Straight answers to the questions buyers ask
Short, checkable answers about the draft, the standard in force and the preparation that is useful under either outcome. Each links to the clause or record behind it.
| Question | The answer in brief |
|---|---|
| What is ISO 22333? | ISO/DIS 22333 is a draft International Standard from ISO/TC 292 on guidelines for business continuity management system processes. Read the full answer |
| Is ISO 22333 published? | No. Read the full answer |
| Does ISO 22333 replace ISO 22301? | No. Read the full answer |
| ISO 22333 vs ISO 22313: what is the difference? | ISO 22313:2020 is the published guidance on the use of ISO 22301 and is available today. Read the full answer |
| What is a BCMS process reference model? | A description of the BCMS as a set of processes, each with a purpose, a set of outcomes and the interfaces it shares with other processes. Read the full answer |
| How do I prepare for ISO 22333? | Do the work that is useful whatever the ballot does: name an owner and a deputy for each operational process, write a criterion and keep a record for each, refresh the impact analysis so the recovery targets are justified, derive the plans from the chosen solutions, and run an exercise with a stated aim. Read the full answer |
| Does a guidance document change my certificate? | No. Read the full answer |
| What evidence does an ISO 22301 auditor ask for? | Evidence that each requirement produced its outcome: a context analysis with issues tied to continuity outcomes, an impact analysis with impact over time and approved recovery targets, a strategy traceable to those targets, plans derived from the strategy, an exercise programme with aims and reports, and an evaluation that updates the documentation. Read the full answer |