What is a BCMS, and what does ISO 22301 require to build one?

A BCMS is the organised set of policies, processes, responsibilities and resources that lets an organisation prepare for disruptive events and maintain its critical activities. ISO 22301:2019 provides the requirements to build this system coherently and verifiably, integrating governance, planning, operation and continual improvement.

In a BCMS, continuity is not reduced to a single plan. It rests on a management logic: understanding the context, defining scope and objectives, steering resources, controlling documented information, and putting control mechanisms in place. The BCMS ties together the key activities — business impact analysis, risk assessment, definition of continuity strategies, and the formalisation of response plans and procedures.

The ISO 22301 model follows a lifecycle. The organisation deploys arrangements, tests them through exercises, measures performance, runs internal audits and conducts management reviews. Nonconformities and gaps are treated and fed back into continual improvement, keeping the BCMS aligned with changing risks, the organisation and stakeholder requirements.

A well-implemented BCMS clarifies business priorities, recovery conditions, responsibilities under disruption and communication channels. It also helps demonstrate command of the subject during a certification audit — provided the elements are applied, tested and kept up to date.