ISO 22301 is the standard for Business Continuity Management. KaitoSec runs it as a full management system, BIA, recovery strategies, BC plans, exercises and management review, sharing one data model with the ISMS, DSMS and AIMS.
ISO 22301 sits alongside the ISMS, the DSMS and the AIMS on KaitoSec, on one data model. A risk identified in the ISMS becomes a BC scenario, a critical asset feeds both control selection and recovery planning, the management review covers all four. No parallel registers, no silo handovers.
Identify critical processes and services, model disruption impact over time, set RTO, RPO, MTPD and MBCO per process. Derive recovery strategies with cost, feasibility and resource information, link each strategy to the processes, assets and suppliers it protects. The same data feeds your ISMS, vendor management and reporting.
Plan and run tabletop walkthroughs, functional tests and full-scale simulations. Capture findings, lessons learned and follow-up actions, then link them back to the BC plan that was tested. ISO 22301, NIS2 and DORA evidence is generated by the work, not compiled after it.
Run BIA at strategic, process, service or asset level. Score criticality, model impact curves over time and define recovery targets per object. KaitoSec uses the same asset and process register as your ISMS, so the BIA stays current without duplicate data entry.
Recovery requirements are generated from your BIA results. Each strategy carries cost, feasibility and resource information and is linked to the protective controls and continuity dependencies it covers.
Structured plans cover roles, escalation, communication, decision authority and dependencies. Plans are versioned, approved, distributed and acknowledged in the same workflow you use for policies, so the plan in force is always the plan people have actually read.
Define activation criteria, escalate from operational disruption to crisis, log decisions and communications in real time. The crisis log feeds incident reporting under NIS2 and DORA without parallel paperwork.
BCM-specific audits are supported with structured evidence and traceability. Management reviews, exercise outcomes and incident follow-ups feed continuous improvement, so your BCM is a working system rather than a binder in a drawer.
Built on open catalogs: BSI, MITRE, OWASP, ENISA
Related platform features
KaitoSec