ISO 22301
Self-assessment questionnaire

How ready are you?
This document has been designed to assess your company’s readiness for an ISO 22301 Business Continuity
Management System certification assessment. By completing this questionnaire your results will allow
you to self-assess your organization and identify where you are in the process in relation to the main
requirements of the standard.

Context of the organization
Have you determined the external and internal issues
that are relevant to your organization’s purpose that
affects your ability to achieve the intended results of yourBusiness Continuity Management System (BCMS)?

Has continual improvement been considered?

Leadership

Do you have a way of reviewing and monitoring changes
to these issues on a regular basis?

Has top management taken responsibility for theeffectiveness of the BCMS and have they communicatedthe importance of an effective BCMS?

Have you determined the needs and expectations ofinterested parties that are relevant to the BCMS and do
you review these on a regular basis?

Have the policy and objectives for the BCMS, which arecompatible with the context and strategic direction of theorganization, been established and communicated?

Have you determined the scope of your BCMS and did
this take into account the external and internal issues,interested parties, and any activities performed by otherorganizations?

Do the roles carry the authority for ensuringconformance and reporting, as well as theresponsibility?

Are you aware of the requirements of interested parties,
including regulatory, statutory and those of yourcustomers?
Have the risks and opportunities associated with theseissues and requirements been considered?

Has a programme to ensure the BCMS achieves its
outcomes, requirements and objectives been developed
and put in place?

Continued >>ISO 22301 Business Continuity Management – Self-assessment questionnaire

Planning

Operation – continued

Have the risks and opportunities that need to beaddressed to ensure the BCMS can achieve its intended
result(s) been established?

Is there a formal and documented process forunderstanding the organization through a Business
Impact Analysis (BIA)?

Has the organization planned actions to address theserisks and opportunities and integrated them into thesystem processes?

Is there a formal process for determining comtinuity
objectives based on understanding the impact ofdisruptive incidents?

Have measureable business continuity (BC) objectives
been established, documented and communicatedthroughout the organization with a plan to achieve
them?

Does the BIA enable prioritization of time frames forresuming each activity (Recovery Time Objectives) andhave minimum levels for resuming activities that havebeen identified?
Have these actions been documented?

SupportHas the organization determined and provided
the resources needed for the establishment,
implementation, maintenance and continual
improvement of the BCMS (including people,infrastructure and environment for the operation ofprocesses)?
• Is this process consistent with the personnel inthe defined BCMS roles?
Has the organization determined the knowledge
necessary for those performing BCMS roles?
Has the organization ensured that those persons
who can affect the performance and effectiveness of
the BCMS are competent on the basis of appropriate
education, training, or experience or taken action toensure that those persons can gain the necessarycompetence?
Has the documented information required by
the standard and necessary for the effective
implementation and operation of the ISMS
been established?
Is the documented information controlled in away that it is available and adequately protected,distributed, stored, retained and under change control,
including documents of external origin required by theorganization for the BCMS?

Operation
Have you devised and implemented a programme toensure the BCMS achieves its outcomes?
Is there a plan for the determining the need for changes
to the ISMS and managing their implementation?
Is there a plan for the determining the need for changes
to the BCMS and managing their implementation?
When changes are planned, are they carried out ina controlled way and actions taken to mitigate anyadverse effects?
If you have outsourced processes, are they
appropriately controlled?

Is the BC strategy based on the outputs of the BIA andrisk assessment?
Does the BC strategy protect prioritized activities andprovide appropriate continuity and recovery of them,
their dependencies and resources?
Does the BC strategy provide for mitigating, responding
to and managing impacts?
Have prioritized time frames been set for theresumption of all activities?
Have the BC capabilities of suppliers been evaluatedand mitigated?
Have the resource requirements for the selectedstrategy options been determined, including people,
information and data, infrastructure, facilities,consumables, IT, transport, finance and partner/
supplier services?
Have measures to reduce the likelihood, duration
or impact of a disruption for identified risks been
considered and implemented, and are these inaccordance with the organization’s risk appetite?
Have documented BC procedures been put in place
to manage a disruptive incident, and have continuity
activities based on recovery onjectives been identifed
in the BIA?
Have internal and external communication protocols
been established as part of these procedures?
Is there an Incident Response Structure (IRS) which
details the management structure and trained
personnel in place to respond to a disruptive incident?
Does the IRS and associated procedures include
thresholds, assessment, activation, resource provisionand communication?
Do the people in your IRS have the necessarycompetencies to perform their duties and are records
kept to demonstrate this?
Is there a procedure for detecting and monitoring
incidents which included recording vital information,actions taken and decisions made?

Continued >>ISO 22301 Business Continuity Management – Self-assessment questionnaire

Operation – continued

Performance evaluation – continued

Is there a procedure for managing internal andexternal communications during a disruptive incident?

Where nonconformities are identified, has theorganization established appropriate processes for
managing nonconformities and the related correctiveactions?

Is there a procedure for receiving and responding
to warnings from outside agencies and emergency
responders?
Is there a procedure for issuing alerts and warnings
and is this communication regularly exercised andrecords kept of the results?
Are there documented plans/procedures for restoringbusiness operations after an incident, do they reflect
the needs of those who will use them and contain all
the essential information they need?
Do the plans define roles and responsibilities and aprocess for activating the response?
Do the plans consider the management of theimmediate consequences of a disruption, in particular
the welfare of individuals, options for response andfurther loss prevention?
Do the plans detail how to communicate withinterested parties, including the media during thedisruption and how to prioritize activities?
Do the plans include a procedure for standing down
the response and returning to normal business?
Have the business continuity procedures been tested,
at planned intervals and with appropriate scenarios toensure they are consistent with your BC objectives?
Have formal post-exercise reports been produced forthe tests and outcomes reviewed to ensure they leadto improvement?

Performance evaluation
Have you determined what needs to be monitored andmeasured, when, by whom, the methods to be used, andwhen the results will be evaluated?
Are the results of monitoring and measurement
documented?
Are internal audits conducted periodically to checkthat the BCMS is effective and conforms to both
ISO 22301:2014 and the organization’s requirements?

Do top management undertake regular and periodic
reviews of the BCMS?
Does the output from the BCMS management review
identify changes and improvements?
Are the results of the management review documented,acted upon and communicated to interested parties asappropriate?
Where nonconformities are identified, has theorganization put in place appropriate processes for
managing nonconformities and the related correctiveactions?

Improvement
Have actions to control, correct and deal with theconsequences of nonconformities been identified?
Has the need for action been evaluated to eliminate theroot cause of nonconformities to prevent reoccurrence?
Have any actions identified been implemented
and reviewed for effectiveness and given rise toimprovements to the BCMS?
Is documented information kept as evidence of thenature of nonconformities, actions taken and theresults?

At BSI we create excellenceby driving the success of ourclients through standards. We helporganizations to embed resilience,
helping them to grow sustainably,
adapt to change, and prosper
for the long term.

We make excellence a habit.

The trademarks in this material (for example the BSI logo
or the word “KITEMARK”) are registered and unregisteredtrademarks owned by The British Standards Institution in
UK and certain other countries throughout the world.

Find out more
Call: +44 (0)345 080 9000
Visit: bsigroup.com© BSI GroupAre results of these audits reported to management,
documented and retained?

BSI/UK/852/SC/0516/EN/BLD

Has the organization established a program for internal
audits of the BCMS?