Support for ISO 22301 Business Continuity
ISO 22301 Clause 7
This clause requires the organisation to provide the resources, competence, awareness, communication and documented information needed for the BCMS.
ISO 22301 Clause 7 - Support
Clause 7 covers what the BCMS needs to function. The clause sits between Clause 6 (planning) and Clause 8 (operation), and it is where the standard sets out the foundations - resources, the right people, awareness across the organisation, communication arrangements, and the documented information that records and controls everything else. The structure mirrors Clause 7 in other Annex SL standards like ISO 9001, ISO 14001, ISO 45001 and ISO 27001, so organisations integrating multiple management systems often share these arrangements.
Sub-clauses of ISO 22301 Clause 7
Clause 7.1 - Resources requires the organisation to determine and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the BCMS. The clause does not require any specific documented information, and is typically evidenced by the overall presence of a working BCMS rather than a separate document.
Clause 7.2 - Competence requires the organisation to determine the competence required of people whose work affects business continuity performance, ensure those people are competent, take action where necessary to acquire competence, and retain documented information as evidence.
Clause 7.3 - Awareness requires the organisation to ensure people doing work under its control are aware of the business continuity policy, their contribution to the BCMS, the implications of not conforming, and their own role and responsibilities before, during and after a disruption.
Clause 7.4 - Communication requires the organisation to determine the internal and external communications relevant to the BCMS - what, when, with whom, how and by whom.
Clause 7.5 - Documented Information requires the organisation to include in the BCMS the documented information required by the standard and any further documented information needed for effectiveness, and to control that information for availability, suitability, protection, distribution, change and retention.
