ISO 22301 Self Assessment Checklist

ISO 22301
Self-assessment questionnaire
How ready are you?

This document has been designed to help you determine your company’s readiness for an ISO 22301 Business
Continuity Management System certification assessment. By completing this questionnaire, your results will
allow you to identify where you are in the process in relation to the main requirements of the standard.
Context of the organization

Have you determined the external and internal issues that Has continual improvement been considered?
are relevant to your organization’s purpose that affect your
ability to achieve the intended results of your Business
Continuity Management System (BCMS)?
Leadership
Has top management taken responsibility for the
Do you have a way of reviewing and monitoring changes to effectiveness of the BCMS and have they communicated
these issues on a regular basis? the importance of an effective BCMS?
Have you determined the needs and expectations of Have the policy and objectives for the BCMS, which are
interested parties that are relevant to the BCMS? Do you compatible with the context and strategic direction of the
review these on a regular basis? organization, been established and communicated?
Have you determined the scope of your BCMS and did Do the roles carry the authority for ensuring conformance
this take into account the external and internal issues, and reporting, as well as the responsibility?
interested parties and any activities performed by other
organizations? Has a program to ensure the BCMS achieves its outcomes,
requirements and objectives been developed and put in
Are you aware of the requirements of interested parties, place?
including regulatory, statutory and those of your
customers?
Have the risks and opportunities associated with these

issues and requirements been considered? Continued >>
ISO 22301 Business Continuity Management – Self-assessment questionnaire
Planning Operation – continued

Have the risks and opportunities that need to be addressed Is there a formal process for determining continuity
to ensure the BCMS can achieve its intended result(s) been objectives based on understanding the impact of disruptive
established? incidents?
Has the organization planned actions to address these risks Does the BIA enable prioritization of timeframes for
and opportunities and integrated them into the system resuming each activity (Recovery Time Objectives) and
processes? have minimum levels for resuming activities that have been
identified?
Have measureable business continuity (BC) objectives been
established, documented and communicated throughout Have these actions been documented?
the organization with a plan to achieve them?
Is the BC strategy based on the outputs of the BIA and risk
assessment?
Support Does the BC strategy protect prioritized activities and
Has the organization determined and provided the provide appropriate continuity and recovery of them,
resources needed for the establishment, implementation, their dependencies and resources?
maintenance and continual improvement of the BCMS
(including people, infrastructure and environment for the Does the BC strategy provide for mitigating, responding to
operation of processes)? and managing impacts?
Are these processes consistent with the personnel in Have prioritized time frames been set for the resumption of
the defined BCMS roles? all activities?
Has the organization determined the knowledge necessary Have the BC capabilities of suppliers been evaluated and
for those performing BCMS roles? mitigated?
Has the organization ensured that those persons who can Have the resource requirements for the selected strategy
affect the performance and effectiveness of the BCMS are options been determined, including people, information
competent on the basis of appropriate education, training and data, infrastructure, facilities, consumables, IT,
or experience, or has action been taken to ensure that transport, finance and partner/supplier services?
those persons can gain the necessary competence?
Have measures to reduce the likelihood, duration or
Has the documented information required by the standard impact of a disruption for identified risks been considered
and necessary for the effective implementation and and implemented, and are these in accordance with the
operation of the ISMS been established? organization’s risk appetite?
Is the documented information controlled in a way that it Have documented BC procedures been put in place
is available and adequately protected, distributed, stored, to manage a disruptive incident, and have continuity
retained and under change control, including documents activities based on recovery objectives been identifed in
of external origin required by the organization for the the BIA?
BCMS?
Have internal and external communication protocols been
established as part of these procedures?
Operation Is there an Incident Response Structure (IRS) which details
Have you devised and implemented a program to ensure the management structure and trained personnel in place
the BCMS achieves its outcomes? to respond to a disruptive incident?
Is there a plan for the determining the need for changes to Does the IRS and associated procedures include
the BCMS and managing their implementation? thresholds, assessment, activation, resource provision and
communication?
When changes are planned, are they carried out in a
controlled way and actions taken to mitigate any adverse Do the people in your IRS have the necessary
effects? competencies to perform their duties and are records kept
to demonstrate this?
If you have outsourced processes, are they
appropriately controlled? Is there a procedure for detecting and monitoring
incidents, which includes recording vital information,
Is there a formal and documented process for actions taken and decisions made?
understanding the organization through a Business Impact
Analysis (BIA)?
Continued >>
ISO 22301 Business Continuity Management – Self-assessment questionnaire
Operation – continued Performance evaluation – continued

Is there a procedure for managing internal and external Are results of these audits reported to management,
communications during a disruptive incident? documented and retained?
Is there a procedure for receiving and responding Where nonconformities are identified, has the organization
to warnings from outside agencies and emergency established appropriate processes for managing
responders? nonconformities and the related corrective actions?
Is there a procedure for issuing alerts and warnings and is Does top management undertake regular and periodic
this communication regularly exercised and records kept reviews of the BCMS?
of the results?
Does the output from the BCMS management review
Are there documented plans/procedures for restoring identify changes and improvements?
business operations after an incident? Do they reflect
the needs of those who will use them and contain all the Are the results of the management review documented,
essential information they need? acted upon and communicated to interested parties as
appropriate?
Do the plans define roles and responsibilities and a
process for activating the response? Where nonconformities are identified, has the organization
put in place appropriate processes for managing
Do the plans consider the management of the immediate nonconformities and the related corrective actions?
consequences of a disruption, in particular the welfare
of individuals, options for response and further loss
prevention? Improvement
Have actions to control, correct and deal with the
Do the plans detail how to communicate with interested
consequences of nonconformities been identified?
parties, including the media, during the disruption and
how to prioritize activities? Has the need for action been evaluated to eliminate the
Do the plans include a procedure for standing down the root cause of nonconformities to prevent reoccurrence?
response and returning to normal business? Have any actions identified been implemented and
Have the business continuity procedures been tested, reviewed for effectiveness and given rise to improvements
at planned intervals and with appropriate scenarios to to the BCMS?
ensure they are consistent with your BCM objectives? Is documented information kept as evidence of the nature
Have formal post-exercise reports been produced for of nonconformities, actions taken and the results?
the tests and outcomes reviewed to ensure they lead to
improvement?
At BSI, we create excellence

Performance evaluation by driving the success of our
Have you determined what needs to be monitored and
measured, when, by whom, the methods to be used, and
clients through standards. We help
when the results will be evaluated? organizations to embed resilience,
Are the results of monitoring and measurement grow sustainably, adapt to change
documented? and prosper for the long term.
Are internal audits conducted periodically to check
that the BCMS is effective and conforms to both We make excellence a habit.
ISO 22301:2014 and the organization’s requirements?
Has the organization established a program for internal

audits of the BCMS?
BSI/USA/547/MS/0616/E
Find out more

Call: 1 800 862 4977
© BSI Group
Visit: bsigroup.com/en-US

ISO 22301 Self Assessment Checklist

Uploaded by

Copyright:

Available Formats

ISO 22301 Self Assessment Checklist

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

ISO 22301 Self Assessment Checklist

Uploaded by

Copyright:

Available Formats

ISO 22301

How ready are you?

Context of the organization

Have the risks and opportunities associated with these

Planning Operation – continued

Operation – continued Performance evaluation – continued

At BSI, we create excellence

Has the organization established a program for internal

Find out more

You might also like