ISO 22301 Alignment Map
Places each P22 document against the clause numbers and titles of ISO 22301, and shows what a business continuity management system adds beyond the pack.
Available soon
- Format
- Excel
- Size
- 62 KB
- Length
- 11 sheets
- Version
- 1.1
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to read and use this map
| Step | What to do |
|---|---|
| 1 | What this workbook is. A map of where the documents of the Business Continuity, Disaster Recovery & Cyber Resilience pack (P22) sit against ISO 22301, the international standard for business continuity management systems. The Alignment Map sheet has one row for each of the standard's 26 second-level clauses, 4.1 to 10.2: the clause number and title, how the pack relates to its topic in words (“Related”, “Partly related”, “Not in this pack”), the P22 documents on the same topic, the other published CISO Times packs on it, and our note. The Beyond the Pack sheet lists the 19 rows where a management system adds something the pack does not do. The Clause Titles sheet lists all 64 numbered headings of clauses 4 to 10. The Relation Count sheet counts the rows. |
| 2 | How each relation was judged. Each relation is our judgement from the clause title alone. We have not read the standard's text, and none of it is reproduced here. Clause numbers and titles from the standard's table of contents, in two official previews of ISO 22301:2019 read on 21 October 2026. Amendment 1:2024 changed no number or title. For each second-level clause we asked whether a P22 document deals with the topic its title names, and wrote in the note what the pack does there and what it leaves out. A third-level heading, such as 8.2.2, is judged with its second-level clause. |
| 3 | What a relation does not say. A relation says only that a P22 document deals with the same topic as the clause title. No row says that a document meets, covers or satisfies a clause. Whether a management system conforms to the standard is decided only by a certification body, in an audit against the standard's full text. Before you rely on a row, read the clause itself: the standard is sold by ISO and by national standards bodies. |
| 4 | If you are planning a business continuity management system, start on the Beyond the Pack sheet. The 8 rows marked “Not in this pack” (4.1, 4.4, 6.3, 7.1, 7.2, 7.3, 8.1, 9.2) are management-system work the pack does not do. The 11 rows marked “Partly related” are topics the pack deals with in part, and the note says what the pack leaves out. Record your plan, an owner and a target date for each in the yellow columns. Then use the Alignment Map sheet to find the documents you already have for the other rows. |
| 5 | If a customer or a regulator asks about ISO 22301, answer from your own position: whether you hold a certificate, are working towards one, or do not plan one. If they ask which documents you hold on a topic, the Alignment Map sheet shows which of the pack's documents deal with it. This map is not a certificate, an audit or a gap assessment, and it is not evidence that your organisation conforms to the standard. |
| 6 | Record your own documents. In the yellow column of the Alignment Map sheet, name the documents and records you have adopted or written for each row. What you write there is your own judgement: check it against the standard's text, and with your certification body where you rely on it. |
| 7 | Read the Relation Count sheet. It counts the map's rows by relation and by clause, the headings in the standard's contents, and how many of your yellow cells are filled in. The counts describe this map and your entries, not your organisation's readiness: no number in it is a score or a share (RR-20). |
| 8 | Check the edition. This map uses ISO 22301:2019 incl. Amd 1:2024: Security and resilience — Business continuity management systems — Requirements. A third edition is in development, at committee draft stage (ISO/CD 22301); until it is published, the 2019 edition with its 2024 amendment is the current one. The new edition may change clause numbers and titles: check this map against its contents before you rely on it. |
| 9 | Keep and review it. This workbook is your own record: keep it with your continuity documents. Review it when a new edition of the standard is published, when you adopt, change or retire a P22 document, and at least every 12 months. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | No rows are marked EXAMPLE: the map's rows are the standard's headings, not an example to delete. |
Limitations: This document helps you plan and test business continuity and recovery from a disruption, including a destructive cyberattack. It is not legal advice, and following it is not a statement that you comply with NIS2, DORA, the GDPR, HIPAA, ISO 22301 or any other law, standard or set of criteria. Which continuity and recovery duties apply to you depends on your sector and the law that applies to you: confirm them with counsel, your auditor or your supervisor.
This workbook has no EXAMPLE rows. Every row of the Alignment Map, Beyond the Pack and Clause Titles sheets is a heading of the standard, and the yellow columns are blank for you to fill.
Adapting this template
Small organisation: you do not need a certified management system to use this pack. Use the Alignment Map sheet when someone asks about ISO 22301, and the Beyond the Pack sheet only if a customer, a regulator or your board asks you to build a management system.
Organisation with an information security management system (ISO/IEC 27001, P08): the notes on 4.1, 4.4, 9.2 say where its processes can be extended to continuity. Ask your certification body whether it can audit the two systems together.
Regulated entity (NIS2, DORA, HIPAA): your continuity duties come from the law that binds you, and the other P22 documents' framework references say which text asks for what. Confirm with [[counsel]] which duties apply to you, and whether your regulator asks about ISO 22301 at all.
IT run by a service provider: if a provider says it holds an ISO 22301 certificate, ask for the certificate and its scope statement. A certificate applies to the scope its certification body audited, which may not include the services you use.
Alignment Map
One row per second-level clause of ISO 22301:2019 incl. Amd 1:2024, in the order of its contents. The yellow column is yours.
How to read the relation. Each relation is our judgement from the clause title alone. We have not read the standard's text, and none of it is reproduced here. A relation says only that a P22 document deals with the same topic as the clause title. No row says that a document meets, covers or satisfies a clause. Whether a management system conforms to the standard is decided only by a certification body, in an audit against the standard's full text. Clause numbers and titles from the standard's table of contents, in two official previews of ISO 22301:2019 read on 21 October 2026. Amendment 1:2024 changed no number or title.
| Clause | Number | Clause title (from the contents) | Relation, judged from the title only | P22 documents on the same topic | Other published CISO Times packs on the topic | Our note | Your own documents and records (your entry) |
|---|---|---|---|---|---|---|---|
| 4 Context of the organization | 4.1 | Understanding the organization and its context | Not in this pack | None in this pack | P05 Information Security Risk Management | The context of the organisation is a management-system step this pack does not take. If you run an ISMS, its context work can be extended to continuity. | |
| 4 Context of the organization | 4.2 | Understanding the needs and expectations of interested parties | Partly related | P22-A10 Business Impact Analysis Questionnaire P22-A04 Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) | P06 Third-Party Security Risk Management | The analysis records what each critical service delivers and to whom, and the harm to customers and on the legal and regulatory impact area; legal and regulatory texts are named in each document's framework references, not assessed. | |
| 4 Context of the organization | 4.3 | Determining the scope of the business continuity management system | Partly related | P22-A02 Business Continuity & ICT Resilience Policy P22-A04 Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) | None named | The policy's scope and the list of critical services set which services and sites the programme applies to. A management-system scope statement is not written here. | |
| 4 Context of the organization | 4.4 | Business continuity management system | Not in this pack | None in this pack | P08 ISO 27001 Implementation & Certification Readiness | The management system as a whole is not in this pack. An ISMS's structure can carry it: see the Guidance question "How do we add ISO 27701, ISO 22301 or ISO 9001 to our ISMS without doing the same work twice?" | |
| 5 Leadership | 5.1 | Leadership and commitment | Partly related | P22-A02 Business Continuity & ICT Resilience Policy P22-A09 Resilience Readiness Dashboard | P03 Board Cybersecurity Reporting | The board or its equivalent approves the policy and receives the readiness report each year. | |
| 5 Leadership | 5.2 | Policy | Related | P22-A02 Business Continuity & ICT Resilience Policy | P04 Security Policy Management | The Business Continuity & ICT Resilience Policy; how policies are approved and published is P04's. | |
| 5 Leadership | 5.3 | Roles, responsibilities and authorities | Related | P22-A08 Crisis & Recovery Responsibility Matrix | None named | The responsibility matrix names who decides and does what, with deputies. | |
| 6 Planning | 6.1 | Actions to address risks and opportunities | Partly related | P22-A04 Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) | P05 Information Security Risk Management | An objective gap is told to the risk owner and the risk reassessed in the risk register. | |
| 6 Planning | 6.2 | Business continuity objectives and planning to achieve them | Partly related | P22-A04 Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) P22-A09 Resilience Readiness Dashboard | None named | Recovery objectives per service and the readiness measures with their targets. Objectives for the management system itself are not set here. | |
| 6 Planning | 6.3 | Planning changes to the business continuity management system | Not in this pack | None in this pack | None named | Planning changes to a management system is not in this pack. | |
| 7 Support | 7.1 | Resources | Not in this pack | None in this pack | None named | Resources for running the programme are not planned here; the resources each process needs are clause 8.3.4's topic. | |
| 7 Support | 7.2 | Competence | Not in this pack | None in this pack | P16 Security Awareness Programme | Competence of the people with continuity roles is not assessed here. | |
| 7 Support | 7.3 | Awareness | Not in this pack | None in this pack | P16 Security Awareness Programme | Awareness is not in this pack; the security awareness pack can carry a continuity module. | |
| 7 Support | 7.4 | Communication | Partly related | P22-A14 Outage Communications Template Set | P09 Security Incident Management | The outage templates deal with communication during a disruption; communication about the programme itself is not in this pack. | |
| 7 Support | 7.5 | Documented information | Partly related | P22-A02 Business Continuity & ICT Resilience Policy | P04 Security Policy Management | Every template carries a document-control table and the policy sets how long test records and crisis logs are kept; document control is P04's. | |
| 8 Operation | 8.1 | Operational planning and control | Not in this pack | None in this pack | None named | Operational planning and control of the programme is not set out as such. | |
| 8 Operation | 8.2 | Business impact analysis and risk assessment | Related | P22-A10 Business Impact Analysis Questionnaire P22-A04 Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) P22-A07 Resilience Dependency Register | P05 Information Security Risk Management | The analysis by process, the objectives it gives each service, and the dependencies; risk assessment uses the risk register. | |
| 8 Operation | 8.3 | Business continuity strategies and solutions | Related | P22-A04 Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) P22-A07 Resilience Dependency Register P22-A11 Site & Business Unit Continuity Plan Template P22-A12 IT Disaster Recovery Procedure | P06 Third-Party Security Risk Management | Workarounds, recovery methods, alternatives for single points of failure and the least each process needs; supplier recovery times through the third-party pack. | |
| 8 Operation | 8.4 | Business continuity plans and procedures | Related | P22-A11 Site & Business Unit Continuity Plan Template P22-A05 Cyber Recovery Plan Template P22-A08 Crisis & Recovery Responsibility Matrix P22-A12 IT Disaster Recovery Procedure P22-A03 Cyber Recovery Operating Procedure P22-A06 Clean-Room Recovery & Rebuild Checklist P22-A14 Outage Communications Template Set | P09 Security Incident Management | Site and unit plans, one plan per service, the crisis roles, disaster recovery, cyber recovery with its clean-room gates, and outage messages; incident response is P09's. | |
| 8 Operation | 8.5 | Exercise programme | Related | P22-A13 Continuity & Disaster Recovery Test Plan and Report | P10 Cyber Incident Exercises & Tabletop Scenario Library | Recovery tests, failover tests and workaround trials; tabletop exercises are P10's and are not recovery tests. | |
| 8 Operation | 8.6 | Evaluation of business continuity documentation and capabilities | Partly related | P22-A13 Continuity & Disaster Recovery Test Plan and Report P22-A09 Resilience Readiness Dashboard | None named | Test reports and the plans' reviews after each test; a formal evaluation of the programme is not set out. | |
| 9 Performance evaluation | 9.1 | Monitoring, measurement, analysis and evaluation | Related | P22-A09 Resilience Readiness Dashboard | P11 Cybersecurity Metrics & Reporting Programme | The readiness measures, reported as counts with every gap named. | |
| 9 Performance evaluation | 9.2 | Internal audit | Not in this pack | None in this pack | P08 ISO 27001 Implementation & Certification Readiness P20 Security Control Assurance | Internal audit is not in this pack; an ISMS's audit programme can include continuity. | |
| 9 Performance evaluation | 9.3 | Management review | Partly related | P22-A09 Resilience Readiness Dashboard | P03 Board Cybersecurity Reporting | Readiness goes to executive management each quarter and to the board each year; a management review agenda is not set here. | |
| 10 Improvement | 10.1 | Nonconformity and corrective action | Partly related | P22-A04 Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) P22-A13 Continuity & Disaster Recovery Test Plan and Report | None named | Objective gaps and test findings each get an owner and a date. | |
| 10 Improvement | 10.2 | Continual improvement | Partly related | P22-A05 Cyber Recovery Plan Template P22-A11 Site & Business Unit Continuity Plan Template | None named | Lessons from tests and real recoveries are written into the plans. |
Beyond the Pack
The map's rows marked “Not in this pack” or “Partly related”: what a business continuity management system adds beyond this pack. The yellow columns are yours.
Each relation is our judgement from the clause title alone. We have not read the standard's text, and none of it is reproduced here. A relation says only that a P22 document deals with the same topic as the clause title. No row says that a document meets, covers or satisfies a clause. A row here is a topic to plan for. It does not say your organisation lacks the practice: you may already run it outside this pack.
| Number | Clause title (from the contents) | Relation on the map (calc) | P22 documents on the topic | What the pack does and leaves out (our note) | Other published CISO Times packs on the topic | Your plan (your entry) | Owner (your entry) | Target date (your entry) |
|---|---|---|---|---|---|---|---|---|
| 4.1 | Understanding the organization and its context | Not in this pack | None in this pack | The context of the organisation is a management-system step this pack does not take. If you run an ISMS, its context work can be extended to continuity. | P05 Information Security Risk Management | |||
| 4.2 | Understanding the needs and expectations of interested parties | Partly related | P22-A10 Business Impact Analysis Questionnaire P22-A04 Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) | The analysis records what each critical service delivers and to whom, and the harm to customers and on the legal and regulatory impact area; legal and regulatory texts are named in each document's framework references, not assessed. | P06 Third-Party Security Risk Management | |||
| 4.3 | Determining the scope of the business continuity management system | Partly related | P22-A02 Business Continuity & ICT Resilience Policy P22-A04 Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) | The policy's scope and the list of critical services set which services and sites the programme applies to. A management-system scope statement is not written here. | None named | |||
| 4.4 | Business continuity management system | Not in this pack | None in this pack | The management system as a whole is not in this pack. An ISMS's structure can carry it: see the Guidance question "How do we add ISO 27701, ISO 22301 or ISO 9001 to our ISMS without doing the same work twice?" | P08 ISO 27001 Implementation & Certification Readiness | |||
| 5.1 | Leadership and commitment | Partly related | P22-A02 Business Continuity & ICT Resilience Policy P22-A09 Resilience Readiness Dashboard | The board or its equivalent approves the policy and receives the readiness report each year. | P03 Board Cybersecurity Reporting | |||
| 6.1 | Actions to address risks and opportunities | Partly related | P22-A04 Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) | An objective gap is told to the risk owner and the risk reassessed in the risk register. | P05 Information Security Risk Management | |||
| 6.2 | Business continuity objectives and planning to achieve them | Partly related | P22-A04 Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) P22-A09 Resilience Readiness Dashboard | Recovery objectives per service and the readiness measures with their targets. Objectives for the management system itself are not set here. | None named | |||
| 6.3 | Planning changes to the business continuity management system | Not in this pack | None in this pack | Planning changes to a management system is not in this pack. | None named | |||
| 7.1 | Resources | Not in this pack | None in this pack | Resources for running the programme are not planned here; the resources each process needs are clause 8.3.4's topic. | None named | |||
| 7.2 | Competence | Not in this pack | None in this pack | Competence of the people with continuity roles is not assessed here. | P16 Security Awareness Programme | |||
| 7.3 | Awareness | Not in this pack | None in this pack | Awareness is not in this pack; the security awareness pack can carry a continuity module. | P16 Security Awareness Programme | |||
| 7.4 | Communication | Partly related | P22-A14 Outage Communications Template Set | The outage templates deal with communication during a disruption; communication about the programme itself is not in this pack. | P09 Security Incident Management | |||
| 7.5 | Documented information | Partly related | P22-A02 Business Continuity & ICT Resilience Policy | Every template carries a document-control table and the policy sets how long test records and crisis logs are kept; document control is P04's. | P04 Security Policy Management | |||
| 8.1 | Operational planning and control | Not in this pack | None in this pack | Operational planning and control of the programme is not set out as such. | None named | |||
| 8.6 | Evaluation of business continuity documentation and capabilities | Partly related | P22-A13 Continuity & Disaster Recovery Test Plan and Report P22-A09 Resilience Readiness Dashboard | Test reports and the plans' reviews after each test; a formal evaluation of the programme is not set out. | None named | |||
| 9.2 | Internal audit | Not in this pack | None in this pack | Internal audit is not in this pack; an ISMS's audit programme can include continuity. | P08 ISO 27001 Implementation & Certification Readiness P20 Security Control Assurance | |||
| 9.3 | Management review | Partly related | P22-A09 Resilience Readiness Dashboard | Readiness goes to executive management each quarter and to the board each year; a management review agenda is not set here. | P03 Board Cybersecurity Reporting | |||
| 10.1 | Nonconformity and corrective action | Partly related | P22-A04 Critical Service Recovery Objectives Matrix (RTO, RPO, MTD) P22-A13 Continuity & Disaster Recovery Test Plan and Report | Objective gaps and test findings each get an owner and a date. | None named | |||
| 10.2 | Continual improvement | Partly related | P22-A05 Cyber Recovery Plan Template P22-A11 Site & Business Unit Continuity Plan Template | Lessons from tests and real recoveries are written into the plans. | None named |
Clause Titles
Every numbered heading of clauses 4 to 10 of ISO 22301:2019 incl. Amd 1:2024, by number and title only.
Clause numbers and titles from the standard's table of contents, in two official previews of ISO 22301:2019 read on 21 October 2026. Amendment 1:2024 changed no number or title. Each relation is our judgement from the clause title alone. We have not read the standard's text, and none of it is reproduced here. A clause, such as 8, is judged through its second-level rows; a third-level heading, such as 8.2.2, with its second-level clause.
| Clause | Number | Title (from the contents) | Level | Judged at map row | Relation at that row (calc) |
|---|---|---|---|---|---|
| 4 Context of the organization | 4 | Context of the organization | Clause | ||
| 4 Context of the organization | 4.1 | Understanding the organization and its context | Second level | 4.1 | Not in this pack |
| 4 Context of the organization | 4.2 | Understanding the needs and expectations of interested parties | Second level | 4.2 | Partly related |
| 4 Context of the organization | 4.2.1 | General | Third level | 4.2 | Partly related |
| 4 Context of the organization | 4.2.2 | Legal and regulatory requirements | Third level | 4.2 | Partly related |
| 4 Context of the organization | 4.3 | Determining the scope of the business continuity management system | Second level | 4.3 | Partly related |
| 4 Context of the organization | 4.3.1 | General | Third level | 4.3 | Partly related |
| 4 Context of the organization | 4.3.2 | Scope of the business continuity management system | Third level | 4.3 | Partly related |
| 4 Context of the organization | 4.4 | Business continuity management system | Second level | 4.4 | Not in this pack |
| 5 Leadership | 5 | Leadership | Clause | ||
| 5 Leadership | 5.1 | Leadership and commitment | Second level | 5.1 | Partly related |
| 5 Leadership | 5.2 | Policy | Second level | 5.2 | Related |
| 5 Leadership | 5.2.1 | Establishing the business continuity policy | Third level | 5.2 | Related |
| 5 Leadership | 5.2.2 | Communicating the business continuity policy | Third level | 5.2 | Related |
| 5 Leadership | 5.3 | Roles, responsibilities and authorities | Second level | 5.3 | Related |
| 6 Planning | 6 | Planning | Clause | ||
| 6 Planning | 6.1 | Actions to address risks and opportunities | Second level | 6.1 | Partly related |
| 6 Planning | 6.1.1 | Determining risks and opportunities | Third level | 6.1 | Partly related |
| 6 Planning | 6.1.2 | Addressing risks and opportunities | Third level | 6.1 | Partly related |
| 6 Planning | 6.2 | Business continuity objectives and planning to achieve them | Second level | 6.2 | Partly related |
| 6 Planning | 6.2.1 | Establishing business continuity objectives | Third level | 6.2 | Partly related |
| 6 Planning | 6.2.2 | Determining business continuity objectives | Third level | 6.2 | Partly related |
| 6 Planning | 6.3 | Planning changes to the business continuity management system | Second level | 6.3 | Not in this pack |
| 7 Support | 7 | Support | Clause | ||
| 7 Support | 7.1 | Resources | Second level | 7.1 | Not in this pack |
| 7 Support | 7.2 | Competence | Second level | 7.2 | Not in this pack |
| 7 Support | 7.3 | Awareness | Second level | 7.3 | Not in this pack |
| 7 Support | 7.4 | Communication | Second level | 7.4 | Partly related |
| 7 Support | 7.5 | Documented information | Second level | 7.5 | Partly related |
| 7 Support | 7.5.1 | General | Third level | 7.5 | Partly related |
| 7 Support | 7.5.2 | Creating and updating | Third level | 7.5 | Partly related |
| 7 Support | 7.5.3 | Control of documented information | Third level | 7.5 | Partly related |
| 8 Operation | 8 | Operation | Clause | ||
| 8 Operation | 8.1 | Operational planning and control | Second level | 8.1 | Not in this pack |
| 8 Operation | 8.2 | Business impact analysis and risk assessment | Second level | 8.2 | Related |
| 8 Operation | 8.2.1 | General | Third level | 8.2 | Related |
| 8 Operation | 8.2.2 | Business impact analysis | Third level | 8.2 | Related |
| 8 Operation | 8.2.3 | Risk assessment | Third level | 8.2 | Related |
| 8 Operation | 8.3 | Business continuity strategies and solutions | Second level | 8.3 | Related |
| 8 Operation | 8.3.1 | General | Third level | 8.3 | Related |
| 8 Operation | 8.3.2 | Identification of strategies and solutions | Third level | 8.3 | Related |
| 8 Operation | 8.3.3 | Selection of strategies and solutions | Third level | 8.3 | Related |
| 8 Operation | 8.3.4 | Resource requirements | Third level | 8.3 | Related |
| 8 Operation | 8.3.5 | Implementation of solutions | Third level | 8.3 | Related |
| 8 Operation | 8.4 | Business continuity plans and procedures | Second level | 8.4 | Related |
| 8 Operation | 8.4.1 | General | Third level | 8.4 | Related |
| 8 Operation | 8.4.2 | Response structure | Third level | 8.4 | Related |
| 8 Operation | 8.4.3 | Warning and communication | Third level | 8.4 | Related |
| 8 Operation | 8.4.4 | Business continuity plans | Third level | 8.4 | Related |
| 8 Operation | 8.4.5 | Recovery | Third level | 8.4 | Related |
| 8 Operation | 8.5 | Exercise programme | Second level | 8.5 | Related |
| 8 Operation | 8.6 | Evaluation of business continuity documentation and capabilities | Second level | 8.6 | Partly related |
| 9 Performance evaluation | 9 | Performance evaluation | Clause | ||
| 9 Performance evaluation | 9.1 | Monitoring, measurement, analysis and evaluation | Second level | 9.1 | Related |
| 9 Performance evaluation | 9.2 | Internal audit | Second level | 9.2 | Not in this pack |
| 9 Performance evaluation | 9.2.1 | General | Third level | 9.2 | Not in this pack |
| 9 Performance evaluation | 9.2.2 | Audit programme(s) | Third level | 9.2 | Not in this pack |
| 9 Performance evaluation | 9.3 | Management review | Second level | 9.3 | Partly related |
| 9 Performance evaluation | 9.3.1 | General | Third level | 9.3 | Partly related |
| 9 Performance evaluation | 9.3.2 | Management review input | Third level | 9.3 | Partly related |
| 9 Performance evaluation | 9.3.3 | Management review outputs | Third level | 9.3 | Partly related |
| 10 Improvement | 10 | Improvement | Clause | ||
| 10 Improvement | 10.1 | Nonconformity and corrective action | Second level | 10.1 | Partly related |
| 10 Improvement | 10.2 | Continual improvement | Second level | 10.2 | Partly related |
Relation Count
The map's rows, counted
Counted from the Alignment Map, Beyond the Pack and Clause Titles sheets. Each relation is our judgement from the clause title alone. We have not read the standard's text, and none of it is reproduced here. The counts describe this map and your entries, not your organisation: no number here is a score or a share of readiness (RR-20).
By relation
| Relation | Rows (calc) | Of all rows (calc) |
|---|---|---|
| Related | 7 | 7 of 26 |
| Partly related | 11 | 11 of 26 |
| Not in this pack | 8 | 8 of 26 |
| All rows | 26 |
By clause
| Clause | Related | Partly related | Not in this pack | Rows on the map | Headings in the contents | Of them, second level |
|---|---|---|---|---|---|---|
| 4 Context of the organization | 0 | 2 | 2 | 4 | 9 | 4 |
| 5 Leadership | 2 | 1 | 0 | 3 | 6 | 3 |
| 6 Planning | 0 | 2 | 1 | 3 | 8 | 3 |
| 7 Support | 0 | 2 | 3 | 5 | 9 | 5 |
| 8 Operation | 4 | 1 | 1 | 6 | 20 | 6 |
| 9 Performance evaluation | 1 | 1 | 1 | 3 | 9 | 3 |
| 10 Improvement | 0 | 2 | 0 | 2 | 3 | 2 |
| All clauses | 7 | 11 | 8 | 26 | 64 | 26 |
"Rows on the map" and "Of them, second level" should be equal for every clause: the map has one row for each second-level heading.
Your entries
| What is counted | Count (calc) |
|---|---|
| Rows of the map where you have named your own documents and records | 0 of 26 |
| Rows beyond the pack with your plan | 0 of 19 |
| Rows beyond the pack with an owner | 0 of 19 |
A filled cell is counted. Whether what you named does what the clause asks is for you to check against the standard's text.
Lists
| Relation | Level |
|---|---|
| Related | Clause |
| Partly related | Second level |
| Not in this pack | Third level |
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| ISO 22301 | ISO 22301:2019 incl. Amd 1:2024: Security and resilience — Business continuity management systems — Requirements. Named here by clause number and title only; its text is not reproduced. |
| Business continuity management system | The policy, objectives, roles, processes, reviews and improvement an organisation runs as one system to manage business continuity. ISO 22301 sets requirements for one. This pack is a set of documents; it is not a management system. |
| Information security management system (ISMS) | The management system ISO/IEC 27001 sets requirements for. The P08 pack helps you implement one. |
| Clause, second level, third level | The numbered headings of the standard's contents. A clause is a heading from 4 to 10, such as 8 Operation. A second-level heading, such as 8.2, has one row on the map. A third-level heading, such as 8.2.2, is judged with its second-level heading. |
| Relation: Related | A P22 document deals with the topic the clause title names. The note says which document and how. |
| Relation: Partly related | A P22 document deals with part of the topic the clause title names. The note says which part, and what the pack leaves out. |
| Relation: Not in this pack | No P22 document deals with the topic. Another published pack may; otherwise it is work a management system adds. |
| Certification body | An organisation accredited to audit management systems against a standard and to issue certificates. Only its audit decides whether a management system conforms to the standard. |
| P22 document | A document of the Business Continuity, Disaster Recovery & Cyber Resilience pack (P22), named by its ID and title, from P22-A02 to P22-A15. |
| Published pack | Another CISO Times pack whose documents deal with the topic, named by its ID and title. |
| Critical service | A service the organisation delivers whose disruption beyond its maximum tolerable downtime would cause Severe harm on the risk register's impact scale (RR-01). It is a business service, such as online ordering, not a system. |
| Business impact analysis (BIA) | Business impact analysis: for each critical service, how the harm grows over time on the risk register's impact areas, and the point at which it becomes Severe (RR-03). |
| Dependency | Anything a critical service needs to run: a system, a supplier, a data set, a group of people, a site, or the foundations (RR-09). |
| Workaround | A way of running the service, or its most important part, without its systems for a set time, such as dispatch from printed pick lists. Owned and accepted by the business owner (RR-06). |
| Objective gap | A check in the objectives matrix that fails: an objective the service cannot meet as things stand. Recorded with an owner, a due date and the change that closes it (RR-15). |
| Continuity plan | A site's or business unit's plan for keeping its part of the critical services running when it loses its building, a large part of its people, a supplier it relies on, or its systems (RR-22). |
| Disaster recovery | Recovering the systems a critical service needs after a failure that is not an attack: repair where they are, fail over, restore elsewhere, or the supplier's own recovery (RR-23, RR-24). After an attack, cyber recovery applies instead (RR-07). |
| Recovery test | A technical test that recovers a critical service, or the systems behind it, and measures the time achieved and the data lost against its objectives; for a service a supplier runs, the supplier's own recovery test with its results shared. A tabletop or a drill under P10 tests decisions and communication. Only a timed recovery proves a recovery time, so under this rule it is not a recovery test (RR-14). |
| Workaround trial | Running a service's workaround for real, for a set time and with a way back, to show it works. It tries the workaround; it does not test recovery (RR-14, RR-26). |
| RR-nn | The rules of the Business Continuity & ICT Resilience Policy, RR-01 to RR-27. |
| Your entry | A yellow column for your own record. The workbook leaves it blank. |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.29 — Information security during disruption | Alignment Map and Beyond the Pack: where the pack's plans for running the organisation through a disruption sit among the headings of a continuity management system, and what such a system adds |
| ISO/IEC 27001:2022 | Annex A 5.30 — ICT readiness for business continuity | Alignment Map, clauses 8.2 to 8.5: the impact analysis, recovery objectives, plans and tests the pack's ICT readiness rests on, placed against the standard's headings |
| NIST CSF 2.0 | GV.OC-03 — “Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed” | The whole workbook: when a customer, a regulator or a contract asks about ISO 22301, which pack documents deal with each topic and what a management system would add |
| ISO 22301:2019 incl. Amd 1:2024 | Security and resilience — Business continuity management systems — Requirements (cited by number and title only) | The whole workbook: every numbered heading of clauses 4 to 10, by number and title only, from the standard's table of contents |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; ISO 22301:2019 incl. Amd 1:2024 (clause numbers and titles only); NIST CSF 2.0
ISO/IEC 27001 references name the clause or control this document relates to; ISO 22301 is named by clause number and title only, and its text is not reproduced. Neither says that meeting one meets any other framework's requirement.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.
Clause numbers and titles from the standard's table of contents, in two official previews of ISO 22301:2019 read on 21 October 2026. Amendment 1:2024 changed no number or title.