ISO 22301 SELF-ASSESSMENT CHECKLIST TEMPLATE

Whether you pursue ISO 22301 certification or not, you can use this self-assessment checklist to understand what you need to create a business continuity management system (BCMS). The checklist is divided into sections following clauses 5 - 10 of ISO 2230.
CLAUSE - SECTION	COMPLETE?	REMARKS
Clause 5 - Leadership
Define a BCMS oversight process.
Appoint an oversight committee.
Ensure that organization objectives and policies align with customer, legal, regulatory, and any other requirements.
Clause 6 - Planning
Outline what your continuity management plan needs. Include the following:
The purpose of the organization and the products and services you provide.
What assets and functions you need to protect and how.
Stakeholder requirements.
Legal and regulatory requirements.
Clause 7 - Support
Establish an easy-to-use, easily accessible document management system to support all documents relevant to each stage of the BCM system.
Establish a documentation maintenance process to ensure regular updates.
Establish a training program to ensure global awareness of the business continuity maintenance program throughout your organization.
Establish a communication program to ensure ongoing liaisons with interested parties during and outside of disruptive events.
Clause 8 - Operation
Complete a risk assessment.
Complete a business impact analysis (BIA).
Based on the previous two assessments, create business continuity recovery strategies for critical aspects of the organization.
Create the business recovery plans:
Crisis management plan.
Critical business recovery plan.
Critical IT disaster recovery plan.
Regularly schedule tests and document the results.
Clause 9 - Performance Evaluation
Schedule and document Internal and external audits.
Measurement and evaluation processes established to track program performance.
Schedule and document management reviews.
Clause 10 - Continual Improvement
Test or measure to identify weaknesses.
Implement a corrective action program.
Implement a post-incident review process.

DISCLAIMER

Any articles, templates, or information provided by Smartsheet on the website are for reference only. While we strive to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability, or availability with respect to the website or the information, articles, templates, or related graphics contained on the website. Any reliance you place on such information is therefore strictly at your own risk.

This template is provided as a sample only. This template is in no way meant as legal or compliance advice. Users of the template must determine what information is necessary and needed to accomplish their objectives.