How do you start an ISO 22301 implementation?

Launching an ISO 22301 implementation means framing a programme that will produce a usable, maintainable BCMS. The first step is understanding the organisation and its context: activities, dependencies, regulatory constraints, stakeholder expectations and external factors. This analysis defines a coherent scope — avoiding both ignored critical dependencies and an unrealistic remit.

The second step is analysing the existing system: identifying what is already in place — continuity plans, incident management, crisis management, disaster recovery, cyber arrangements, exercises, documentation and governance. The aim is to measure gaps, reuse what works, and set build priorities.

The launch then requires leadership commitment. Responsibilities must be clarified, key roles named, and business continuity objectives set. The continuity policy formalises the expected framework and guides decisions. At this stage an implementation plan is essential: milestones, resources, deliverables, change management and control of documented information.

Finally, the launch prepares the operational work: business impact analysis, risk assessment, strategy definition, drafting of plans and procedures, and the organisation of exercises. A solid start is recognisable by explicit governance, a defensible scope, and deliverables prioritised according to impacts and risks.