ISO 22301 Advice for Business Continuity

Understand critical business processes and prepare them for interruptions: We accompany the development of your business continuity management system.

Planning for restart and emergency preparedness in time.

Learn more

Business continuity

Business continuity management (BCM) helps organizations prepare for disruptions to critical business processes. Our ISO 22301 consultancy helps you to set up a Business Continuity Management System (BCMS), clarify responsibilities and make emergency preparedness plannable.

A Business Impact Analysis (BIA) shows which processes are particularly time-critical and which dependencies exist. From this, we jointly develop restart strategies, emergency plans and appropriate exercises. The results serve as a basis for further improvement and preparation for an independent certification audit.

The interfaces to Information security according to ISO 27001 and to IT security We take into account as well as the involvement in an Integrated management system.

Our services for your Business Continuity Management

In a free initial consultation, we first record your specific needs. On this basis, we develop an individual package of measures that is optimally tailored to the requirements of your company.

Our offer includes the implementation of an Business Continuity Management Systems (BCMS) according to ISO 22301, so that your essential business processes can be maintained even in crisis situations. Upon request, we integrate the BCMS into existing management structures, for example into an already existing information security management system (ISMS).

Depending on the focus, we also support you in fulfilling important regulatory requirements, such as the NIS 2 Directive or relevant BSI standardsIf they are relevant to your company. In addition, we offer training courses for your employees in order to permanently anchor awareness of the topics of business continuity and crisis prevention in the company.

Their advantages

Benefit from our cooperation

Security

Ensuring your business-critical processes deserves the utmost attention. A Business Continuity Management System (BCMS) according to ISO 22301 ensures that essential processes in an emergency can be protected and quickly restored.

Speed

Best practices and standardized practices ensure that potential gaps in your emergency and restart plans are quickly filled. This ensures a swift resumption of business operations in the event of disruptions.

Customer trust

A high level of operational security strengthens the trust between you and your customers. A professionally introduced BCMS demonstrates a sense of responsibility and promotes the long-term commitment of your business partners.

Integrative approach

We either integrate the new regulations into your existing organizational and documentation structures or provide you with a suitable platform if necessary. In this way, we ensure that your BCMS is seamlessly embedded in your company.

Personal support on site

Unlike many of our competitors, we are personally at your side whenever you need us.

Procedure for Business Continuity Advice

Our experienced business continuity management consultants are well-versed in the specific risks, regulatory requirements and challenges faced by SMEs, large corporations and public institutions. Whether it is NIS2, banks and insurance companies, KRITIS, telecommunications or the health sector – we provide you with cross-industry advice and sound advice on the introduction or optimization of your business. BCMS according to ISO 22301. Benefit from our many years of expertise to future-proof your company and protect it against potential threats.

1. Setup

Together with your management and the relevant departments, we determine which measures are necessary to ensure the continuation of your essential business processes. The focus is on risk identification and assessment, so that the business continuity concept is oriented exactly to the requirements of your company – in accordance with ISO 22301.

2. Analysis

Our team analyzes your central business processes, resources and infrastructure in detail. Instead of just looking at formal requirements, we create a holistic risk assessment. This gives you a well-founded picture of the possible disruptive scenarios and the resulting requirements for a functioning Business Continuity Management (BCM).

3. Concept

Based on the analysis, we develop a tailor-made business continuity concept. In it, we determine which strategies and measures must be taken in the event of an emergency in order to restore your operation as quickly as possible or to continue business operations without major interruptions. They always retain the decision-making power over the final priorities and implementation steps.

4. Solution

We derive the appropriate measures – from short-term emergency measures to long-term prevention strategies. We consider not only technical, but also organizational, personnel and infrastructural aspects. The goal: a robust resilience to the identified risks, which can be seamlessly integrated into your company.

5. Reporting

Our experts accompany you in the practical implementation and monitor the transition to regular operation. With regular reports and a complete documentation, you always stay in the picture. We also ensure that any vulnerabilities are quickly detected and fixed so that your BCMS is continuously improved.

6. Advisory services

Through ongoing reviews as part of a continuous improvement process (CIP), we ensure that your BCMS remains up-to-date and can respond to new threats or changed business structures. From planning and implementation to the ongoing maintenance of your BCMS in accordance with ISO 22301 – we support you as a reliable partner and consultant to make your company sustainable crisis-proof.

Frequently Asked Questions on Business Continuity, BCMS & ISO 22301

What is Business Continuity Management (BCM) and why is it so important?

Business continuity management (BCM) is a systematic approach that ensures that critical business processes in an organization can be maintained or restored as quickly as possible, even in the event of disruptions or crisis situations. This is not only about technical measures, but above all about organizational structures, processes and roles. The aim is to assess the effects of emergencies (e.g. B. Reduce natural disasters, cyberattacks, pandemics to a tolerable level. The importance of BCM is particularly evident in today’s increasingly connected business world, where downtime can cause significant financial and reputational damage.

ISO 22301 is an international standard that defines requirements for a systematic Business Continuity Management System (BCMS). It specifies how organizations can protect and maintain their essential functions and processes. By implementing ISO-22301-compliant measures, companies create:

  • Structure and clarityA clearly defined framework helps to establish responsibilities and processes for emergency and crisis situations.
  • Trust with stakeholdersCustomers, business partners and authorities see in the certification according to ISO 22301 that a robust BCM is available.
  • Risk minimisation: Regular analyses can be used to identify and remedy weaknesses at an early stage.
  • Competitive advantageSolid preparation and rapid responsiveness can ensure business operations in an emergency and reduce downtime costs.

ISO 27001 is an international standard for information security management systems (ISMS). Although ISO 22301 focuses mainly on maintaining business processes in case of crisis and ISO 27001 on information security, there is a lot of overlap. These include:

  • Risk analysisBoth standards rely on systematic risk analysis to identify and address weaknesses.
  • Management processesBoth standards are based on the Plan-Do-Check-Act (PDCA) cycle and require continuous improvement.
  • Documentation requirements: Both the implementation of an ISMS and a BCMS require extensive documentation and proof obligations.
  • Information security interfaceBusiness continuity also includes the availability of IT systems. Close coordination with the ISMS is essential here.


By implementing both standards in an integrated management system, synergy effects can be exploited, redundant processes reduced and overall efficiency increased.

A BCMS is a structured framework of policies, processes, operations and responsibilities that helps organizations be prepared for and respond appropriately to disruptions and crisis situations. It shall include, inter alia:

  1. Analysis of business processes (Business Impact Analysis, BIA) to identify critical processes.
  2. Risk assessment to identify potential threats and their impact.
  3. Strategies and plans for emergency response, restoration and continuous maintenance of essential functions.
  4. Continuous review and improvementExercises and audits ensure that plans remain up-to-date and vulnerabilities are addressed.


With a BCMS in accordance with ISO 22301, companies create the basis to act in a structured and effective manner in an emergency and thus minimize economic losses and reputational damage.

Business Impact Analysis (BIA) is an essential part of business continuity management. It serves to identify all relevant business processes and to evaluate their criticality. The BIA examines the following aspects:

  • Process dependencies: Which processes depend on each other?
  • Possible damageWhat happens if a certain process fails (financial, reputational, legal or regulatory damage)?
  • Recovery priorities: Which processes need to be restored first and within what time span?


The results of the BIA form the basis for the development of tailor-made emergency and recovery plans. Only those who can realistically assess the consequences of failures can define effective continuity strategies.

Risk management complements BIA and is a key element in any BCM approach. The systematic identification, evaluation and treatment of risks enables preventive measures to be taken before failures occur. Typical steps are:

  1. Hazard analysis (e.g.) B. Cyber risks, natural disasters, supply shortages.
  2. Classification by probability and effect.
  3. Risk treatment: Implementation of risk mitigation, prevention or acceptance measures.
  4. Monitoring and review: Continuous adaptation of measures to changing framework conditions.

Through sound risk management, companies can not only better manage crises, but ideally also avoid them altogether.

An ISO 27001 ISMS focuses on protecting information assets and IT systems, while a BCMS covers the organizational and procedural maintenance of the entire business. The integration has the following advantages:

  • Common management framework: Both systems follow the PDCA cycle and can therefore be well bundled into one management system.
  • Same or similar documentation requirementsHazard documentation, risk analyses and internal audits can be partially combined.
  • Increased efficiencyDuplicate processes and overlaps are reduced, which saves time and costs.
  • Better coverage of all business areasAn integrated management system covers both information security and business continuity, ensuring comprehensive risk management.

Central factors in the introduction of a BCMS are:

  1. Management supportManagement must recognize the importance of BCM and provide resources.
  2. Culture and awarenessEmployees must be trained and sensitized in order to understand their role in an emergency.
  3. Clear roles and responsibilities: Who coordinates the emergency exercises, who is the contact for external service providers, etc.?
  4. Continuous updatingBusiness processes and risks are changing, so BCM plans need to be updated regularly.
  5. Exercises and tests: Only through realistic emergency or crisis simulations can the effectiveness of plans be checked and improved.

Careful planning and structured implementation are essential so that the BCMS does not only exist on paper, but actually works in an emergency.

Certification according to ISO 22301 takes place in several steps:

  1. Preparatory phase: Gap analysis is carried out here and the BCMS is set up.
  2. Internal audits: verification of the system for conformity with the standard and internal optimisation.
  3. Certification Audit – Level 1 (Document Examination)An auditor first evaluates the documentation (e.g. B. BIA, risk assessments, contingency plans.
  4. Certification audit – Level 2 (on-site inspection)The auditor checks the practical implementation in the company, conducts interviews and visual inspections.
  5. Certificate issuanceIf the audit is successful, a certificate is issued which is usually valid for three years. Monitoring audits are carried out annually to check continuous conformity.


Through ISO-22301 certification, companies demonstrate that they are systematically prepared for an emergency.

BCM plans should be reviewed and adjusted regularly, but at least once a year or when significant changes occur in the company or environment, such as:

  • Organisational changes (Reorganisations, new locations).
  • Technological changes (new IT systems, cloud migration).
  • New or altered threats (e.g.) B. new cyber risks, geopolitical risks.

In addition to document revisions, periodic intervals (e.g. b. half-yearly or annually) exercises and tests are carried out to check the effectiveness of the plans. The more realistic the simulations are, the more meaningful the results are for the further development of the BCMS.

When implementing a BCMS, organizations often encounter the following hurdles:

  1. Underestimation of effortAn effective BCM is complex and requires time, resources and management commitment.
  2. Resistance of employeesChanges to process flows or additional documentation obligations are not always directly accepted.
  3. Lack of risk and awareness trainingEmployees must be trained to act correctly in an emergency.
  4. Lack of integration into existing systemsA BCMS without coordination with the ISMS or other management systems leads to duplication of work and redundancies.
  5. Unclear responsibilities: It must be possible to act quickly in crisis situations. An unexplained distribution of roles slows down effective action.

In order to overcome these hurdles, clear communication and structured project management are essential.

By integrating a BCMS into an ISMS, companies benefit from:

  • Holistic viewBoth standards complement each other (BCM for process continuity, ISMS for information security).
  • Reduction of duplication of workRisk analyses, documentation and audits can be combined.
  • Optimised resources: Shared budgets and teams ensure more effective management.
  • Increased compliance: Organizations meet several standard requirements at the same time and can thus comply with regulatory requirements more securely.
  • Strengthening security awarenessEmployees internalize both the requirements of security and continuity processes.

Integrated management systems increase overall efficiency and ensure the ability to act in critical situations.

Typically, the following roles are defined in Business Continuity Management:

  1. BCM controller (BCM Manager): Coordinates the implementation and maintenance of the BCMS, plans exercises and audits.
  2. Crisis Management Unit: A team of managers and experts who take over operational and strategic control in the event of a crisis.
  3. Specialist responsibleResponsible for the continuity plans in their respective departments (e.g. B. IT, production, personnel.
  4. PersonnelAre informed about emergency and evacuation plans and know their tasks in a crisis.
  5. External consultants (optional): Support in standard interpretation, conducting audits and training.

A clear definition of responsibilities and communication channels is crucial for being able to act efficiently in an emergency.

The success of a BCMS can be measured by several indicators:

  • Time to restore (Recovery Time Objective, RTO): How quickly can critical processes be restored?
  • Availability of critical resources (Recovery Point Objective, RPO): How much data can be lost without endangering business operations?
  • Number and quality of emergency drillsHow often are exercises performed and how realistic are they? How were deficiencies corrected?
  • Audit results: What discrepancies have internal and external audits detected?
  • employee feedback: How safe do employees feel when dealing with emergency scenarios?


A BCM should be continuously improved. The measurement of these parameters shows whether the set goals are achieved and where there is a need for optimization.

Although BCM and IT Emergency Management are often closely linked, there are differences in focus:

  • BCM: Holistically deals with the maintenance of all critical business processes in all corporate areas (e.g. B. Production, logistics, personnel, sales.
  • IT Emergency ManagementFocuses primarily on the recovery of IT systems, data and infrastructures after a failure or cyberattack.


BCM is therefore higher-ranking and includes IT emergency management as an important component. Ideally, both concepts are closely interlinked in order to ensure smooth operation in the event of a crisis.

Key documents in a BCMS according to ISO 22301 include:

  1. BCM policyPrinciples and objectives for Business Continuity Management.
  2. Business Impact Analysis (BIA): Identification and evaluation of business critical processes.
  3. Risk assessment: Description and assessment of relevant risks.
  4. Business continuity strategyGuidance on how to maintain business operations in crises.
  5. Emergency and contingency plans: Detailed processes for different scenarios (e.g. B. IT failure, fire, natural disaster.
  6. Exercise and test protocolsEvidence of exercises performed, test results and improvement measures.
  7. Communication plans: Description of how and by what means internally and externally in the event of a crisis is communicated.


These documents are regularly updated and form the basis for a successful implementation of the BCMS.

To successfully conduct an emergency test, companies should pay attention to the following:

  1. Realistic scenarios: The exercises should realistically depict typical hazards and crisis scenarios.
  2. Extensive planningRoles, processes and communication paths must be clearly defined in advance.
  3. Transparency: All participants should be aware of the exercise intention and the desired learning effect.
  4. Detailed evaluation: Weaknesses and potential for improvement must be accurately documented.
  5. Binding measures: Improvements derived from test results should be implemented in a timely manner.


Regular emergency tests increase awareness and ensure that the emergency plans work even under stressful conditions.

Implementation of a BCMS can be complex and resource intensive. External consulting offers numerous advantages:

  • Experience and best practicesConsultants have usually already accompanied numerous BCM projects and bring valuable practical experience.
  • Neutral viewExternal experts can look more objectively at company processes and point out risks that may be overlooked internally.
  • Transfer of know-how: During the implementation, internal teams are trained and can later carry on the knowledge independently.
  • Time savings: An experienced consultant recognizes stumbling blocks at an early stage and thus accelerates the project progress.
  • Faster certification capability: Those seeking certification benefit from the expertise of consultants who are fully familiar with ISO requirements.


Especially for companies that do not yet have any experience with BCM, it is worthwhile to invest in external advice in order to reach their destination quickly and efficiently.

The establishment or extension of a BCMS makes sense in every phase. However, there are certain triggers for which an increased need for action becomes clear:

  • Significant changes in business: Mergers, acquisitions, new locations.
  • Increased compliance requirements: New legal requirements or industry standards.
  • Increase in crisis incidents: Increase of disruptions, hacker attacks or natural disasters.
  • After the introduction of an ISMS: Since a BCMS can be integrated well into the ISMS, it makes sense to coordinate both management systems with each other.

It is important that management recognizes the need and provides sufficient resources. An effective BCM is always an investment in the future security of the company.

A well-established and regularly maintained BCMS has numerous positive effects:

  1. Higher resilience: The company can react faster to unforeseen events and minimize business failures.
  2. Competitive advantageCustomers and partners trust more organizations that have a proven continuity strategy.
  3. Cost savings: Prevention is usually cheaper than coping with the consequences of crises.
  4. Positive imageProfessional crisis management strengthens the reputation and shows that the company is acting responsibly.
  5. Staff satisfactionEmployees feel safer and better prepared when they know that the company is prepared for emergencies.


Overall, a robust BCM increases the sustainability and future security of a company, as it not only reacts to acute risks, but also initiates a continuous improvement process.

Your experts in business continuity issues

Whether CISO, CIO, IT manager, IT manager or person responsible for crisis and emergency management – our experienced consultants for Business Continuity Management bring many years of practice and develop Customized solutions according to ISO 22301, which are exactly aligned to the requirements of your company.

  • Many years of experience in management systems with focus on ISO 9001, 14001, 27001, 27701, 22301 & GDPR
  • Advising for DAX & international companies, banks, authorities and the military on information security, data protection, business continuity, quality and environmental management
  • Implementation, auditing, certification & optimization of management systems
  • ISO 9001 Lead Auditor, ISO 14001 Lead Auditor
  • EMAS environmental verifier
  • ISO/IEC 27001 Lead Auditor, ISO/IEC 27001 Lead Implementer, ISO 22301 Lead Auditor
  • Data protection officer (TÜV), data protection auditor (TÜV).
  • Digital Transformation Manager (TÜV), Business Continuity Manager (TÜV).
  • PMP, PRINCE2, MSP, ITIL Expert, CISSP, CISSP-ISSAP, CISM
  • Development of training materials on IT security, management systems & compliance
  • Conference Speaker

Initial consultation free of charge

Do you want to introduce a Business Continuity Management System? We operate in Germany, Austria and Switzerland and support you.