ISO 22301
Connect BIA, recovery strategies, BC plans, exercises and management review under ISO 22301 to the same processes, assets and owners that support ISMS, DSMS and AIMS.
One control, several standards
Standards overlap far more than they differ. A control entered once is mapped to every framework whose requirement it answers, so the second audit inherits the evidence from the first.
One control
Supplier & third-party due diligence
From control to policy
A control is not a line in a register. It belongs to a management system, and it is carried by the policies and procedures your people actually read, so it flows through both.
One control
Supplier & third-party due diligence
Management systems
Policies and procedures
01
ISO 22301 sits alongside the ISMS, the DSMS and the AIMS in KaitoSec, on one data model. A risk identified in the ISMS becomes a BC scenario, a critical asset feeds both control selection and recovery planning, the management review covers all four. No parallel registers, no silo handovers.
02
Stage 1 examines your documentation, Stage 2 the implementation in practice, followed by annual surveillance audits in a three-year cycle. KaitoSec shows per requirement which evidence stands and where gaps remain, so you set the audit date based on maturity.
03
Plan and run tabletop walkthroughs, functional tests and full-scale simulations. Capture findings, lessons learned and follow-up actions, then link them back to the BC plan that was tested. ISO 22301, NIS2 and DORA evidence is generated by the work, not compiled after it.
01
The standard requires both as the foundation: understanding impact and assessing continuity risks. You run the BIA at process, service or asset level, assess risks on the same object and define RTO, RPO, MTPD and MBCO per process. Registers and objects are the same as in the ISMS, nothing is entered twice.
02
BIA results become continuity requirements, from which you derive strategies and solutions. Each option documents cost, feasibility and resource needs, because the standard requires a justified selection, not just an outcome.
03
BC plans capture roles, activation, communication and decision authority. Versioning, approval, distribution and acknowledgement run in the same workflow as policies. That way, every role knows its part before it is needed.
04
The standard requires an ongoing exercise programme with defined objectives, from tabletop walkthroughs through functional tests to full-scale exercises. Findings and follow-up actions are documented directly on the tested plan; the exercise history is fully evidenced at audit.
05
Metrics, internal audit and management review are separate obligations in the standard. KaitoSec brings exercise results, incidents and review decisions together in one place; every improvement stays traceable to its trigger.
No. The BCMS module works with or without a certification goal. If you pursue ISO 22301, you connect requirements, BIA, plans, exercises and reviews. For other obligations, suitable evidence can be reused where your scope genuinely supports it.
NIS2 Article 21 explicitly requires business continuity and crisis management. DORA expects financial entities to maintain digital operational resilience including ICT business continuity policies. A BCMS aligned to ISO 22301 satisfies both, plus produces the evidence supervisory authorities expect. KaitoSec maps ISO 22301 requirements to NIS2 measures and DORA articles on one data model.
A BC plan covers the overall response: which processes keep going, who decides, how the organisation communicates, how the business escalates. A disaster recovery plan covers the technical restoration of systems. KaitoSec carries both and keeps the relationships explicit, so neither plan drifts from the other.
ISO 22301, NIS2 and DORA all expect regular testing, typically at least annually for critical plans and more often for high-impact processes. KaitoSec schedules, documents and tracks exercises in the same place as the plans themselves, so the cadence is provable without manual record-keeping.
The asset register, the risk register and the policy library stay in place; the BCMS extends them with BIA, recovery strategies, BC plans, exercises and crisis activation. Your ISBs work in the same workspace, your management review covers both systems, and audit evidence compiles from one source. Our BCM knowledge hub covers BIA, recovery strategies and exercises in depth.
