ISO 22313
ISO 22313 business continuity management implementation
ISO 22313 consulting helps organisations turn business continuity plans into practical staffing and resource arrangements. Vosurein reviews critical activities, recovery strategies and exercise scenarios to check who can decide during disruption, what to restore first and which external resources are confirmed available.
For Your Business
Who this service is for and when to start
Suitable for companies with existing business continuity documents but lacking drills, or that need to update plans due to new locations, outsourcing, or information system changes. Important for companies whose clients require continuous supply, or that have experienced outages, power failures, or supply interruptions; impacted activities should be reviewed first.
The Challenge
Common challenges faced by businesses
Successful backups do not mean business can continue; there may still be missing personnel, equipment, sites, or supply sources. Departments setting recovery times independently may also conflict, for example, business commitments may have earlier deadlines than the time IT or production can actually recover.
If the plan is not tested with scenarios, the availability of emergency contacts, authorization rights, and alternative resources is often only discovered when an incident occurs.
Our Approach
Methods and applicable requirements
ISO 22313:2020 provides guidance on applying the requirements of ISO 22301 for business continuity management, helping organizations maintain predefined acceptable service capabilities during disruptions. It is an auxiliary approach for implementation and improvement and does not replace the requirements of ISO 22301.
The priorities below depend on the organisation’s context. Confirm the scope and level of supporting evidence at the start.
Business Impact
Trace critical activities from products and services, dependent resources, and consequences after disruption. Discuss recovery priorities based on explainable business rationale.
Strategy and Planning
Compare the feasibility of alternative sites, suppliers, personnel, and information resources. Record activation conditions, authorities, and limitations, instead of just listing backup names.
Exercise Arrangements
Select controllable disruption scenarios and have participants operate or role-play according to the plan. During the process, check whether information is sufficient and handovers are clear.
Review and Update
Turn findings from exercises and real events into improvements, and revisit plans when there are changes in processes, systems, or collaborations.
Process
Consulting scope and process
Identify Critical Activities
Interview business and support departments, and organize delivery requirements, resource dependencies, and current recovery arrangements.
Adjust Recovery Strategies
Compare disruption scenarios with available resources to help set responsibilities, activation procedures, and contact methods.
Conduct Scenario Exercises
Play out disruption and recovery within the agreed scope, recording decisions, information gaps, and unfinished actions.
Track Improvement Closure
Check the revised plans and personnel understanding, and schedule follow-up exercises and maintenance responsibilities.
Preparation
What documents do companies need to prepare?
- Products and Activities: Critical deliverables, processes and departmental contacts.
- Resources and Dependencies: Information on systems, sites, personnel, and suppliers.
- Business Continuity Plan: Business impact analysis, recovery arrangements, and contact lists.
- Incidents and exercises: Existing disruptions, tests, and improvement records.
An index or summary is enough for an initial discussion. Before sharing personal data, confidential contract information or system records, agree on access authorisation, redaction and retention.
Project Planning
Estimating time and cost
Estimate the work from the number of critical activities, departments and sites, exercise types, and depth of checks on alternative resources. Tabletop and live failover exercises need different resources. IT backup implementation, equipment investment and third-party certification are planned separately.
FAQ
Frequently asked questions
Is having data backups enough?
Not enough. Business recovery also depends on personnel, processes, equipment, and supply relationships. Backups also need to be confirmed whether they can be restored in time when needed.
Must exercises interrupt production systems?
Not necessarily. Start with a tabletop exercise if appropriate. Any switch involving production systems needs additional risk assessment, approval and arrangements to restore normal operations.
What is the difference between ISO 22313 and 22301?
22301 specifies management system requirements; 22313 provides application guidance. Companies can use the latter to improve implementation methods but cannot use it to replace conformity assessment for the former.
Can small companies do it too?
Yes, the scope can focus on important deliverables and a few key resources, and the plan should be practical for actual use.
Can it guarantee uninterrupted operation?
No. The focus is to confirm acceptable capabilities and recovery arrangements in advance, and understand the limitations when conditions exceed the plan.
How to keep the plan up-to-date?
Include changes in personnel, systems, locations, and suppliers as triggers for updates, and regularly check through drills.
Related
Related services and enquiries
Tell us your industry, the activities you want to improve, your existing system and your target completion date so we can define the scope together.
Content checked: . Applicable versions and requirements depend on the company’s circumstances.
Let's Talk
Start a conversation about your needs.
Tell us how the work is done today and when you hope to finish,
so we can agree the scope and way of working together.
Blog
Sustainability and AI insights
Start with understanding,
and see where change can lead.