ISO 22301 for the CEO: how long can a site be down, and who signs off the RTO?

A customer asks how fast we can resume supply after an incident. What should the CEO answer with?

As the service page puts it, customers do not ask whether you will have an incident, but how fast you keep supplying afterwards. Three records answer that:

• The BIA report: which activities are critical, the financial loss from disruption, the maximum tolerable period of disruption (MTPD), and the RTO/RPO derived from it
• Continuity strategies and plans: redundancy for people, sites, equipment, ICT and suppliers, plus response, crisis communication and recovery plans
• Exercise records: auditors and customers both treat them as the test of whether the system is real

The certification phase listed on the service page includes a customer questionnaire evidence pack. What the CEO must check is whether the recovery time promised to customers is backed by a BIA and exercises; if not, the promise itself is a risk.

Who decides the RTO and RPO? When redundancy falls short, how is the investment decided?

According to the service page:

1. Interview to identify critical activities and how impact grows over time, and set the maximum tolerable period of disruption (MTPD).
2. The RTO must be shorter than the MTPD; the RPO is set by how often data changes and how much data loss is tolerable.
3. Management then approves them and checks back whether current redundancy can deliver; if it cannot, that is an investment decision.

A common mistake is to copy an impressive RTO without the capability behind it. When signing off, the CEO can ask to see three things together: the disruption loss estimated by the BIA, the options and cost of strengthening redundancy, and the residual risk to disclose to customers and the board if nothing is strengthened. Recognition of costs and financial effects is for the finance head and the external auditor to judge.

We already have a BCP. Why do the board or customers still want ISO 22301?

• A BCP is a plan document; ISO 22301 is a full management system covering the BIA, strategies, plans, exercises and continual improvement, and it is certifiable by a third party (3-year cycle).
• No exercise, no credit: without a BIA-derived RTO and exercise records, a plan counts as non-existent in audits and customer reviews.
• Exercise frequency: clause 8.5 of ISO 22301 requires exercises under a programme at planned intervals and after significant changes; the practical baseline listed on the service page is at least one full or functional exercise a year plus scenario-based tabletop exercises.
• Current edition: ISO 22301:2019 with Amendment 1 of 2024 (organisations must determine whether climate change is a relevant issue); the third edition is still at committee draft stage with no publication date, so certification is still against the 2019 edition.

Whether to certify can follow customer demand; the BIA and exercises are the baseline either way.

How should disruption risk go into the board's risk report?

• Risk category: Article 18 of the TWSE Risk Management Best Practice Principles for Listed Companies groups risks into strategic, operational, financial, information, compliance, integrity and other emerging risks; disruption is an operational risk.
• One language: the service page runs the BIA in ERM risk language, sharing a scenario library with the enterprise risk map, so continuity risk sits on the ERM risk map.
• Reporting rhythm: the promotion unit compiles and reports at least once a year (Article 15); exercise records and BIA results go straight into the same report.
• ESG indicator G-18: risk management overseen by the audit committee or a board-level functional committee, with a report to the board at least once a year; an AA item worth one extra point overall.

These principles and the ESG evaluation apply only to listed companies; companies that are not public companies are not covered and can use them voluntarily.

When a key supplier fails, what should the CEO check first?

The service page recommends extending the BIA into the supply chain with the ISO/TS 22318 method:

• Identify critical suppliers and single sources
• Assess how their disruption affects the MTPD
• Set up alternative sources and continuity clauses in contracts
• Ask critical suppliers for their BCP or exercise evidence

This is also the question customer questionnaires ask most. Across departments, procurement owns alternative sources and contract clauses, production and sales supply the disruption impact, and IT owns ICT redundancy; the CEO decides which suppliers count as critical and whether to invest in a second source.

EU customers mention NIS2 and DORA resilience requirements. Does ISO 22301 help?

Yes, but keep certificates and legal measures apart:

• NIS2, Article 21: requires business continuity (backup management, disaster recovery) and crisis management measures.
• DORA, Articles 11 and 12: require financial entities to have an ICT business continuity policy, impact analysis, backup and recovery procedures, and annual testing; DORA has applied directly to EU financial entities since 17 January 2025, and Taiwanese ICT providers mostly take on the requirements by contract.
• Neither law issues a certificate, but the ISO 22301 BIA, strategies, plans and exercises are exactly the evidence for these measures; certification is optional, the measures are not.

The CEO can first confirm whether the company is itself an entity in scope or a supplier to one, then decide whether to go for certification or first complete the measures and evidence.

How does Winners Consulting help a CEO with ISO 22301?

This is Winners Consulting's own description; hold us to the questions above.

• Who leads: Winners Consulting is a consultant and does not issue certificates; vice-president and director-level consultants personally lead the work end to end, never outsourced; a third-party body certifies, and we accompany you
• Method: built around clause 8 of 22301, with the BIA done using ISO/TS 22317, backup and ICT redundancy documents shared with ISO 27001, and continuity risk placed on the ERM risk map
• Exercises are part of the delivery: every project runs at least one tabletop and one functional exercise, and the records are the evidence for certification and customer questionnaires
• Timeline (as listed on the service page): scope and BIA (4–6 weeks), strategy and plans (4–6 weeks), exercises and correction (4–8 weeks), audit and certification (3–6 weeks), usually 4–7 months
• First step: the first mechanism diagnosis is free

Go deeper: ISO 22301 business continuity management, Choosing an ISO 22301 consultant, ISO 22301 budget and timeline, ERM consulting, CRO role page