Compliance FrameworksInternational
ISO 22301
Business Continuity Management: software asset inventory for recovery, supplier dependencies.
Business Continuity Management: software asset inventory for recovery, supplier dependencies.
| Region | International |
| Country or scope | International |
| Sector | General |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers ISO 22301
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 15 controls from Safeguard's control catalog for ISO 22301.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 26: 4 written for ISO 22301 and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
ISO22301-8.2.2-INV BIA Resource Identification | The business impact analysis must identify the resources needed to support prioritized activities, including an inventory of the software components those activities depend on (ISO 22301:2019 §8.2.2, Business impact analysis) | Scan |
ISO22301-8.2.2-SUP Supplier Dependency Mapping | Dependencies on partners and suppliers must be identified in the BIA, which maps to knowing the supplier of each software component (ISO 22301:2019 §8.2.2, dependencies including suppliers) | Scan |
ISO22301-8.2.2-DEP Dependency Chain Documentation | Understanding how a disruption propagates requires documented dependency relationships between components (ISO 22301:2019 §8.2.2, dependency analysis) | Scan |
ISO22301-8.3-VER Recovery-Grade Version Records | Continuity strategies and solutions must enable restoring activities within recovery objectives, which requires knowing the exact versions of software to rebuild (ISO 22301:2019 §8.3, Business continuity strategies and solutions) | Scan |
ISO22301-8.2.3 Risk Assessment of Disruption | The risk assessment must identify risks of disruption to prioritized activities, which for software risk requires components identifiable against known-vulnerability sources (ISO 22301:2019 §8.2.3, Risk assessment) | Scan |
ISO22301-8.4-DOC Documented Continuity Information | Plans and procedures must be maintained as documented, dated information, satisfied by an SBOM with document identity and creation timestamp (ISO 22301:2019 §8.4, Business continuity plans and procedures) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
ISO22301-4.1 | Understanding the Organisation and Its Context |
ISO22301-4.2 | Understanding Needs and Expectations of Interested Parties |
ISO22301-5.1 | Leadership and Commitment |
ISO22301-6.1 | Actions to Address Risks and Opportunities |
ISO22301-6.2 | Business Continuity Objectives and Planning |
ISO22301-7.1 | Resources for the BCMS |
ISO22301-8.2 | Business Impact Analysis |
ISO22301-8.3 | Risk Assessment for Business Continuity |
ISO22301-8.4 | Business Continuity Strategies and Solutions |
ISO22301-8.5 | Business Continuity Plans |
ISO22301-8.6 | Exercise and Testing Programme |
ISO22301-9.1 | Monitoring, Measurement, Analysis and Evaluation |
ISO22301-9.2 | Internal Audit of the BCMS |
ISO22301-10.1 | Nonconformity and Corrective Action |
ISO22301-10.2 | Continual Improvement of the BCMS |
Policy templates
Written for ISO 22301:
- Business Continuity Management System (BCMS) Policy
- Business Continuity Plan Template
- Business Impact Analysis Policy and Procedure
- BCMS Exercise and Testing Policy
And 22 from the standard set, adapted to ISO 22301.