What is a BCMS? Business continuity management system under ISO 22301
A BCMS (business continuity management system) is the whole of the agreements, roles, processes and controls an organisation uses to manage its business continuity. The term comes from ISO 22301, which describes which components a BCMS must have to be certified. The system revolves around business continuity and the agreements in the business continuity plan. A BCMS is therefore not software and not a single document. It is a way of working that you can demonstrate.
A BCMS is the system around the plan. The business continuity plan is one of the documents within it.
Why a BCMS and not just a plan?
A plan goes out of date quickly. A system makes sure the plan is updated, tested and improved. Picture a company that wrote a perfect continuity plan in 2024. By 2026, half of its systems have been replaced, there are new suppliers, and two employees have left. Without a BCMS, the plan still sits on the shared drive, but it no longer matches reality.
A BCMS keeps track of this. It records who maintains the plan, how often it is tested and what happens with the outcomes.
The components of a BCMS
ISO 22301 follows the structure of the PDCA cycle (plan, do, check, act): plan, carry out, check and improve. For the BCMS, this means the following in practice:
| Component | Question it answers | Where you find it |
|---|---|---|
| Context and scope | What falls within the BCMS and what does not? | Step-by-step plan |
| Leadership | Who owns it and who decides? | Requirements of the standard |
| Risk and BIA | What is critical and how long can it be down? | BIA, RTO and RPO |
| Continuity strategy | Which alternative bridges the outage? | Business continuity plan |
| Procedures and crisis management | What do we do at the moment itself? | Crisis management |
| Testing and exercises | Does the plan really work? | Exercising and testing |
| Evaluation and improvement | What do we learn and what do we change? | The audit process |
This table shows that a BCMS is more than one document. Each row produces evidence that an auditor can check.
BCMS and BCP: what is the difference?
A BCP (business continuity plan) is the document with the concrete agreements. The BCMS is the system that feeds, maintains and checks the plan.
| BCP | BCMS | |
|---|---|---|
| What is it? | A document or set of documents | A management system |
| When is it finished? | After it has been written | Only once it works and keeps improving |
| Who manages it? | Usually one owner | Management, process owners and administration together |
| Evidence | The plan itself | The plan, exercise reports, decisions and improvement actions |
A BCP without a BCMS is often a good-looking document that nobody knows a year later. A BCMS without a BCP lacks content. You need both.
An example: a BCMS for a small company
An installation company with fifteen employees wants to start ISO 22301. The company keeps it small:
- The director owns the BCMS and signs off the scope: scheduling, invoicing and the service desk.
- The BIA shows that the service desk must be back within one day.
- The business continuity plan describes that fault reports come in temporarily through the planner’s mobile phone.
- Every quarter, a short exercise takes place. The planner takes the phone home and handles a test report.
- After each exercise, one improvement point goes on the action list, with an owner and a date.
This is a working BCMS on a small scale. It does not need to be bigger to be demonstrable.
How to build a BCMS in one year
You build a BCMS step by step. This is a realistic order for a small or medium-sized business (SME), with a small group of people involved:
| Quarter | What you do | Evidence you produce |
|---|---|---|
| 1 | Define the scope and appoint an owner | Approved scope, mandate |
| 2 | Carry out a BIA for the critical processes | BIA table, approved RTO and RPO |
| 3 | Write the continuity strategy and plans | Business continuity plan, IT plan |
| 4 | First exercise and internal check | Exercise report, action list |
After the first year, the cycle starts again. You adjust the BCMS to what the exercises and incidents have shown. That is also exactly what an auditor wants to see at the surveillance audit: that something has changed because of what was learned the year before.
Common mistakes
| Mistake | Consequence | Better approach |
|---|---|---|
| Only writing down a BCMS | Nobody uses it | Start with one process and make it work |
| Not appointing an owner | It gets lost in day-to-day pressure | Appoint one accountable person with a mandate |
| No improvement actions from exercises | The same mistakes keep coming back | Record every outcome with an action and a date |
| Choosing too broad a scope | The project gets stuck | Start with the critical processes |
How the BCMS fits into certification
For certification, you must demonstrate that the BCMS works. The auditor visits in two stages: first to check whether the system is right on paper, then to see whether it works in practice. We describe the full process on the page the audit process. For costs and lead time, see costs and timeline.
Frequently asked questions about the BCMS
Is a BCMS software? Not necessarily. Software can help you keep track of documents and actions, but the BCMS is a way of working.
Does a BCMS always need to be certified? No. You can set up a BCMS without a certificate. The certificate is the proof for third parties.
How do I start? Begin with the scope and the BIA. The step-by-step plan shows the order.
For the concept on which the BCMS rests, read what business continuity is.