Is Your Business Continuity Plan Actually a Plan, or Just a Document?

Most organizations have a business continuity plan. Very few have actually tested whether it works.

If you’re responsible for operational resilience, you’ve probably been through this at least once: a crisis hits, someone opens the business continuity plan, and within minutes it’s clear the document was written for a world that no longer exists. The contacts are outdated. The recovery steps assume systems that have been replaced. The person listed as the BCP owner left the company two years ago.

ISO 22301 exists precisely to prevent this scenario. But only when it’s implemented seriously — not just to produce a certificate.

What ISO 22301 Actually Requires

ISO 22301 is the international standard for Business Continuity Management Systems (BCMS). It doesn’t just ask you to write a plan. It asks you to build, maintain, and continuously improve a management system that ensures critical business functions can survive disruption.

The standard is built around a few core pillars:

Business Impact Analysis (BIA) is where everything starts. Before writing a single recovery procedure, you need to understand which business processes are critical, how long they can be unavailable before causing serious harm, and what resources they depend on. Without a solid BIA, you’re essentially guessing at priorities.

Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) must be defined per process — not as a blanket statement. “We aim to recover within 24 hours” means nothing if your payment processing team has a 4-hour threshold and your HR portal can wait a week.

Incident response and escalation procedures need to be clear, short, and usable under pressure. If your on-call team needs to read a 60-page document during a crisis, the procedure has already failed.

Exercise and testing is the part most organizations skip. ISO 22301 requires not just that plans exist, but that they are tested, results are documented, and gaps are remediated. A plan that hasn’t been tested is a hypothesis, not a plan.

Where Most Implementations Go Wrong

The most common failure isn’t technical — it’s organizational. Business continuity gets treated as a compliance checkbox rather than an operational discipline.

Plans are written once and forgotten. Organizations change constantly: new systems, new vendors, new teams, new offices. A BCP written 18 months ago reflects an organization that may no longer exist. Without a formal review cycle tied to change management, the plan drifts away from reality.

Scope is defined too narrowly. Many organizations build a BCP around IT disaster recovery and call it done. ISO 22301 covers the full organization — people, facilities, suppliers, and processes. A business can lose its primary office, lose a critical supplier, or face a public health crisis. IT recovery alone won’t address any of these.

The BIA is treated as a one-time exercise. Business processes evolve. The criticality of a specific function today may be very different from what it was when the BIA was first conducted. A static BIA gives you a false sense of precision.

Testing is superficial. A tabletop exercise where participants discuss what they would do is a start, but it’s not enough. ISO 22301 expects progressively rigorous testing — from walkthroughs to functional exercises to full simulations. If your last test was a meeting room discussion, you don’t yet know whether your plan works.

The Overlap With Other Frameworks You’re Already Managing

If your organization is already working with ISO 27001, DORA, or similar frameworks, a significant amount of ISO 22301 groundwork is already in place.

ISO 27001 covers information security risks and includes requirements around availability and incident response. The risk assessment methodology, documentation structure, and internal audit process are all directly applicable to ISO 22301.

DORA (EU Digital Operational Resilience Act) places resilience testing and third-party risk management at the center of its requirements. The overlap with ISO 22301’s exercise requirements and supply chain continuity provisions is substantial. Organizations managing both frameworks in silos are duplicating effort unnecessarily.

Third-party risk management appears in all three. Your critical suppliers are part of your continuity posture. A single, well-structured vendor assessment process can satisfy requirements across ISO 22301, ISO 27001, and DORA simultaneously.

The organizations that struggle most are those that manage each framework as a separate project with a separate team. The ones that manage resilience well treat it as a single discipline with multiple compliance outputs.

What “Good” Actually Looks Like

A mature ISO 22301 implementation has a few recognizable characteristics.

Recovery objectives are owned by the business, not by IT. The teams responsible for critical processes have defined what they need to recover and by when — and those numbers have been validated against technical capability. There are no surprises on either side.

The BCP is a living document with a real owner and a real review schedule. Changes to critical systems, key personnel, or supplier relationships trigger a review — not just the annual audit cycle.

Exercises happen regularly, at increasing levels of complexity. Results are treated seriously. Findings generate remediation tasks that are tracked to closure.

Leadership is engaged. Business continuity isn’t something that only matters to the IT or risk team. Senior management understands the organization’s recovery posture, approves the objectives, and participates in major exercises.

The Certificate Is Not the Goal

ISO 22301 certification demonstrates that your BCMS has been assessed against the standard. It’s a useful signal — to customers, regulators, and partners — that your organization takes continuity seriously.

But the certificate is a lagging indicator. The real measure of your BCMS is what happens when something goes wrong. Organizations that treat the standard as a framework for genuine operational resilience, rather than a documentation exercise, are the ones that perform under pressure.

The question worth asking isn’t “are we certified?” It’s “if we lost our primary data center, our key supplier, or our main office tomorrow — do we know exactly what to do, and have we proven it works?”

If the answer is uncertain, that’s where the work begins.

Whether you’re starting your ISO 22301 journey or looking to improve an existing BCMS, our team is ready to support you. Contact us at sales@c4sec.com