02 / Compliance and certification
ISO 22301, for the day the building is dark
We help you build a business continuity management system that knows what must keep running, how fast it has to come back, and who does what when it does not.
Overview
What ISO 22301 asks of you
ISO 22301 is the international standard for a business continuity management system (BCMS). It asks you to understand which activities matter most, how long you can live without them, and to prepare, exercise and improve the arrangements that bring them back.
The business impact analysis and the risk assessment drive everything else. We work through them with the people who run the processes, so recovery objectives reflect operations and not a guess made in a meeting room. Plans are then tested in exercises, because a plan nobody has tried is a hypothesis.
Certification is issued by an accredited certification body. Black Fox prepares you, runs exercises with you, coordinates the audit with our long-standing certification partners or a body of your choice, and supports you through it if you want us there.
Who it is for
Organisations whose clients or regulators ask for evidence of business continuity, providers of services that others depend on, and teams with recovery plans that have never been tested. It sits well beside an ISO/IEC 27001 ISMS and supports operational resilience obligations such as those under DORA.
The work, from scoping to evidence.
What we do
Scope and context
We define which products, services and sites the BCMS covers, and the parties who depend on them.
Business impact analysis
Prioritised activities, their dependencies, and recovery objectives agreed with the people who own them.
Risk assessment
A look at the disruptions most likely to stop those activities, including IT, suppliers, people and premises.
Strategies and plans
Continuity and recovery strategies you can afford, turned into plans that name people, steps and contacts.
Exercises
Tabletop and practical exercises, from a walk-through to a technical recovery test, with lessons recorded and acted on.
Internal audit and review
An internal audit of the BCMS and a management review that produces decisions.
How the engagement runs
Kickoff
We agree the scope, the people involved and the deadline, and sign an NDA first if you need one.
Gap assessment
Interviews and document review against the standard, ending in a prioritised gap report.
Analysis and planning
Business impact analysis, risk assessment, strategies and plans, built with your process owners.
Exercise
We run an exercise against the plans and turn what breaks into improvements.
Internal audit
A full internal audit against the standard, with nonconformities you can still fix.
Certification audit
We coordinate the audit with one of our long-standing certification partners or the accredited body of your choice, help you prepare and help with any findings that follow.
What you receive
- BCMS scope statement and context analysis
- Business impact analysis with recovery objectives
- Risk assessment and treatment plan for disruptions
- Business continuity and recovery plans
- Exercise reports with lessons learned
- Internal audit report and management review inputs
Black Fox prepares and supports you, and does not issue certificates, attestation reports or official assessments itself. Where a certificate or report is the goal, we coordinate the audit with our long-standing certification partners or a body of your choice, so the work runs end to end in one engagement.
Questions
Is business continuity the same as disaster recovery?
No. Disaster recovery brings IT systems back. Business continuity keeps the activities that matter running, which includes people, premises, suppliers and communication as well as IT. ISO 22301 covers the whole picture.
Do you issue the ISO 22301 certificate?
No. Certificates come from accredited certification bodies, independent of whoever helped you implement. We prepare you, coordinate the audit with one of our long-standing certification partners or a body of your choice, and support you through it, so you go from preparation to the certificate in one engagement.
Can it share a management system with ISO/IEC 27001?
Yes. Both follow the common structure ISO uses for management system standards, so scope, document control, internal audit and management review can be shared.
How often do we need to exercise?
The standard expects exercises at planned intervals and after significant changes. How often depends on your risks and your plans. We help you set a programme you can actually keep.
Related services
- Governance and riskBusiness continuity and disaster recoveryBCP and DRP from Black Fox Security: business impact analysis, continuity and recovery plans, backup and restore testing and tabletop exercises that test the plan.
- Compliance and certificationISO/IEC 27001ISO/IEC 27001 support from Black Fox Security: ISMS scoping, risk assessment, Statement of Applicability, internal audit and certification audit preparation.
- Compliance and certificationDORADORA support from Black Fox Security: ICT risk management gap assessment, incident reporting, digital operational resilience testing and ICT third-party risk.
- Advisory and responseDigital forensics and incident responseDFIR from Black Fox Security: incident post-mortems, network and storage forensics, reverse engineering, data recovery, response plans and tabletop exercises.
Find out what stops when something stops
Tell us what your business cannot be without. We will help you work out how long that can last and what brings it back.