ISO 22301:2019 Implementation Training

Opens by asking who would decide what happens if a main site or system stopped tomorrow. It follows XYZ Ltd., a payments company in Singapore, through a power fault at its data centre with and without a business continuity management system. Covers what a BCMS gives the business, clause 1 scope, the five main changes in the 2019 edition, the 2024 climate change amendment, and how the 24 modules of this training course work.

What you will be able to do

• Explain why business continuity matters and what a BCMS gives
• Describe what ISO 22301:2019 covers and who can use it
• Name the main changes in the 2019 edition

Why it matters

Doubt about who decides costs customers, money and trust every hour, and a BCMS settles the answer long before the day comes.

Practice: Practice: Welcome: why business continuity matters · 3 questions

XYZ Ltd.'s IT team reports its settlement system recovered in three and a half hours, yet merchants are paid a day late. The module covers clause 2 and clause 3 terms: incident against disruption, impact over time, the business impact analysis, activity and prioritised activity, the two time frames with minimum acceptable capacity, the definition of business continuity, the plan, exercise against test, and a logistics company in Hong Kong.

What you will be able to do

• Tell an incident from a disruption
• Set a limit and a target time frame for an activity
• Distinguish an exercise from a test

Why it matters

A plan built on different meanings fails on the day it is needed, because IT and the business measure different things.

Practice: Practice: The language of continuity · 3 questions

XYZ Ltd. writes recovery plans for every system before asking which activities matter to merchants, in one version, and starts with a gap assessment in the other. Covers the high level structure, the plan, do, check, act cycle, what clauses 4 to 10 contain, the six parts of clause 8, shall, should, may and can, four ways to show conformity, guidance documents, a five-phase sequence and a gap assessment table.

What you will be able to do

• Describe how clauses 4 to 10 fit the plan, do, check, act cycle
• Read shall, should, may and can correctly
• Run a gap assessment that looks for evidence, not titles

Why it matters

Starting from where you stand avoids months of detailed plans built on the wrong priorities.

Practice: Practice: The system, and where to start · 3 questions

At XYZ Ltd., all customer-facing systems sit in one cloud region, and an outage stops payments for most of a day when nobody listed it as an issue. The module covers the intended outcomes of the BCMS, writing issues with their effect, internal and external issues for a hospital in Mumbai and a logistics company in Hong Kong, the 2024 climate change point, interested parties, and clause 4.2.2 process and register.

What you will be able to do

• Write internal and external issues with their effect
• Decide whether climate change is a relevant issue
• Keep a register of legal and regulatory requirements up to date

Why it matters

A dependency nobody wrote down, such as one cloud region, can turn an outage into a lost day of payments.

Practice: Practice: Issues, interested parties and the law · 3 questions

XYZ Ltd. considers leaving its outsourced merchant support in Manila out of scope, and a storm then closes the partner's site. The module covers what the scope must consider, what it must contain, and why an exclusion must never weaken continuity. It explains outsourced functions, whole or part of an organisation, five questions to draw the scope, XYZ Ltd.'s scope statement, and clause 4.4 as linked processes.

What you will be able to do

• Write a scope statement with parts, locations, products and services
• Document and explain any exclusion
• Keep outsourced functions inside the scope

Why it matters

A scope cut short for an easier audit can leave out the very function that must keep going.

Practice: Practice: The scope and the BCMS · 3 questions

At XYZ Ltd., a board hands the BCMS to an IT manager with no budget in one version, while the chief executive sets policy and names a manager with authority in the other. The module covers top management and the eight ways it shows leadership and commitment, integration into business processes, the four conditions of the policy in clause 5.2.1, communicating the policy, and roles in clause 5.3 for a hospital in Hong Kong.

What you will be able to do

• List the eight ways top management shows commitment
• Write a business continuity policy that meets the four conditions
• Assign who ensures conformity and reports performance

Why it matters

Without leadership, a sound analysis ends with its request refused as an IT cost until the predicted outage arrives.

Practice: Practice: Leadership, policy and roles · 3 questions

XYZ Ltd., in Singapore, fills its planning register with a data centre fire and ransomware while the lone coordinator resigns and no exercise budget exists. The module separates risks to the BCMS in clause 6.1 from risks of disruption in clause 8.2.3. It covers determining and planning actions, a BPO contact centre in Mumbai, measurable objectives with five planning questions, and the four considerations for changes in clause 6.3.

What you will be able to do

• Separate risks to the BCMS from risks of disruption
• Write measurable objectives with what, resources, who, when and evaluation
• Plan a change to the BCMS before making it

Why it matters

A register looking at the wrong kind of risk leaves a merchant asking for an exercise report that does not exist.

Practice: Practice: Risks, opportunities, objectives and changes · 3 questions

At two in the morning XYZ Ltd. loses power at its primary data centre, and the only engineer trained to move card authorisation is on a flight. The module covers resources for the BCMS in clause 7.1, a competence matrix with evidence, awareness of the policy and of one's role before, during and after a disruption, a hospital in Hong Kong, a call-centre partner, and the five questions of the communication plan.

What you will be able to do

• Determine resources and competence for each continuity role
• Evaluate whether training worked, not only attendance
• Plan what is communicated about the BCMS, when and by whom

Why it matters

A plan works only when two trained people can carry it out, one of whom is reachable at night.

Practice: Practice: Resources, competence, awareness, communication · 3 questions

During XYZ Ltd.'s first live exercise in Singapore the plan sits on an intranet inside the failed data centre, and the printed copy is two versions old. The module covers the two kinds of documented information in clause 7.5.1, identification, format and approval in clause 7.5.2, and control in clause 7.5.3. It covers offline copies, version control, documents of external origin, and a hospital in Toronto and a logistics company in Mumbai.

What you will be able to do

• Identify the documented information a BCMS requires and what is your choice
• Mark each plan with title, version, owner and approver
• Keep one current version available when the network is down

Why it matters

A plan you cannot reach, or cannot trust, is not a plan when the disruption arrives.

Practice: Practice: Documented information · 3 questions

A typhoon closes the Manila partner's site, and XYZ Ltd.'s merchants blame it, not the partner. The module gives a map of clause 8, then covers criteria and control for continuity processes, planned and unintended changes, and the definition of outsourcing with the process staying inside the BCMS. A logistics company in Sydney and a hospital in Hong Kong show supplier gaps. It ends with how the BIA and risk assessment combine.

What you will be able to do

• Set criteria and records for each continuity process
• Control an outsourced process and a key supplier's recovery
• Explain how the BIA and the risk assessment work together

Why it matters

You can outsource the work but never the responsibility, so a partner's weak plan becomes your merchants' outage.

Practice: Practice: Operational planning and control · 3 questions

XYZ Ltd. in Singapore takes recovery times from its IT plan and gives merchant support three days that nobody agreed. The module covers the definition of a business impact analysis and the eight steps of clause 8.2.2: impact types and criteria, activities defined by their output, impacts over time, the limit, the target at a minimum acceptable capacity, priorities, resources and dependencies, with five questions for owners and a hospital in London.

What you will be able to do

• Define impact types and criteria with recognisable thresholds
• Find the limit and set a target inside it
• Record resources and dependencies for each prioritised activity

Why it matters

Priorities that come from impact, not from who asks loudest, stop recovery times being guessed; this training course shows the method.

Practice: Practice: The business impact analysis, step by step · 3 questions

A large retail chain's tender asks XYZ Ltd., a Singapore payments company, how soon card payments return after a failure. The module follows six worksheets: the timeline for card and wallet authorisation, reading the first crossing of the unacceptable line, limits and targets for four activities, why settlement is rated on its worst day, three tiers, resources by type, supplier gaps, and decisions for top management.

What you will be able to do

• Read an impact timeline to find the first unacceptable crossing
• Compare a supplier's recovery time with the time you need
• Turn each BIA gap into a decision with an owner

Why it matters

A BIA that leads to no decision protects nobody, while numbers with reasons let money follow the priorities.

Practice: Practice: The BIA in practice for XYZ Ltd. · 3 questions

XYZ Ltd., a payments company in Singapore, ranks merchant settlement as a top priority but sends every bank file over one network link, which fails. The module separates risks of disruption from risks to the BCMS, then covers identifying risks to each resource, writing them as actionable statements, Sterling's 1 to 5 scoring, a risk register for settlement, four responses, and a logistics company in Sydney.

What you will be able to do

• Identify risks of disruption to each resource of a prioritised activity
• Rate likelihood and impact on one scale and decide on treatment
• Give every risk an owner and a review date

Why it matters

The analysis tells you what matters; the risk assessment shows the single link that could stop it.

Practice: Practice: Risk assessment of disruption · 3 questions

XYZ Ltd. builds a fast standby for internal reports while merchant settlement runs on one server, and settlement is down for two days. The module separates strategy from solution, then covers options before, during and after a disruption, the tests of time frame and capacity, an options analysis, three tests for selection, cost tiers, the eight resource types of clause 8.3.4, dependencies, and a logistics company in Toronto.

What you will be able to do

• Identify options for before, during and after a disruption
• Select solutions on time frame, risk appetite, cost and benefit
• Determine the resources each chosen solution needs

Why it matters

Spend in proportion to impact: the same budget spent upside down leaves the activity that matters with nothing to switch to.

Practice: Practice: Strategies and solutions · 3 questions

At two in the morning XYZ Ltd., in Singapore, loses its primary data centre and nobody knows who may approve the switch to the second site. The module covers the five qualities of procedures, the response structure with crisis, incident and recovery teams, the eight abilities teams must have collectively, life safety first, pre-defined activation thresholds, a deputy for every role, a hospital in Hong Kong and a smaller logistics company in London.

What you will be able to do

• Write procedures that are specific, flexible and clear on roles
• Set a response structure with teams and activation thresholds
• Name a trained deputy with the same authority for every role

Why it matters

Someone decided who decides long before the night, so the first hour is not lost to phone calls up the line.

Practice: Practice: Plans, procedures and the response structure · 3 questions

When card payments fail at lunchtime, a XYZ Ltd. message to merchants takes three approvals and two hours to write. The module covers the six procedures in clause 8.4.3, a communication matrix of what, when, with whom and how, receiving and logging incoming messages and risk advisories, means that work in a disruption, a typhoon warning for Manila, a fire at a logistics company in Dubai, a holding statement, templates and a decision log.

What you will be able to do

• Document who is told what, when and how in a communication matrix
• Prepare message templates for your most likely scenarios
• Keep a time-stamped log of actions and decisions

Why it matters

Silence gets filled by rumours, so words written before the day let you be the first voice your customers hear.

Practice: Practice: Warning and communication · 3 questions

XYZ Ltd.'s first eighty-page plan sits on a file server that fails with everything else, and the settlement team improvises. The module covers the definition of a business continuity plan, what the plans contain collectively, a set of plans for a Singapore payments company, the eight elements in clause 8.4.4.3 with a settlement plan outline, action cards, standing down by criteria, welfare, recovery from temporary measures, and a hospital in Sydney.

What you will be able to do

• Include the eight required elements in each plan
• Make plans usable with action cards and offline copies
• Document how activities return from temporary measures

Why it matters

A plan is only as good as its use on the day, so one short card in the right hands beats eighty pages nobody can open.

Practice: Practice: Business continuity plans and recovery · 3 questions

A retail chain's tender asks XYZ Ltd. how it knows its plans work, and two years ago the only answer was that they were approved. The module covers the programme and the seven conditions of clause 8.5, exercise against test, a ladder of four exercise types, a first-year programme, six design steps, safeguards for full tests, running and debriefing, a post-exercise report, and a logistics company in Hong Kong.

What you will be able to do

• Plan a programme of exercises and tests over time
• Design an exercise with aims, scenario, injects and roles
• Write a post-exercise report and close every action

Why it matters

How do we know it works? Because we tried it, and a client's tender can see the report and what changed.

Practice: Practice: The exercise programme · 3 questions

XYZ Ltd.'s call-centre partner in Manila has a backup site with no access to XYZ Ltd.'s systems, found only because someone checked. The module covers the five parts of clause 8.6, suitable, adequate and effective, and the three moments of evaluation. It shows an evaluation schedule, what to ask partners and suppliers, a four-question post-incident review, and checks against legal requirements, ISO 22313 and the policy, with a hospital in London.

What you will be able to do

• Evaluate plans as suitable, adequate and effective on evidence
• Ask critical partners and suppliers for plans, recovery times and exercise reports
• Run a post-incident review that updates documents

Why it matters

Plans that were right when approved can be years out of date, and evaluation finds that before the day they are needed.

Practice: Practice: Evaluating plans, partners and suppliers · 3 questions

The board of XYZ Ltd. asks whether it is ready, and one answer is an opinion while the other is four numbers. The module covers the four decisions of clause 9.1, measures that show capability, a monitoring plan, valid methods using a logistics company in Sydney, and analysing trends. Then clause 9.2: the audit programme built on importance and previous results, five steps of each audit, one finding followed through, and exercise against audit.

What you will be able to do

• Choose measures that show capability and decide how, when and by whom
• Build an audit programme from importance and previous results
• Follow a finding to verified closure

Why it matters

Measure it, or you are guessing: your own checks should find the gaps before a real disruption does.

Practice: Practice: Monitoring, measurement and internal audit · 3 questions

An exercise shows XYZ Ltd.'s secondary data centre cannot carry peak payment volume, and the yearly review buries it on slide thirty-two. The module covers clause 9.3.1, the eleven inputs of clause 9.3.2 including the business impact analysis and lessons from near misses, how to prepare an input pack, the decisions in clause 9.3.3.1 with owners and dates, and retaining, communicating and acting on results.

What you will be able to do

• Prepare the eleven inputs of clause 9.3.2 as a short pack
• Present results as decisions with options and costs
• Retain, communicate and act on the review's results

Why it matters

A review with no decisions leaves the next exercise to fail in exactly the same way a year later.

Practice: Practice: Management review inputs and decisions · 3 questions

A missed recovery time at XYZ Ltd. traces back to a runbook naming a replaced server, and the real fix is a step in the change process. The module defines nonconformity, where they come from, and the steps of clause 10.1.2. It separates correction from corrective action, uses a why method, shows a corrective action record, covers changes to the system, and continual improvement in clause 10.2 with a logistics company in Mumbai.

What you will be able to do

• Separate a correction from a corrective action
• Find the cause in the process and check for similar cases
• Close an action only on evidence that it worked

Why it matters

Fix the problem, then fix the cause, or the same nonconformity returns in a real outage.

Practice: Practice: Corrective action and continual improvement · 3 questions

A settlement bank asks XYZ Ltd. for its current recovery plan and last exercise report, and the team sends two hundred files that include neither. The module separates documents you maintain from records you retain, explains clause 7.5.1, and goes through the required items in clauses 4 to 10. It covers why the impact analysis and risk assessment should still be recorded, what most organisations add, a documented information list and control of plans.

What you will be able to do

• Tell documents you maintain from records you retain
• List the items each clause requires and mark the rest as your choice
• Control plans so the current version is available where needed

Why it matters

Knowing exactly what is required, and keeping it current, means the two documents a bank asks for are found in minutes.

Practice: Practice: The documented information you need · 3 questions

A retailer's tender asks XYZ Ltd., a Singapore payments company, for ISO 22301 certification within a year. The module covers starting with top management and a gap assessment, four phases of a road map (set up, build, check, certify), a first tabletop exercise, eight readiness checks, the 2024 climate change point, four questions for a certification body, stage 1 and stage 2, the cycle after the certificate, and what comes next in this training course.

What you will be able to do

• Plan a dated road map with outputs, owners and dates
• Run a first exercise before the certification audit
• Check readiness against eight points and explain stage 1 and stage 2

Why it matters

Certification follows a system that already works, so starting with owners and a gap assessment wins the tender that copied plans lose.

Practice: Practice: Your road map and certification readiness · 3 questions