Communication for ISO 22301 Business Continuity
ISO 22301 Clause 7.4
This sub-clause requires the organisation to determine the internal and external communications relevant to the BCMS - what, when, with whom, how and by whom.
ISO 22301 Clause 7.4 - Communication
Clause 7.4 covers the routine communication arrangements that surround the BCMS. It does not deal with incident-time warning and communication - that is handled separately in Clause 8.4.3. What 7.4 deals with is the everyday business of who knows what about the BCMS, when they hear about it, and how.
What ISO 22301 Clause 7.4 Requires
The clause requires the organisation to determine the internal and external communications relevant to the BCMS, including what will be communicated, when it will be communicated, with whom it will be communicated, how it will be communicated and who will communicate. There is no specific documented information requirement, but most organisations find it easier to record the communication arrangements in the IMS manual or in a dedicated communications policy.
The Difference Between 7.4 and 8.4.3
It is worth being clear about the boundary. Clause 7.4 is the steady-state communication arrangement - how the policy is shared with staff, how interested parties are kept informed about the BCMS, how performance is reported to top management. Clause 8.4.3 is the incident-time arrangement - how the response team alerts staff, communicates with regulators, talks to the media and keeps customers informed during an actual disruption. The two have to be designed together but they sit in different clauses for a reason.
The simplest approach is a communications table or matrix in the IMS manual that lists each topic, audience, frequency, channel and owner. Add a row for each significant BCMS communication - policy publication, objective updates, audit results, post-exercise reports, management review outcomes - and the clause is met.
Part of the communication thinking should cover how customers find out if the organisation is having an outage. That sometimes belongs in 8.4.3, sometimes in 7.4 - the steady-state communications strategy might say "customer-facing service status updates are published on the website status page" and the incident-time procedures kick in to actually populate it. Both clauses then point at each other.
Practical Compliance Guidance
The P-17 Communications Policy provides the framework for both internal and external communications, including BCMS-specific arrangements. The IMS manual section on communications captures the routine BCMS communication matrix. Incident-time communications are recorded separately in the F-Q94 Business Continuity Plan.
| alphaZ document | How to use it |
|---|---|
| ISO 22301 Toolkit | The full set of policies, procedures, registers and plans that build a BCMS to the requirements of the standard. |
| P-17 Communications Policy | The communications policy that covers internal and external arrangements, with BCMS-specific elements integrated. |
| IMS1 - ISO 22301 Manual | Section 3.3 of the manual records the routine BCMS communication arrangements - what, when, with whom, how and by whom. |
Subscribers to alphaZ have access to all of these documents and supporting material. Find out more about the alphaZ subscription.
