The register

The 26 requirements the draft aligns with

One page per clause of ISO 22301:2019, the requirements standard a certificate is issued against. Each page states the requirement in our own words, cites the clause, and gives the evidence an auditor asks for. The draft adds a process view; it does not change these requirements.

Clause numbers and titles stay as the standard writes them. Every other line is our own statement. How the record is written.

4. Context of the organization

Clause	Record	The answer in one line	Evidence
4.1	Understanding the organization and its context	The BCMS has to rest on a written view of what could stop it delivering continuity, inside and outside the organization, kept current as the business changes.	3 lines
4.2	Needs and expectations of interested parties	Keep a register of who has a stake in continuity and what each of them actually requires, including the legal and regulatory obligations that attach to keeping services running.	3 lines
4.3	Determining the scope of the BCMS	Fix and document which parts of the organization, which products and which services sit inside the BCMS, and justify every exclusion in writing.	3 lines
4.4	The BCMS and its processes	Establish, operate, maintain and improve the BCMS, including the processes it needs and how they interact, and be able to show the system ran rather than existed.	3 lines

5. Leadership

Clause	Record	The answer in one line	Evidence
5.1	Leadership and commitment	Top management has to own the BCMS in practice: align it with strategy, integrate it into how the business runs, resource it, and hold managers accountable.	4 lines
5.2	Business continuity policy	A current policy, set by top management, that fits the organization, frames the objectives, commits to requirements and improvement, and reaches the people who need it.	3 lines
5.3	Roles, responsibilities and authorities	Assign and communicate the roles the BCMS depends on, name who is accountable for conformity and who reports performance to top management, and provide deputies.	3 lines

6. Planning

Clause	Record	The answer in one line	Evidence
6.1	Actions to address risks and opportunities	Plan for what could help or hinder the management system itself, and keep that register separate from the disruption risks handled in the impact analysis.	3 lines
6.2	Business continuity objectives and planning	Set continuity objectives that are measurable, consistent with the policy, and each with a plan that says what will be done, by whom, by when and how it will be judged.	3 lines
6.3	Planning changes to the BCMS	Make BCMS changes in a planned way, with the purpose, the consequences, the effect on the system, the resources and the accountability all written down.	3 lines

7. Support

Clause	Record	The answer in one line	Evidence
7.1	Resources	Determine what the BCMS needs to run and keep it provided through establishment, operation, maintenance and improvement, not only at implementation.	3 lines
7.2	Competence	Define the competence each continuity role needs, make sure the holder has it, act where it is missing, evaluate the action, and keep the evidence.	4 lines
7.3	Awareness	Everyone must know the policy, how their work affects continuity, what better continuity delivers, what nonconformity costs, and their own part before, during and after a disruption.	3 lines
7.4	Communication	Decide what will be communicated, when, to whom, how and by whom, inside and outside the organization, and test the plan before a disruption tests it.	3 lines
7.5	Documented information	Keep the information the BCMS depends on, create and update it to a defined standard, and control it through its life: approval, access, retention and disposition.	3 lines

8. Operation

Clause	Record	The answer in one line	Evidence
8.1	Operational planning and control	Set criteria for each operational process, run it against them, keep the records, control planned change, review unintended change and control what suppliers do.	4 lines
8.2	Business impact analysis and risk assessment	Establish what disruption would cost over time, set the point beyond which it is unacceptable, prioritize activities and their recovery, and judge the events that could cause it.	5 lines
8.3	Business continuity strategies and solutions	Choose strategies from the impact and risk findings, select the solutions that deliver them, work out the resources and implement them so they can actually be activated.	4 lines
8.4	Business continuity plans and procedures	Maintain a response structure, warning and communication, plans for prioritized activities and recovery procedures, derived from the solutions and available where responders are.	4 lines
8.5	Exercise programme	Run a planned programme of exercises and tests with stated aims and scenarios, cover every strategy over the cycle, report formally, act on the findings and review the programme itself.	5 lines
8.6	Evaluation of documentation and capabilities	Evaluate whether the analysis, strategy, solutions, plans and procedures are still suitable, adequate and effective, including the capability of key partners and compliance with the law.	5 lines

9. Performance evaluation

Clause	Record	The answer in one line	Evidence
9.1	Monitoring, measurement, analysis and evaluation	Decide what to measure, how, when and by whom, keep the results, analyse them and use them to judge whether the BCMS is performing and effective.	4 lines
9.2	Internal audit	Audit the BCMS on a planned basis with objective, competent auditors, and run the programme so findings are tracked to verified closure.	4 lines
9.3	Management review	Review the BCMS at planned intervals against the defined inputs, record the decisions and track the actions, with top management present rather than represented.	4 lines

10. Improvement

Clause	Record	The answer in one line	Evidence
10.1	Nonconformity and corrective action	React to a nonconformity, correct it, find the cause, check whether it exists elsewhere, act in proportion, review the action and keep the record.	4 lines
10.2	Continual improvement	Keep making the BCMS more suitable, adequate and effective, using qualitative and quantitative evidence from analysis, evaluation and management review.	4 lines

The register is not the draft. The draft text is not public. Its 10 process readings sit in the process model and each says whether it is stated in the public record, our reading, or not stated.