Business continuity management
Business continuity management supplies the recovery plans, the impact analysis and the exercise discipline that make the resource decisions in 5.7 testable rather than theoretical.
This annex is informative. Annex A names the discipline and does not define it. A finding cannot rest on the annex alone. The guidance it supports is clause 5.8, and the evidence on this page is our interpretation of what that support looks like in practice.
What Annex A says
Annex A names business continuity management as a supporting discipline. The standard does not set its scope or require a particular continuity standard. The contribution to clause 5.8 is concrete: identify the core services, analyse the impact of their loss over time, choose the recovery strategy, and prove it works. That work produces the predetermined acceptable service level that 5.7 refers to, and it gives the resilience assessment a set of services to organise around.
Why it matters
Continuity work can become a document factory. The resilience value comes from three things: a small number of services that genuinely matter, recovery objectives that the business has agreed rather than the continuity team invented, and exercises that change something. A plan that has never been exercised is a hypothesis. The discipline also feeds the learning loop in 5.9: every exercise and incident should produce a change, not only a report.
What good looks like
Agree the core service list with the executive owner. For each, record the maximum tolerable disruption and the recovery objective. Choose the strategy and record its dependencies on suppliers, systems and people. Exercise at least one service a year, including a decision exercise for the people who would be in charge. Record the changes the exercise produced and track them to closure.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask when the plan was last exercised and what changed as a result. A plan with no exercise and no change is a document, not a capability.
- Business impact analysis The core services, the impact over time and the agreed recovery objectives
- Continuity plans The recovery strategy, dependencies, roles and call trees for each core service
- Exercise record The scenario, participants, observations and changes made
- Service level agreement The predetermined acceptable service level agreed with the service owner
Where it commonly fails
- The plan covers every process and prioritises none.
- Recovery objectives are set by the continuity team without the service owner.
- Exercises are walkthroughs that never test a decision or a dependency.
What to do before the second edition
Exercise the service the organization would miss most, with the people who would actually be on duty. Stop the exercise when a decision stalls and record why. Fix that before writing another plan.
Read across
- 5.7 Availability of resources
- 5.8 Development and coordination of management disciplines
- 5.9 Supporting continual improvement
- 6.3.2 Review