed? Yes: procedures, contacts and recording arrangements; actual communication records when events occur. | Yes | — | ||||||||||||||||||||||
50 | 8.4.3.1 c)–e) | […] ensuring the availability of the means of communication during a disruption; […] facilitating structured communication with emergency responders; […] providing details of the organization’s media response following an incident, including a communications strategy; | Are communication means available during disruption? Are emergency-service coordination and media response defined? Yes: documented procedures, fallback channels, contacts, message approval and spokesperson arrangements. Test fallback communication in practice. | Yes | — | ||||||||||||||||||||||
51 | 8.4.3.1 f) | […] recording the details of the disruption, the actions taken and the decisions made. | Are disruption details, actions and decisions recorded? Yes: a recording procedure and logs when disruptions occur. If none occurred, check the prepared form/system and its exercise use; invented incident records are unnecessary. | Yes | — | ||||||||||||||||||||||
52 | 8.4.3.2 a) | Where applicable, the following shall also be considered and implemented: a) alerting interested parties potentially impacted by an actual or impending disruption; | Are potentially affected parties alerted to actual or impending disruption? Yes, when applicable: procedures under 8.4.3.1 and alert records when events occur. N/A requires justified absence of the need across relevant scenarios; no disruptions this year alone is insufficient. | Yes | |||||||||||||||||||||||
53 | 8.4.3.2 b) | […] ensuring appropriate coordination and communication between multiple responding organizations. | Is multi-organization response coordinated? Yes, when applicable: procedures, arrangements and joint-check results. N/A is possible only where scenarios involving multiple responding organizations are demonstrably absent. | Yes | |||||||||||||||||||||||
54 | 8.4.3.2; 8.5 | The warning and communication procedures shall be exercised as part of the organization’s exercise programme described in 8.5. | Are warning, contacts, fallback channels and communications exercised? Yes: formalized reports under 8.5 e), such as call-tree/message-delivery results and findings. This remains required even without real disruptions. | Yes | — | ||||||||||||||||||||||
55 | 8.4.4.1 | The organization shall document and maintain business continuity plans and procedures. […] The business continuity plans shall provide guidance and information to assist teams to respond to a disruption and to assist the organization with response and recovery. | Are current plans practically usable? Yes: continuity plans and procedures. IT disaster recovery may form part of the set but does not replace arrangements for business activities, people, supply and communication. | Yes | — | ||||||||||||||||||||||
56 | 8.4.4.2 a)–c) | Collectively, the business continuity plans shall contain: […] continue or recover prioritized activities within predetermined time frames; […] procedures to enable the delivery of products and services at agreed capacity; | Do plans collectively cover team actions, monitoring, activation thresholds/process and delivery at agreed capacity within required time frames? Yes: these details in the plan set. Check consistency with BIA, RTOs and selected solutions. | Yes | — | ||||||||||||||||||||||
57 | 8.4.4.2 d) | […] details to manage the immediate consequences of a disruption giving due regard to: 1) the welfare of individuals; 2) the prevention of further loss or unavailability of prioritized activities; 3) the impact on the environment. | Do plans address people’s welfare, further loss/unavailability and environmental impacts? Yes: relevant actions, such as safe shutdown, evacuation, staff support and spill prevention, matched to disruption scenarios. | Yes | — | ||||||||||||||||||||||
58 | 8.4.4.3 a)–d) | Each plan shall include: a) the purpose, scope and objectives; b) the roles and responsibilities of the team […] c) actions to implement the solutions; d) supporting information needed to activate […], operate, coordinate and communicate the team’s actions; | Does each plan contain purpose, scope, objectives, roles, solution actions and supporting information, including activation criteria? Yes: these sections in each plan, contacts, instructions and accessible supporting material. | Yes | — | ||||||||||||||||||||||
59 | 8.4.4.3 e)–h) | […] internal and external interdependencies; […] the resource requirements; […] the reporting requirements; […] a process for standing down. | Does each plan cover interdependencies, resources, reporting and standing down? Yes: plan details including decision authority and notifications. Coordinate stand-down with return from temporary arrangements under 8.4.5. | Yes | — | ||||||||||||||||||||||
60 | 8.4.4.3 | Each plan shall be usable and available at the time and place at which it is required. | Can plans be obtained if the office, network or key person is unavailable? Yes: current plans in accessible form. Evidence: offline/fallback copies, alternate-person access, readability and use in exercises. | Yes | — | ||||||||||||||||||||||
61 | 8.4.5 | The organization shall have documented processes to restore and return business activities from the temporary measures adopted during and after a disruption. | Is return from temporary measures to normal or a new stable state defined? Yes: documented processes for moving operations back, reconciling data, clearing backlogs and ending workarounds. This goes beyond initial activation of backup IT. | Yes | — | ||||||||||||||||||||||
62 | 8.5 | The organization shall implement and maintain a programme of exercising and testing to validate over time the effectiveness of its business continuity strategies and solutions. | Does the exercise/test programme validate strategies and solutions over time rather than one convenient scenario? Yes, to the necessary extent under 8.1: a programme or equivalent records; reports are mandatory under 8.5 e). Examples include site, connectivity, personnel and supplier loss. | Yes | — | ||||||||||||||||||||||
63 | 8.5 a)–d), g) | The organization shall conduct exercises and tests that: […] are based on appropriate scenarios that are well planned with clearly defined aims and objectives; […] are performed at planned intervals and when there are significant changes […]. | Are exercises aligned with objectives, developing teamwork, competence, confidence and knowledge and collectively validating strategies and solutions? Are they scheduled and triggered by significant changes? Yes: scenario/planning records under 8.1 and reports under 8.5 e). No universal annual frequency is prescribed. | Yes | — | ||||||||||||||||||||||
64 | 8.5 e) | […] produce formalized post-exercise reports that contain outcomes, recommendations and actions to implement improvements; | Do exercises/tests produce reports with outcomes, recommendations and improvement actions? Yes: formalized reports, such as actual recovery time, achieved capacity and gaps. An attendance list alone is insufficient. | Yes | — | ||||||||||||||||||||||
65 | 8.5 f) | […] are reviewed within the context of promoting continual improvement; […] The organization shall act on the results of its exercising and testing to implement changes and improvements. | Are results reviewed and necessary improvements implemented? Yes: reports with actions under 8.5 e) and implementation evidence under 8.1, such as updated plans, completed tasks and repeat checks. Reporting without follow-through is insufficient. | Yes | — | ||||||||||||||||||||||
66 | 8.6 a)–b) | […] evaluate the suitability, adequacy and effectiveness of its business impact analysis, risk assessment, strategies, solutions, plans and procedures; […] undertake evaluations through reviews, analysis, exercises, tests, post-incident reports and performance evaluations; | Is the whole analysis/solution/plan set evaluated for suitability, adequacy and effectiveness? Yes, to the necessary extent under 8.1 and 9.1: review, exercise, test, post-incident and performance-evaluation results. Checking document existence alone is insufficient. | Yes | — | ||||||||||||||||||||||
67 | 8.6 c)–d) | […] conduct evaluations of the business continuity capabilities of relevant partners and suppliers; […] evaluate compliance with applicable legal and regulatory requirements, industry best practices, and conformity with its own business continuity policy and objectives; | Are partner/supplier capabilities, legal/regulatory compliance, industry best practices and conformity with policy/objectives evaluated? Yes, to the necessary extent under 8.1/9.1: supplier assessments, joint tests and compliance checks. A supplier certificate alone does not prove required recovery time. | Yes | — | ||||||||||||||||||||||
68 | 8.6 e) | […] update documentation and procedures in a timely manner. These evaluations shall be conducted at planned intervals, after an incident or activation, and when significant changes occur. | Are evaluations scheduled and triggered by incidents/activation and significant changes? Is documentation updated promptly? Yes: updated documents and evaluation evidence to the necessary extent under 8.1/9.1. Check contact, site and dependency changes. | Yes | — | ||||||||||||||||||||||
69 | 9.1 a)–d) | The organization shall determine: a) what needs to be monitored and measured; […] when and by whom the monitoring and measuring shall be performed; […] when and by whom the results […] shall be analysed and evaluated. | Are monitoring subjects, valid methods, timing and responsibility for measurement, analysis and evaluation defined? A separate measurement plan is not prescribed. Evidence: indicator definitions, report settings, schedules and interviews, for example RTO achievement and resource readiness. | No | — | ||||||||||||||||||||||
70 | 9.1 | The organization shall retain appropriate documented information as evidence of the results. The organization shall evaluate the BCMS performance and the effectiveness of the BCMS. | Are actual results retained and BCMS performance/effectiveness evaluated? Yes: reports, dashboards, measurements and conclusions. For example, recovery in 6 hours against an 8-hour RTO with minimum service capacity confirmed. | Yes | — | ||||||||||||||||||||||
71 | 9.2.1 | The organization shall conduct internal audits at planned intervals […] whether the BCMS […] conforms to […] the organization's own requirements […] the requirements of this document; […] is effectively implemented and maintained. | Do planned audits assess the standard, internal requirements and effective BCMS implementation/maintenance? Yes: audit results and programme-implementation evidence under 9.2.2 e). Exercises test capability but do not by themselves replace system audits. | Yes | — | ||||||||||||||||||||||
72 | 9.2.2 a)–e) | […] plan, establish, implement and maintain an audit programme(s) […] retain documented information as evidence of the implementation of the audit programme(s) and the audit results; | Does the programme consider process importance and prior results? Are audit criteria/scope defined, objectivity/impartiality ensured and results reported to managers? Yes: programme or equivalent planning records, implementation evidence and audit results. | Yes | — | ||||||||||||||||||||||
73 | 9.2.2 f)–g) | […] ensure that any necessary corrective actions are taken without undue delay […] ensure that follow-up audit actions include the verification of the actions taken and the reporting of verification results. | Are nonconformities and causes addressed without undue delay, with actions verified and verification reported? Yes: corrective-action records under 10.1.3 and follow-up verification evidence. If none arose, assess the established arrangements. | Yes | — | ||||||||||||||||||||||
74 | 9.3.1 | Top management shall review the organization's BCMS, at planned intervals, to ensure its continuing suitability, adequacy and effectiveness. | Does top management review the BCMS at planned intervals? Yes: results under 9.3.3.2, such as meeting decisions or electronic review approval. A separately titled “BCMS review meeting” is not mandatory. | Yes | — | ||||||||||||||||||||||
75 | 9.3.2 a)–f) | The management review shall include consideration of: […] the status of actions from previous management reviews; […] changes in external and internal issues […] information on the BCMS performance, including trends […]. | Are previous actions, context, trends in nonconformities/actions, monitoring and audits, party feedback, policy/objective changes and procedures/resources for improvement considered? A separate consolidated input report is not prescribed. Evidence: review materials, discussion and references in decisions. | No | — | ||||||||||||||||||||||
76 | 9.3.2 g)–k) | […] information from the business impact analysis and risk assessment; […] output from the evaluation of business continuity documentation and capabilities […] risks or issues not adequately addressed in any previous risk assessment; […] lessons learned and actions arising from near-misses and disruptions; […] opportunities for continual improvement. | Are BIA, risks, documentation/capability evaluation, unaddressed risks, near-miss/disruption lessons and improvement opportunities considered? A separate input report is not mandatory. Evidence: review material, exercise results and discussion. Decisions are retained under 9.3.3.2. | No | — | ||||||||||||||||||||||
77 | 9.3.3.1 a)–d) | The outputs of the management review shall include decisions related to continual improvement opportunities and any need for changes to the BCMS to improve its efficiency and effectiveness […]. | Do decisions address scope, BIA/risk/strategy/solution/plan updates, procedures/controls and measurement of control effectiveness? Yes: documented results under 9.3.3.2. A conclusion that no change is needed should follow from reviewed information. | Yes | — | ||||||||||||||||||||||
78 | 9.3.3.2 | The organization shall retain documented information as evidence of the results of management reviews. It shall: a) communicate the results of the management review to relevant interested parties; b) take appropriate action relating to those results. | Are results retained, communicated and acted upon? Yes: minutes, reports or electronic decisions, plus communication and follow-through evidence. Owners and deadlines support implementation tracking. | Yes | — | ||||||||||||||||||||||
79 | 10.1.1 | The organization shall determine opportunities for improvement and implement necessary actions to achieve the intended outcomes of its BCMS. | Are improvement opportunities identified and necessary actions implemented? A separate improvement register is not prescribed. Evidence: completed changes, resolved problems and implemented exercise follow-up decisions. | No | — | ||||||||||||||||||||||
80 | 10.1.2 a)–b) | When a nonconformity occurs, the organization shall: a) react to the nonconformity […] b) evaluate the need for action to eliminate the cause(s) of the nonconformity, in order that it does not recur or occur elsewhere […]. | Are nonconformities controlled/corrected, consequences addressed and causes and similar issues examined? Yes, when cases exist: records under 10.1.3. Failure to meet RTO calls for cause assessment, not merely changing the target. | Yes | — | ||||||||||||||||||||||
81 | 10.1.2 c)–e) | […] implement any action needed; […] review the effectiveness of any corrective action taken; […] make changes to the BCMS, if necessary. Corrective actions shall be appropriate to the effects of the nonconformities encountered. | Are proportionate actions implemented, effectiveness reviewed and the BCMS changed where needed? Yes, when cases exist: records under 10.1.3, such as repeat recovery-test results. If no cases occurred, assess process readiness. | Yes | — | ||||||||||||||||||||||
82 | 10.1.3 a)–b) | The organization shall retain documented information as evidence of: a) the nature of the nonconformities and any subsequent actions taken; b) the results of any corrective action. | Are nonconformity details, subsequent actions and corrective-action results retained? Yes: nonconformity records, tickets or another record system. If no cases exist, do not invent records; assess recording arrangements and readiness. | Yes | — | ||||||||||||||||||||||
83 | 10.2 | The organization shall continually improve the suitability, adequacy and effectiveness of the BCMS, based on qualitative and quantitative measures. | Are qualitative/quantitative measures and analysis, evaluation and management-review outputs used to identify business/BCMS needs and opportunities? A separate improvement document is not prescribed. Evidence: recovery trends, resource readiness, changes and feedback. Underlying results are retained under 9.1/9.3. | No | — | ||||||||||||||||||||||
84 | |||||||||||||||||||||||||||
85 | |||||||||||||||||||||||||||
86 | |||||||||||||||||||||||||||
87 | |||||||||||||||||||||||||||
88 | |||||||||||||||||||||||||||
89 | |||||||||||||||||||||||||||
90 | |||||||||||||||||||||||||||
91 | |||||||||||||||||||||||||||
92 | |||||||||||||||||||||||||||
93 | |||||||||||||||||||||||||||
94 | |||||||||||||||||||||||||||
95 | |||||||||||||||||||||||||||
96 | |||||||||||||||||||||||||||
97 | |||||||||||||||||||||||||||
98 | |||||||||||||||||||||||||||
99 | |||||||||||||||||||||||||||
100 |