Documented Information for ISO 22301 Business Continuity
ISO 22301 Clause 7.5
This sub-clause requires the organisation to maintain the documented information required by the standard and control it for availability, distribution, change and retention.
ISO 22301 Clause 7.5 - Documented Information
Clause 7.5 is the document control clause. It splits into three parts: general (what documented information has to exist), creating and updating (how to mark and approve it) and control (how to make sure it stays available, current and protected). The clause is shared in spirit with Clause 7.5 of ISO 9001 and other Annex SL standards, so organisations with an existing document control process usually only need to confirm it covers the BCMS-specific records.
What ISO 22301 Clause 7.5 Requires
Under Clause 7.5.1, the BCMS must include the documented information required by ISO 22301 and any further documented information the organisation determines is necessary for the BCMS to be effective. The standard names specific documented information requirements throughout - the policy, the scope, the BIA, the risk assessment, the business continuity plans, the management review records and so on. Anything else the organisation finds useful is also in scope.
Under Clause 7.5.2, when documented information is created or updated, the organisation must ensure appropriate identification (title, date, author, reference number where relevant), format and media, and review and approval for suitability and adequacy.
Under Clause 7.5.3, documented information must be controlled to ensure it is available and suitable for use where and when needed, and adequately protected from improper use, loss of confidentiality, integrity or availability. Control activities include distribution, access, retrieval, storage, change control, retention and disposition. External documents the organisation determines are necessary must also be identified and controlled.
BCMS-Specific Documented Information
For ISO 22301 the documented information landscape includes the IMS manual, the business continuity policy and policy statement, the interested parties register, the legal register entries relevant to continuity, the business continuity register and risk register, the business impact analysis, the business continuity plan, exercise records, audit records and management review records. The business continuity plan in particular has handling considerations - it usually contains personal contact details and should be treated as confidential.
An ISO 22301 documentation audit checklist is the easiest way to make sure nothing is missed. Run through the standard, tick off each documented information requirement, identify which document covers it, and check the version control on each. The document register holds the master list.
The BC plan is the document that needs the tightest control. It will hold names, phone numbers, sometimes home addresses for the response team. Treat it as confidential, give controlled distribution, and make sure that when someone leaves the team the plan is updated promptly. Out-of-date contact details in a BC plan are worse than no plan at all.
Practical Compliance Guidance
The F-IMS20 Document Register provides the master list of BCMS documented information. The PP-1-08 Files, Documents and Records Policy describes the document control process. Audit-readiness can be tested using the ISO 22301 Management System Audit Checklist.
| alphaZ document | How to use it |
|---|---|
| ISO 22301 Toolkit | The full set of policies, procedures, registers and plans that build a BCMS to the requirements of the standard. |
| F-IMS20 Document Register | The master register of BCMS documented information, version, owner and review date. |
| PP-1-08 Files, Documents and Records Policy | The policy procedure that defines how documented information is created, controlled, retained and disposed of. |
| ISO 22301 Management System Audit Checklist | Used to verify that all documented information required by the standard is in place and current. |
Subscribers to alphaZ have access to all of these documents and supporting material. Find out more about the alphaZ subscription.
