Business Continuity (ISO 22301)

Learn how to keep your organization running through any disruption — the BCMS lifecycle, Business Impact Analysis, RTO/RPO/MTPD, risk assessment, recovery strategies, plans, exercising, audits and the key ISO 22301:2019 clauses 4–10. The course is organized into 7 modules, ending with a final exam (pass mark 80%). It is free awareness-level training designed for anyone who needs a practical, working understanding of the topic.

What you'll learn

• What is ISO 22301 and why a BCMS?
• The BCMS lifecycle & key clauses (PDCA)
• Business Impact Analysis (BIA)
• RTO, RPO, MTPD & MBCO
• Risk assessment & recovery strategies
• Plans, incident response & exercising
• Leadership, audit & continual improvement

Learning objectives

• Explain what ISO 22301:2019 is and why organizations build a Business Continuity Management System (BCMS)
• Describe the business continuity lifecycle and how it maps to the auditable clauses 4–10
• Run a Business Impact Analysis (BIA) and rank prioritized activities by criticality and urgency
• Define, calculate and apply RTO, RPO, MTPD and MBCO correctly
• Carry out a continuity risk assessment and choose proportionate recovery strategies for people, premises, technology, information and suppliers
• Build, validate, exercise and continually improve business continuity plans and incident response
• Recognise the role of leadership, top management commitment, audits and management review in a certified BCMS

Course modules in brief

What is ISO 22301 and why a BCMS?

ISO 22301:2019 ("Security and resilience — Business continuity management systems — Requirements") is the international standard that specifies how to build, operate and certify a Business Continuity Management System (BCMS) . A BCMS is the management framework that lets an organization anticipate disruptions, respond effectively, and resume prioritized activities at an acceptable level within an agreed timeframe — whatever the cause.

The BCMS lifecycle & key clauses (PDCA)

Like every modern ISO management standard, ISO 22301 runs on the Plan-Do-Check-Act (PDCA) cycle. Continuity is never "finished": each turn of the cycle uses real-world incidents, exercises and audits to make the BCMS stronger. PDCA maps directly onto the auditable clauses.

Business Impact Analysis (BIA)

The Business Impact Analysis (BIA) is the foundation of the whole BCMS (clause 8.2.2). It identifies the organization's activities, analyses how the impact of not performing them grows over time, and uses that to determine which activities are prioritized and how quickly they must resume.

RTO, RPO, MTPD & MBCO

These four metrics are the quantitative language of continuity. They turn the BIA's judgements into hard, testable targets that drive strategy and budget.

Risk assessment & recovery strategies

Alongside the BIA, clause 8.2.3 requires a risk assessment : identify threats that could disrupt prioritized activities, analyse likelihood and impact, and decide how to treat the risk. The classic 5×5 matrix scores Likelihood × Severity to rank what to treat first.

Plans, incident response & exercising

Strategies become documented business continuity plans and procedures (clause 8.4): how the organization detects an incident, activates a response, communicates, and recovers each prioritized activity. Plans must be specific, accessible during a crisis, and owned by named people. Untested plans are merely assumptions.

Leadership, audit & continual improvement

A BCMS survives only with top management commitment (clause 5) and disciplined evaluation (clauses 9–10). Leadership must set the continuity policy, assign roles and authorities, provide resources, and ensure the BCMS achieves its intended outcomes — it cannot be delegated away.

Exam and certificate

The course has 7 modules and ends with a final exam; the pass mark is 80%.

Frequently asked questions

Is this course free?

It is free awareness-level training designed for anyone who needs a practical, working understanding of the topic.

What does “What is ISO 22301 and why a BCMS?” cover?

A BCMS is "all-hazards": it prepares you for any disruption, whatever the cause.

What does “The BCMS lifecycle & key clauses (PDCA)” cover?

ISO 22301 runs on PDCA — continuity is a loop, not a one-off project.

What does “Business Impact Analysis (BIA)” cover?

The BIA turns "what do we do" into "what must we recover first, and by when".