Overview - ISO/TS 22331:2018 and business continuity strategy
ISO/TS 22331:2018, "Security and resilience - Business continuity management systems - Guidelines for business continuity strategy", provides practical guidance for determining and selecting business continuity strategies. Applicable to organizations of any type, size or sector (private, public, not‑for‑profit), it supports those responsible for strategy design within a Business Continuity Management System (BCMS) or a broader business continuity programme. The technical specification is consistent with ISO 22301 and focuses on turning business impact analysis and risk assessment outcomes into effective continuity strategies.
Key topics and technical requirements
- Scope and applicability: Guidance for strategy determination and selection for all organizations.
- Prerequisites: Define context and scope; identify interested parties; assign roles, authorities and competencies; secure top management commitment; allocate resources; complete business impact analysis (BIA) and risk assessment.
- Strategy determination process: Principles, planning, initial design considerations, gap analysis, strategy consolidation and categorization.
- Strategy types: Options for protecting, stabilizing, continuing, resuming and recovering prioritized activities and resources.
- Selection and approval: Choosing strategies based on BIA and risk assessment results, documenting selected options, obtaining management approval.
- Implementation and monitoring: Guidance on next steps - implementing strategies, establishing business continuity procedures, monitoring performance and management review for continual improvement.
- Outcomes expected: Measures to reduce incident frequency and impact; financial planning for response; communications capabilities; alternate workspace and personnel arrangements; ICT recovery; alternative supply chain and delivery methods.
Practical applications - who uses it and why
- Business continuity managers and BCMS practitioners use ISO/TS 22331:2018 to translate BIA and risk assessments into actionable business continuity strategy options.
- Senior leadership and decision-makers use it to evaluate resource needs, strategy approvals and organizational resilience investments.
- Emergency planners, IT disaster recovery teams and supply‑chain managers use it to design alternate workspaces, ICT recovery strategies and supply chain continuity measures.
- Consultants and auditors reference it when aligning continuity programmes with ISO 22301 requirements or when developing continuity procedures and testing plans.
Related standards
- ISO 22301 - Business continuity management systems - Requirements
- ISO 22300 - Security and resilience - Vocabulary
- ISO Guide 73 - Risk management - Vocabulary
- ISO 22313 - Guidance on implementing ISO 22301 (informative references in the technical specification)
ISO/TS 22331:2018 is a practical, standards‑based roadmap for developing resilient business continuity strategy options that align with organizational context, BIA findings and risk treatment priorities. Keywords: ISO/TS 22331:2018, business continuity strategy, BCMS, business impact analysis, risk assessment, ISO 22301, resilience, continuity planning.