Who sets the RTO and RPO, and how far does the CISO's responsibility go?
The RTO is how soon you must recover; the RPO is how much data you can afford to lose. Both should be derived from the BIA's impact analysis and decided by management, then checked against current backup capability; if capability falls short, it becomes an investment decision.
A common mistake is drawing the target after shooting the arrow: copying an attractive RTO with no matching capability. The CISO's job is to connect recovery objectives to technical verification of backup and disaster recovery, so that budget proposals rest on the BIA and the capability gap.
We already have ISO 27001. What evidence can ISO 22301 share?
It can, and integration is recommended. Both use the Annex SL structure, and 27001 controls A.5.29/5.30 (security during disruption, ICT readiness) connect directly to 22301:
- Backup and ICT continuity documents are shared with 27001
- Integrated implementation shares documents and audits, at lower incremental cost than doing them separately
- Exercise records serve as evidence for both certification and customer questionnaires
Timeline listed on the service page: about 3–5 months with 27001.
How often should we exercise, and what records should the CISO keep?
The standard requires exercises at planned intervals and after significant changes; the practical baseline is at least one full exercise a year plus scenario-based tabletop exercises. The review and improvement records after an exercise matter as much as the exercise itself. A BCP without exercise records counts as non-existent in audits and customer reviews.
Security scenarios can include ransomware: within the ISO 22301 framework, build a ransomware BCP chapter with an IT-DRP, a crisis communication SOP and a procedure for working with law enforcement, and exercise rebuilding all IT systems, not just partial recovery.
When a security incident disrupts operations, how does the continuity plan connect to statutory reporting deadlines?
One event may trigger several deadlines, each with its own starting point and receiving authority; first decide which regimes apply to the company:
| Regulation | Deadline |
|---|---|
| GDPR | Without undue delay and, where feasible, within 72 hours of awareness |
| NIS2 | Early warning in 24 hours, notification in 72 hours, final report within one month |
| DORA | Initial notification within 4 hours of classifying as major and no later than 24 hours from awareness |
| EU CRA | Early warning in 24 hours, notification in 72 hours |
The BCM reporting procedure should include how deadlines are counted, templates for authority notifications, risk-tiered notices to affected persons, and media and investor relations handling.
Can ISO 22301 carry customer questionnaires and NIS2 or DORA resilience requirements? Does the certificate equal compliance?
It can carry the evidence, but the certificate is not compliance. NIS2 business continuity measures, DORA ICT operational resilience and brand owners' supplier backup questions can all be answered from a 22301 system. But NIS2 and DORA have no standalone certificates, and an ISO certificate is not regulatory compliance; first determine whether the company is a covered entity, an EU financial entity, or a supplier to one.
Version: the current edition is ISO 22301:2019 with Amendment 1 of 2024 (organisations must determine whether climate change is a relevant issue); the third edition is still at committee draft stage with no publication date, so implementation today is still certified against the 2019 edition.
How should budget and timeline be planned, and which phases cannot be compressed?
The service page lists four phases taking usually 4–7 months, about 3–5 months with 27001:
| Phase | Timeline |
|---|---|
| Scope and BIA | 4–6 weeks |
| Strategy and plans | 4–6 weeks |
| Exercises and revision | 4–8 weeks |
| Audit and certification | 3–6 weeks |
The BIA and exercises cannot be compressed. Budget depends on the number of critical activities and sites in scope, how deep the BIA goes, and the current state of backup and disaster recovery. Certificates run on a 3-year cycle, with stage 1 and stage 2 audits by a third party.
How does Winners Consulting help a CISO with ISO 22301?
Winners Consulting's approach (test us with the questions above too):
- VP- and director-level consultants lead in person; nothing is outsourced; consultants hold ISO 22301 lead auditor qualifications
- Clause 8 at the core and ISO/TS 22317 for the BIA, sharing backup and ICT continuity documents with 27001
- At least one tabletop and one functional exercise per project, plus an evidence pack for customer questionnaires
- Certification is by a third party; Winners consults and does not certify
ISO 22301 business continuity, Choosing an ISO 22301 consultant, Budget and timeline. Apply for a free mechanism diagnosis
How other roles see this service
Other services for this role
- CISO implementing ISO 27001: board reporting, the ESG bonus point and certification scope
- CISO on ISO 27701 and GDPR: cross-border data, employee data and the 72-hour notice
- CISO facing NIS2: are we in scope, and how to handle several EU countries, the board and reporting?
- CISO facing DORA: serving EU financial clients, what to prepare for contracts, reporting and testing
- CISO facing the EU CRA: who leads, 24-hour reporting, SBOM and budget
- CISO implementing ISO/IEC 29147: reporting channel, CVD policy and CRA reporting
- CISO guide to ISO/IEC 30111: linking vulnerability handling to CRA reporting
- CISO guide to IEC 62443: which parts to pursue and how it relates to the EU CRA
- CISO guide to TISAX: assessment level, ISA2027 and timeline
- CISO guide to ISO/SAE 21434: product security beyond TISAX
- CISO guide to ISO 42001: what AI governance shares with ISO 27001
- CISO and the EU AI Act: what do AI security, logs and human oversight require?
- CISO and trade secret protection: designing classification and access logs that hold up