ISO 22301:2019 · Business Continuity Management Systems
ISO 22301, run as a living management system.
ISO 22301 expects a living management system: impact analysis, recovery strategies, plans and exercises that stay current. ResiliencePilot covers the operational core (clauses 8.2 to 8.6) on one platform, with the evidence and sign-off an auditor expects.
From clause to evidence
Every clause has a home.
The operational heart of ISO 22301 (clauses 8.2 through 8.6), each mapped to a workflow that produces the evidence and sign-off an auditor traces.
8.2 Business impact analysis
Rank process criticality and set MTPD, RTO and RPO, with business-owner sign-off, feeding your recovery strategies directly.
8.2 Dependencies & resources
Map what each process depends on (suppliers, applications, infrastructure, people) with automatic single-point-of-failure detection.
8.3 Continuity strategies
Select a recovery strategy per process (from hot standby to cloud failover to manual fallback), each with an achievable RTO/RPO and cost.
8.4 Continuity plans
BCPs with activation criteria, roles, escalation and resources, pre-populated from your chosen strategy, not a blank Word file.
8.5 Exercise programme
Plan, run and evidence exercises with findings and corrective actions, tracked against the ISO 22301 lifecycle.
8.6 Evaluation of BC capabilities
Scheduled evaluation of your capabilities against the 8.1–8.5 outputs, with findings linked to corrective action.
Where rAIley helps with ISO 22301
rAIley suggests BIA ratings, drafts recovery strategies and test scenarios, and reviews your continuity plans for gaps, grounded in your own records and audit-logged. You stay the approver.
Frequently asked questions
- The operational core (8.2 through 8.6): business impact analysis, strategies, plans, exercises and evaluation.
- Yes. The same BIA, dependency and test evidence supports DORA ICT resilience and NIS2 continuity obligations on one platform. Maintain it once, reuse it across audits.
- Yes. You can't build a recovery strategy or approve a continuity plan for a process whose BIA isn't completed and signed off. The platform enforces the chain from impact analysis to strategy to plan.
- In the EU, on Microsoft Azure (Sweden Central). If you have specific residency requirements, talk to us.
Which ISO 22301 clauses does it cover?
Can we reuse this for DORA and NIS2?
Does a plan have to be based on a completed BIA?
Where is our data hosted?
Build your ISO 22301 BCMS in ResiliencePilot.
See it on your own data and frameworks, with your security and data-residency questions answered.