01 · 1990s–2006
Continuity professionalisation
Financial, infrastructure and technology disruptions drove formal business-impact analysis and continuity standards, including BS 25999.
ASSURANCE DNA · BUSINESS CONTINUITY
ISO 22301
A business-continuity management system that identifies priority activities, interruption tolerances, response capability and exercised recovery.
What must continue, at what minimum level, for how long, and through whose exercised capability?
REFERENCEISO 22301:2019 + Amendment 1:2024CURRENT STATE · 21 AUG 2026The 2019 edition remains published; ISO lists a successor project in development.BID ENTRYCapture · Map · Assemble · Model · Story · Evidence · Mobilise · Measure
It is wider than disaster recovery and more demanding than a generic plan. Contract-specific recovery still depends on real capacity, dependencies and exercises. Source-bounded interpretation: no certification, protected text reproduction or award prediction.
LIVING EXPERIMENT · DISRUPTION
The Disruption Laboratory
A service pathway is interrupted at selectable points. Recovery claims only reconnect the route when time objectives, dependencies, owners and exercised evidence agree.
MODEL STATESME · SENSE · APPLYDeterministic teaching model · no award prediction
ORIGIN × EVOLUTION × CURRENT PRACTICE
Why this reference exists—and what changed.
Critical infrastructure, technology, outsourcing, health, finance, logistics and public-service providers where disruption affects essential outcomes.
02 · 2012
First ISO 22301 edition
ISO created international certifiable requirements for societal security and business continuity.
03 · 2019
Second edition
The current edition clarified structure and requirements for planning, operation, evaluation and improvement.
04 · 2024–2026
Climate amendment and revision work
A climate amendment was published in 2024; ISO records a successor project in development.
A generic continuity plan does not validate a contract-specific recovery promise. Capacity, dependencies and exercise results must match the proposed service.
OFFICIAL SOURCE FRESHNESS MONITOR
SOURCE CHECK PENDING
Monthly official-source reachability and change review.
LAST SOURCE CHECKloading…
What this date means
The check records source reachability and a content fingerprint. It does not silently change the page or claim that an edition changed.
PUBLICLY DESCRIBABLE ANATOMY
Every domain gets a specific bid-management translation.
These are navigational interpretations, not substitute clauses. Use the official publication for normative wording.
- 01
Continuity context and scope
Define continuity scope around the products, services, locations, technology and partners that sustain the promised buyer outcome.
- Evidence object
- Contract BCMS scope and priority-service map
- Decision test
- Does scope include transition and single points of failure outside the bidder?
- 02
Leadership and continuity policy
Name continuity leadership, policy, authority and resources before recovery promises are written.
- Evidence object
- Continuity governance and escalation map
- Decision test
- Who may invoke, prioritise and fund the response?
- 03
Business impact analysis and risk assessment
Use impact analysis to define tolerances, minimum service, dependencies and recovery priorities.
- Evidence object
- Contract BIA and dependency register
- Decision test
- Are RTO and RPO derived from buyer impact rather than copied from corporate policy?
- 04
Continuity strategies and solutions
Design people, site, technology, supplier and data solutions that can meet the tolerances.
- Evidence object
- Continuity strategy and capacity evidence
- Decision test
- Is there enough alternate capacity when multiple contracts are disrupted?
- 05
Plans, procedures and communication
Create usable plans, communications, role cards and buyer interfaces.
- Evidence object
- Response and recovery playbook
- Decision test
- Can the plan be executed by named alternates without its author present?
- 06
Exercises, evaluation and management review
Exercise credible scenarios, record findings and review capability at management level.
- Evidence object
- Exercise objectives, results and action log
- Decision test
- Did the exercise test the hardest dependency or only demonstrate the known path?
- 07
Corrective action and continual improvement
Correct capability gaps and update solution, contract assumptions and training.
- Evidence object
- Exercise corrective-action closure
- Decision test
- Can the team show that a failed exercise changed recovery capability?
BEFORE × INTERVENTION × AFTER
Worked case · 24/7 public contact service
A fictional service has a two-hour maximum tolerable interruption and relies on telephony, CRM, identity, two sites and three critical suppliers.
Scenario evidence demonstrates design visibility, not future uptime.
What the team can observe
The response promises a 30-minute recovery because a cloud brochure says so; people, telephony routing and concurrent contract demand are absent.
What changes in the operating system
The team builds a contract BIA, maps end-to-end dependencies, proves alternate capacity and exercises a combined site-plus-identity failure.
The promise separates detection, invocation, minimum service and full recovery, with buyer communications and residual constraints made explicit.
PROPORTIONATE IMPLEMENTATION
Scale the control—not the integrity of the decision.
It is wider than disaster recovery and more demanding than a generic plan. Contract-specific recovery still depends on real capacity, dependencies and exercises.
WORKED CASEISO-22301–01Teaching scenario · no claimed outcome
Name priority deliverables, substitutes, contact routes and one tabletop interruption exercise.
Impact sheet, substitute plan, exercise notes
Reconcile buyer tolerances with solution capacity and critical-supplier recovery.
BIA, capacity test, supplier assurance
Model aggregated contract demand and exercise cross-service dependencies.
Portfolio BIA, exercise programme, action closure
SOURCE TRAIL · REVIEWED 21 AUG 2026
Trace each interpretation to its authority.
Publication status can change. Exact conformity questions belong with the current licensed publication and competent assurance.