Free checklist

The ISO 22301 readiness checklist for growing companies

Forty-two plain-English checks covering what an ISO 22301 auditor will look at, from the business impact analysis through continuity strategies, plans, exercises and the audit itself. Written for companies without a resilience department.

Nine sections Scope, leadership, business impact analysis, risk, strategies, plans, exercising, monitoring and audit preparation.
Plain English Every check written the way an auditor would actually probe it, with RTO and RPO explained where they first appear.
Startup-sized What genuinely matters for a 5 to 250 person company, with the enterprise theatre left out.

Tick items off as you go: your progress saves automatically and helps us tailor any follow-up conversation. Anything you cannot tick is a conversation worth having.

1. Scope and context

Continuity starts with knowing which interruptions actually hurt.

The Business Continuity Management System (BCMS) scope names the products and services whose interruption hurts customers most, and it matches reality.
Interested parties and their continuity expectations are recorded, including customer recovery expectations, regulators and insurers.
Legal and contractual continuity obligations, including service level agreements, are listed in one place.
Your dependencies are mapped: people, premises, technology, information and suppliers.

2. Leadership and policy

Plans written by one person and read by nobody fail their first real test.

A business continuity policy exists, is approved and dated by leadership and has been communicated.
A named person owns the BCMS, and incident response roles are assigned with deputies for each.
Continuity objectives exist, are measurable and get reviewed.
Leadership takes part in exercises rather than only approving paperwork.

3. Business impact analysis

The BIA is to ISO 22301 what the risk assessment is to ISO 27001: the engine.

A documented business impact analysis (BIA) identifies your prioritised activities and how impact grows over time when each stops.
Each prioritised activity has a recovery time objective (RTO): how quickly it must be back.
Data loss tolerance is defined as a recovery point objective (RPO) for the systems that matter.
The resources each recovery needs are identified: people, systems, suppliers and workspace.
The BIA was reviewed within the last year and after any major change.

4. Risk assessment

What could take you down, and what you decided to do about it.

Disruption risks are assessed and owned: loss of premises, people, technology, information and suppliers.
Single points of failure are identified honestly, including the person who knows everything.
Each significant risk has a treatment decision, and accepted risks are signed off by someone entitled to accept them.
Risk decisions visibly connect to the continuity strategies you chose.

5. Continuity strategies and solutions

A strategy per prioritised activity, proportionate to how fast it must return.

Each prioritised activity has a continuity strategy that can plausibly meet its RTO.
Documented workarounds exist for the loss of critical systems, even if the workaround is manual.
Backup and restore arrangements match your RPO, and a restore has actually been tested.
Alternate working arrangements, remote or otherwise, have been validated rather than assumed.
Failure of a critical supplier has an answer: an alternative, an exit plan or a documented acceptance.

6. Plans and procedures

Written for the person on duty at two in the morning, not for the author.

Business continuity plans exist and are findable during a disruption, including an offline copy.
Plans state clear activation criteria and who is authorised to invoke them.
The response structure is defined: who leads, who communicates, who recovers what.
Communication templates exist for staff, customers, regulators and, if needed, media.
A newcomer could follow the plan without the author in the room.

7. Exercising and testing

The clause auditors probe hardest, because untested plans are fiction.

An exercise programme exists with a schedule someone owns.
At least one exercise has been conducted, with records of scenario, participants and findings.
Exercises grow in realism over time, from tabletop discussion towards simulation.
Lessons from exercises visibly change the plans, with evidence.
The people with roles know them without reading the plan cover to cover.

8. Monitoring, internal audit and management review

The clauses that prove the BCMS runs, rather than merely exists.

You measure something meaningful: exercises completed, findings closed, restore tests passed.
An internal audit has been performed by someone independent of the work, with a report.
Findings have corrections, root causes and corrective actions, with evidence of closure.
Management review covers the required inputs and produces decisions.
Real disruptions, however small, get a post-incident review that feeds the system.

9. Certification audit preparation

What makes the certification body's visit boring, which is the goal.

You have quotes from accredited certification bodies and understand the Stage 1 and Stage 2 structure.
The BCMS has run long enough to have evidence: exercises held, reviews minuted, actions closed.
The people who own plans and activities can each speak to their part without a script.
If you hold ISO 27001, the shared management system clauses are integrated rather than duplicated.
An independent readiness or internal audit has been done, so Stage 2 holds no surprises.

What to do with the gaps

Anything unticked is normal: that is what a gap analysis is for. If you want a prioritised, fixed-price plan for closing them, book a free introductory call or try the cost calculator to get a tailored estimate. The ISO 22301 consultancy page explains how we work.