ISO 22301:2019 Requirements: Clauses 4

This guide explains ISO 22301:2019 auditable requirements in Clauses 4–10. Clauses 1–3 (scope, references, terms) orient the reader; certification evidence focuses on the management system clauses below.

Related: What is ISO 22301 · Checklist · Hub.

HLS structure: 4 Context · 5 Leadership · 6 Planning · 7 Support · 8 Operation (incl. 8.5 exercises/testing) · 9 Performance evaluation · 10 Improvement. Unlike ISO 27001, ISO 22301 does not use an Annex A-style control catalogue.

Clause 4 — Context of the Organisation

Determine external and internal issues, understand interested-party requirements, and define the BCMS scope. Scope must be clear enough for auditors to know what is in and out of the management system.

Clause 5 — Leadership

Top management demonstrates commitment, establishes a business continuity policy, and assigns roles and authorities. Leadership is evidenced in decisions, resources, and management review — not only a signed policy PDF.

Clause 6 — Planning

Address risks and opportunities to the BCMS, set continuity objectives, and plan changes. Objectives should be consistent with policy and capable of evaluation.

Clause 7 — Support

Provide resources, competence, awareness, communication, and controlled documented information. Continuity fails when only a few specialists understand the plans.

Clause 8 — Operation

Operational planning and control for the BCMS typically include business impact analysis, risk assessment, strategy selection, and implementation of procedures and plans. Clause 8.5 requires exercising and testing to validate procedures and build competence — see BCP testing and exercises.

Clause 9 — Performance Evaluation

Monitor and measure BCMS performance, conduct internal audits, and hold management reviews. Evaluation proves the system is operating, not merely documented.

Clause 10 — Improvement

React to nonconformities with corrective action and continually improve the BCMS. Exercise findings and real incidents should drive tangible updates.

How CyberSilo Helps

BCMS programme artefacts — BIA, plans, exercise records — organised in Compliance Standards Automation
ThreatHawk SIEM / SOAR for detection, response evidence, and ICT continuity telemetry during disruption
Advisory scoping for certification readiness — contact CyberSilo

Evidence Clauses 4–10 Continuously

Organise BCMS records by clause in CyberSilo CSA ahead of Stage 1 and Stage 2.

Talk to CyberSilo ISO 22301 Hub

Frequently Asked Questions

Are there Annex A controls in ISO 22301 like ISO 27001?

ISO 22301 is structured around HLS clauses 4–10 for the BCMS. Unlike ISO 27001, it does not use an Annex A control catalogue.

What is special about 8.5?

It mandates exercises and testing of business continuity procedures — a frequent Stage 2 focus area.

Do Clauses 1–3 get audited?

Auditors use them for orientation; conformity assessment centres on Clauses 4–10 and effective implementation.

Certification process · BIA · 8.5 exercises · Hub