ISO 22301 Alignment Guide
Companion resource to my CBCI study series. A high-level, clear breakdown of how the BCI Good Practice Guidelines (GPG 7.0) align with and actualise the strict requirements of the ISO 22301:2019 standard.
CBCI Study Series · Companion Resource
Connecting the Skeleton to the Muscle: BCI GPG 7.0 & ISO 22301:2019
A common area of confusion for candidates preparing for the Certificate of the Business Continuity Institute (CBCI) examination is the precise relationship between the BCI Good Practice Guidelines (GPG) Edition 7.0 and international standards, specifically ISO 22301:2019. These frameworks are not competing systems; rather, they are deeply aligned, complementary toolkits designed to work in tandem to establish organisational resilience.
To succeed on exam day, you must grasp the conceptual division of labor between the two. ISO 22301:2019 represents the standard of requirements—it dictates the 'what' an organisation shall do to implement, operate, and certify a formal Business Continuity Management System (BCMS). The BCI GPG Edition 7.0, on the other hand, represents the good practice guidance—it describes the prescriptive 'why' and 'how' for practitioners to execute, coordinate, and deliver those requirements successfully within real-world operating environments.
The Plan-Do-Check-Act (PDCA) Engine
In absolute alignment with ISO requirements for management systems, both ISO 22301 and the BCI GPG 7.0 structure their lifecycle around the classic Plan-Do-Check-Act (PDCA) continuous improvement cycle. This replaces the old BCM 'Lifecycle' model with a far more holistic and scalable system of management processes. Under this framework, the BCI's six Professional Practices (PPs) operate as the operational engine that drives the PDCA cycle forward:
- Plan (Establish): Mapped to PP1 (Establishing a BCMS) and PP2 (Embracing Business Continuity). This stage focuses on understanding the organisational context, building senior leadership commitment, defining the BC policy, establishing high-level governance, and actively measuring and improving the underlying corporate continuity culture.
- Do (Implement & Operate): Mapped to PP3 (Analysis), PP4 (Solutions Design), and PP5 (Enabling Solutions). This represents the core technical execution of the program: estimating business impacts over time to determine recovery priorities (BIA), assessing risks to identify Single Points of Failure (SPOFs), design-tiering recovery solutions, designating command hierarchies, and authoring actionable playbooks.
- Check (Monitor & Review): Mapped to PP6 (Validation). This stage evaluates the suitability, adequacy, and overall efficacy of the implemented systems. It uses exercises to stress-test resources, formal Quality Assurance (QA) reviews to check documentation, and independent audits to verify compliance against policies and standards.
- Act (Maintain & Improve): Mapped to PP1 (Governance) and PP6 (Validation). Following live incidents or simulated exercise debriefs, the organisation captures lessons learned in a no-blame environment, implements corrective actions to resolve gaps, and reviews organisational change to continually update and strengthen the BCMS.
ISO 22301:2019 to BCI GPG 7.0 Mapping Matrix
To help you visualise how the specific, legal clauses of ISO 22301 (Clauses 4 through 10) map back directly to the practical chapters of the BCI Good Practice Guidelines, use the following master mapping reference matrix as a study check:
| ISO 22301 Clause | Description | BCI GPG Professional Practice | Core Aligned Requirement |
|---|---|---|---|
| Clause 4 | Context of the Organisation | PP1: Establishing a BCMS | Determine internal/external issues, identify interested parties and their legal obligations, define organisational boundaries, and document explicit justifications for any scope exclusions. |
| Clause 5 | Leadership | PP1: Establishing a BCMS PP2: Embracing BC |
Top management must demonstrate active commitment, establish and communicate a clear BCM Policy, provide resources (budget, time, and competent staff), and assign key governance roles. |
| Clause 6 | Planning | PP1: Establishing a BCMS PP3: Analysis |
Identify management-level risks and opportunities (6.1) and establish measurable corporate Business Continuity Objectives. (Setting actual recovery targets maps strictly to PP3). |
| Clause 7 | Support | PP1: Establishing a BCMS PP2: Embracing BC PP5: Enabling Solutions |
Establish and fund resources, verify and record staff competency (7.2), drive organisational continuity awareness (7.3), coordinate communications, and manage documented information controls (7.5). |
| Clause 8 | Operation | PP3: Analysis (8.2) PP4: Solutions Design (8.3) PP5: Enabling Solutions (8.4) PP6: Validation (8.5) |
The technical heart of the system. Run BIAs & RAs, design strategy options and select recovery solutions (Platinum/Gold/Silver tiers), establish command response hierarchies, and implement exercise programs. |
| Clause 9 | Performance Evaluation | PP6: Validation | Monitor, measure, and evaluate BCMS performance (9.1), plan and conduct independent internal audits at scheduled intervals (9.2), and facilitate formal top management reviews (9.3). |
| Clause 10 | Improvement | PP1: Establishing a BCMS PP6: Validation |
Respond to nonconformities and implement immediate corrective actions (10.1), and continuously drive system-wide suitability, adequacy, and efficiency through PDCA cycles (10.2). |
Critical Study Warnings & Exam Alerts
To lock in a passing score on your Certificate of the BCI (CBCI) exam, you must be extremely careful not to fall for these three highly common conceptual traps that frequently trip up candidates
Summary: Building an Aligned Shield
By aligning the GPG 7.0 Professional Practices with the structural clauses of ISO 22301, practitioners can establish a comprehensive, compliant, and deeply resilient BCMS. The ISO standard protects the organisation from a regulatory, financial, and strategic perspective, while the Good Practice Guidelines provide the human coordinate to make those safeguards active, practical, and highly effective under pressure.
Disclaimer: This companion guide is compiled from the BCI Good Practice Guidelines (GPG) Edition 7.0 and ISO 22301:2019 standards and is intended strictly as an independent study aid for candidates preparing for the CBCI examination. All trademarks remain the copyright of their respective holding organisations.
