ISO 22301:2019: the evidence behind every control

57 controls. For each, the artefacts auditors ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

Context of the organization, ISO 22301:2019

4.1Understanding the organization and its context hard 4.2Understanding the needs and expectations of interested parties hard 4.2.1General hard 4.2.2Legal and regulatory requirements hard 4.3Determining the scope of the business continuity management system hard 4.3.1General moderate 4.3.2Scope of the business continuity management system moderate 4.4Business continuity management system hard

Leadership, ISO 22301:2019

5.1Leadership and commitment hard 5.2Policy hard 5.2.1Establishing the business continuity policy hard 5.2.2Communicating the business continuity policy hard 5.3Roles, responsibilities and authorities hard

Planning, ISO 22301:2019

6.1Actions to address risks and opportunities hard 6.1.1Determining risks and opportunities hard 6.1.2Addressing risks and opportunities hard 6.2Business continuity objectives and planning to achieve them hard 6.2.1Establishing business continuity objectives moderate 6.2.2Determining business continuity objectives hard 6.3Planning changes to the business continuity management system hard

Support, ISO 22301:2019

7.1Resources hard 7.2Competence hard 7.3Awareness hard 7.4Communication hard 7.5Documented information hard 7.5.1General hard 7.5.2Creating and updating hard 7.5.3Control of documented information hard

Operation, ISO 22301:2019

8.1Operational planning and control moderate 8.2Business impact analysis and risk assessment hard 8.2.1General hard 8.2.2Business impact analysis hard 8.2.3Risk assessment hard 8.3Business continuity strategies and solutions hard 8.3.1General hard 8.3.2Identification of strategies and solutions hard 8.3.3Selection of strategies and solutions hard 8.3.4Resource requirements hard 8.3.5Implementation of solutions hard 8.4Business continuity plans and procedures hard 8.4.1General hard 8.4.2Response structure hard 8.4.3Warning and communication hard 8.4.4Business continuity plans hard 8.4.5Recovery hard 8.5Exercise programme hard 8.6Evaluation of business continuity documentation and capabilities hard

Performance evaluation, ISO 22301:2019

9.1Monitoring, measurement, analysis and evaluation hard 9.2Internal audit hard 9.2.1General hard 9.2.2Audit programme(s) hard 9.3Management review hard 9.3.1General hard 9.3.2Management review input hard 9.3.3Management review outputs hard

Improvement, ISO 22301:2019

10.1Nonconformity and corrective action hard 10.2Continual improvement hard