Build a Business Continuity Management System toward ISO 22301:2019
Training for BCM managers, risk officers, IT operations, compliance, and internal auditors — understand the BCMS clauses, perform Business Impact Analysis, build BCPs & recovery plans, and run internal audits per ISO 19011.
- 4.9/5 · 287 reviews
- 300+ clients nationwide
- 2,000+ trainers
- 1 to hundreds of participants
- Standard · Premium · Private 1-on-1
- Core clauses
- Clauses 4–10Core clauses
- Key outputs
- BIA + BCP + Recovery PlanKey outputs
- Companion guidance
- ISO 22313:2020Companion guidance
- Format
- Inhouse, online, hybridFormat
2,000+ trainers and experts
Our group's teaching network, matched to what your team needs.
See class documentationYou see your trainer first
The trainer's profile, track record and field come with the proposal, before you decide.
4.9 out of 5
287 participant reviews.
300+ clients nationwide and 180,000+ private training sessions completed. Among them: MPR RI, Akademi Militer Magelang, DPRD Provinsi Jawa Timur.
One person to hundreds
Private coaching for one participant, a class for one team, or several cohorts at once.
Three budget levels
- Standard: core class, material fitted to the participants’ work
- Premium: senior trainer, deeper material design
- Private 1-on-1: one participant, one trainer, schedule set by the participant
ISO 22301 Awareness + Internal Auditor training equips your team to understand the BCMS requirements, perform Business Impact Analysis, build continuity plans, and run internal audits per ISO 19011. Neksus trains to readiness; a KAN-accredited certification body performs the audit and issues your ISO 22301:2019 certificate.
The international standard for Business Continuity Management Systems
ISO 22301:2019 is the international standard for Business Continuity Management Systems (BCMS). Its clause structure follows the Annex SL High Level Structure (clauses 4–10), aligned with ISO 9001, 14001, 27001, and 37001. The core of ISO 22301 is Business Impact Analysis (BIA) — analysis of the impact of disruption on critical business processes, definition of Recovery Time Objective (RTO) and Recovery Point Objective (RPO), continuity & recovery strategies, incident response procedures, and exercise & test to validate the plans. ISO 22301 has gained relevance after pandemic-era experience, supply chain disruption, and major cyber incidents. Many financial regulators (e.g. OJK) link BCMS to IT risk management regulation.
- BIA is the foundation — without valid BIA, RTO/RPO becomes guesswork
- Clause 8.5 — exercise & test is mandatory and must be evaluated at least annually
- Clause 8.2 — impact analysis must cover people, process, technology, suppliers, and locations
- Aligned with POJK IT risk management and ISO 27031 (IT readiness for business continuity)
ISO 22301 certificates can only be issued by accredited certification bodies (KAN in Indonesia, internationally recognized via the IAF MLA). Neksus prepares your BCMS to pass Stage 1 and Stage 2 — without promises of guaranteed certification.
A Disaster Recovery Plan (DRP) focuses on IT recovery. A Business Continuity Plan (BCP) is broader: people, processes, alternative workplaces, crisis communication, suppliers, and stakeholder management. ISO 22301 demands a holistic BCMS covering both.
ISO 22301 auditors pay close attention to exercise quality: realistic scenarios, cross-functional participation, post-exercise evaluation with corrective actions. Tabletop walkthroughs are insufficient for critical scenarios — full simulation or live failover testing is required.
Clause 8.2.2 (BIA) asks how quickly the impact of disrupting an activity becomes unacceptable. Clause 8.2.3 (risk assessment) asks what is most likely to cause that disruption and where the weak points sit. The order matters. The BIA identifies the prioritized activities and the resources they depend on, and the risk assessment then evaluates the risk of disruption to those resources. Organizations that fold both into a single likelihood × impact matrix usually lose the time dimension, and the time dimension is exactly where MTPD and RTO come from. Detailed guidance on BIA method sits in ISO/TS 22317:2021.
POJK 11/POJK.03/2022 on IT Operations by Commercial Banks requires banks to maintain a disaster recovery plan and to test and review it at least once a year. Non-bank financial institutions fall under POJK 4/POJK.05/2021 and SEOJK 22/SEOJK.05/2021. Licensed payment service providers under PBI 22/23/PBI/2020 must meet governance and risk management requirements. Most of these provisions speak about information technology. ISO 22301 extends the coverage to people, premises, suppliers, and communication, so one well-designed exercise programme can serve as evidence for the supervisor and as BCMS audit evidence at the same time.
ISO 22301:2019 replaced the 2012 edition with leaner requirements and a reorganized operation clause: 8.2 business impact analysis and risk assessment, 8.3 business continuity strategies and solutions, 8.4 business continuity plans and procedures, 8.5 exercise programme, and 8.6 evaluation of business continuity documentation and capabilities. Amendment ISO 22301:2019/Amd 1:2024, published in February 2024, adds two notes: clause 4.1 asks the organization to determine whether climate change is a relevant issue, and clause 4.2 notes that interested parties can have climate-related requirements. For organizations in flood-prone areas or regions exposed to extreme weather, the answer to clause 4.1 usually becomes a scenario in the risk assessment.
Typical BCMS scopes that get certified
Scope definition affects BIA complexity and exercise expectations.
Scope: core banking, payment processing, branches, customer service. Frequently driven by POJK IT risk management and Bank Indonesia regulations.
Scope: digital platform, customer support, vendor management. Often required by enterprise customers and vendor list audits.
Scope: infrastructure and services. RTO/RPO are very tight for tier 3-4 data centers.
Scope: critical public services. Disruption impact is broad — BIA covers socio-economic dimensions alongside the financial ones.
Scope: critical clinical services (ED, ICU, OR), electronic medical records, medical supply. Low disruption tolerance.
Scope: production and supply chain. Geopolitical risk and supplier concentration become BIA focus.
Scope: switching, clearing, transaction processing, e-money services. Dependencies between providers run deep, so the BIA has to map the impact of a disruption on interconnected partners, merchants, and end users.
Scope: public services delivered through SPBE (electronic government), licensing, and civil registration. Regional hazard profiles from BNPB's InaRISK are a primary input to the risk assessment, and Law No. 24 of 2007 on Disaster Management frames the agency's role when a disaster strikes.
Organizational readiness before inviting a certification body
- Business continuity policy authorized by top managementCommitment to maintaining continuity of key products/services, allocated resources, compliance obligations.
- BCMS context & written scopeClause 4 — issue analysis, interested parties (regulators, clients, suppliers), in-scope products/services, geographic boundaries.
- Business Impact Analysis (BIA) completed (clause 8.2.2)Process identification, prioritization by impact (financial, regulatory, reputational, operational), MTPD (Maximum Tolerable Period of Disruption), RTO, RPO, and minimum resource requirements.
- Risk Assessment for disruptions (clause 8.2.3)Threat identification (cyber, natural, supplier, pandemic, key personnel loss) and vulnerability; prioritization by likelihood × impact.
- Continuity & recovery strategies (clause 8.3)Strategy choices per scenario: alternative workplaces, IT alternatives (failover, backup site), supplier alternatives, personnel alternatives.
- Business Continuity Plan (BCP) & incident response plans (clause 8.4)Incident detection & escalation procedures, command structure, internal/external communication procedures, recovery procedures per function/process.
- Exercise & test (clause 8.5)Annual exercise program: tabletop, walkthrough, full simulation, or live failover. At least one exercise for critical scenarios performed and evaluated.
- One internal audit cycle + management reviewInternal audit per ISO 19011, exercise result evaluation, and management review (clause 9.3) with standard inputs/outputs.
- Competence and role awareness during an incident (clauses 7.2 and 7.3)Every response team member knows their role, who deputizes for them, and where to assemble. Training and briefing records are kept as evidence of competence.
- Evaluation of documentation and capabilities (clause 8.6)Planned reviews of the BIA, risk assessment, strategies, and plans, including after real incidents and exercises. The capabilities of critical suppliers and partners are evaluated too.
Audit path from contract to certificate
Per ISO/IEC 17021-1 — 3-year certification cycle.
- 1
Application & contract
1–2 weeksSubmit scope, employees in scope, sites (including recovery sites), IAF sector. The body computes mandays per IAF MD 5.
- 2
Stage 1 — BCMS documentation review
1–2 daysAuditor reviews policy, scope, BIA, risk assessment, continuity strategies, BCPs, exercise & test documentation, internal audit results, and management review minutes.
- 3
Stage 2 — Implementation audit
3–8 days onsiteAuditor goes into the processes: BCM owner interviews, IT team, vendor management, communications. Review of exercise records (scenario, participation, results, corrective actions), BCP audit per critical process.
- 4
Closure of findings & certification recommendation
30–90 daysMajor NCs closed. For BCMS, major NCs often involve a superficial BIA or tabletop-only exercise for critical scenarios without real simulation.
- 5
Certificate issuance (3-year cycle)
—Certificate carries the scope. Often required for enterprise customer tenders & regulated sectors (banking, insurance).
- 6
Year 1 & 2 surveillance audits
Annual, 2–5 daysFocus on latest exercise results, real incidents & response, BIA changes (e.g. new services), and prior finding follow-up.
- 7
Recertification audit (year 3)
Before certificate expiresFull re-audit. Pass → renewed for another 3 years.
What an ISO 22301 Internal Auditor does — they test the BCP, beyond document review
Internal Auditor training follows ISO 19011:2018 with added BCM competency focus.
An ISO 22301 internal auditor verifies BIA quality (whether the impact analysis is realistic), RTO/RPO validity (whether feasible given the chosen strategy), BCP completeness per critical process (whether procedures are executable), and exercise quality (whether scenarios are challenging, whether evaluation & corrective action are performed). A good auditor reviews exercise records: how many participated, whether the scenario was realistic, what findings emerged, and whether findings were followed up. Independence: an auditor does not audit a BCP for the function they manage.
- Understanding of ISO 22301 clauses 4–10 and the Annex SL structure
- Business Impact Analysis methods: process identification, financial/regulatory/reputational impact, MTPD, RTO, RPO
- Risk assessment for disruptions: threat scenarios, vulnerabilities, prioritization
- Audit of continuity & recovery strategies (IT alternatives, locations, suppliers, personnel)
- Audit of BCPs per critical process: response procedures, command structure, communication
- Audit of exercise & test: scenario quality, participation, evaluation, corrective actions
- ISO 19011 — independence, objectivity, evidence-based
- Using ISO 22313:2020 as interpretation guidance and ISO/TS 22317:2021 as the BIA method reference when judging whether evidence is sufficient
- Auditing critical supplier continuity against ISO/TS 22318:2021: contract clauses, evidence of the supplier's BCP, and joint exercises
- Tracing one prioritized activity from BIA to strategy, plan, exercise, and corrective action within a single audit sample
- Major NC
E.g. BIA absent or superficial for a critical process, exercise never performed for a critical scenario, or RTO unrealistic given the chosen strategy.
- Minor NC
E.g. exercise documentation incomplete, one BCP not updated after organizational change, or post-exercise evaluation produces no corrective actions.
- OFI
E.g. recommendation to escalate exercise complexity from tabletop to simulation, or to adopt a BCM tool (e.g. Fusion, Riskonnect) for visibility.
- Observation
E.g. note on single-source supplier dependency with potential single point of failure.
Expected outcomes for your team
Awareness vs Internal Auditor vs Lead Auditor preparation (BCM)
| Criterion | Awareness | Internal Auditor ★ | Lead Auditor preparation |
|---|---|---|---|
| Typical duration | 1 day | 3 days | 5 days (IRCA-style) |
| Target audience | Critical function managers + BCM team | Internal audit & risk officer team | Aspiring Lead Auditors / BCM consultants |
| Main output | Basic BIA & BCP understanding | Audit checklists + audit simulation + finding reports | Individual certificate from a registered training scheme |
| Delivered by | Training vendor (e.g. Neksus) | Training vendor (e.g. Neksus) | Registered training organization (e.g. BCI / DRI International / PECB) |
| Clauses covered in depth | Clauses 4, 5, 8.2, and 8.4 from the process owner's view | Clauses 4–10 with focus on 8.2 through 8.6 and 9.2 | Clauses 4–10 plus audit programme management under ISO 19011 |
| Hands-on practice | Discussing disruption scenarios in the participant's own unit | Building checklists, interviewing process owners, writing finding statements | Leading an audit team, opening and closing meetings, drafting the audit report |
Engagement path with Neksus for ISO 22301
- 1
Kickoff & gap analysis
Week 12-hour workshop with the BCM Manager/Risk: critical process mapping, existing BIA (if any), and documentation readiness.
- 2
1-day awareness
Week 2For critical function managers: why BCMS matters, their role in BIA & BCP, and exercise expectations.
- 3
3-day Internal Auditor workshop
Weeks 3–4Clauses 4–10, BIA methods, audit of continuity strategies, BCP audit, and exercise & test audit per ISO 19011.
- 4
Mock audit + exercise observation
Week 5Facilitator accompanies the internal audit team in reviewing existing BIA & BCP, then observes one exercise (ideally a full simulation).
- 5
Readiness review & recommendations
Week 6Report: remaining gaps, priority actions, Stage 1 document readiness.
- 6
Handoff to the certification body
Week 7+Stage 1 document package is ready. Body selection is entirely your decision.
Target roles
BCMS owner, primary contact with the certification body.
Links the BCMS with the enterprise risk management framework.
Accountable for IT RTO/RPO and failover exercises.
Business process owners who document the function BCP.
4–8 cross-functional internal auditors for audit independence.
Accountable for internal/external incident communication procedures.
Audits critical supplier continuity and manages alternatives.
Directs the business continuity policy and leads the management review.
Examples of accredited certification bodies for ISO 22301 in Indonesia
The list below is not a Neksus recommendation. Body selection is entirely your organization’s decision.
UK-origin body; original author of BS 25999 which preceded ISO 22301.
BCMS audit experience for banking and multinational corporates.
Cross-sector BCMS audit experience — financial, telecommunications, manufacturing.
Often integrated with ISO 27001 (information security) for combined audits.
BCMS audit experience in energy and public services.
Frequently used in SOE/government tenders and OJK fintech ecosystem.
The bodies above are examples of organizations accredited (typically through KAN and the IAF MLA network) that can perform certification audits. They are not Neksus partners and do not receive referrals from Neksus. Choosing a certification body is entirely your organization’s decision based on scope, sector, and internal procurement requirements.
Typical outcome patterns from comparable clients
Mid-size bank with core banking + multi-channel digital, certifying to meet POJK IT risk management.
Awareness for function managers + 3-day Internal Auditor for 6 people + observation of a live core banking failover test to the DR site.
Stage 1 passed without critical findings; Stage 2 produced 2 Minor NCs (critical vendor exercise documentation) closed within 60 days.
B2B SaaS with SOC 2 + ISO 22301 demand from enterprise customer.
BIA across engineering & customer support; 3-day Internal Auditor focused on platform RTO/RPO & cloud failover integration.
ISO 22301 certificate issued within 5 months; together with SOC 2 Type 2, satisfied Fortune 500 enterprise customer onboarding.
SOE utilities with public-service continuity demands.
BIA covered the socio-economic impact of service disruption; coaching on large-scale simulation exercise with cross-region participation.
ISO 22301 certificate issued; documented improvement of readiness for rainy-season disruption & natural disasters.
Procurement information
- Contract formatInhouse training, continuous program, or integrated awareness + Internal Auditor + exercise observation package.
- LocationOnsite at the client site, regional onsite, or live online.
- Language of deliveryIndonesian or bilingual ID/EN.
- Materials & participant certificateModules, handouts, BIA template, BCP template, audit checklists, Neksus participation certificate.
- Tax documentationVAT invoice, receipt, BAST. SOE/government e-procurement support available.
- Payment terms30% advance on contract, 70% on training completion.
- Optional exercise design coachingSeparate manday-based scheme: designing realistic exercise scenarios and post-exercise evaluation.
Frequently Asked Questions
Discuss ISO 22301:2019 readiness for your organization
Send your BCMS scope and target certification schedule. The Neksus team studies your context and prepares a program design.
- Awareness, Internal Auditor, and observation of real exercises
- Facilitators with BCM Manager and BCMS audit backgrounds
- Materials covering alignment with POJK IT risk management
- Structured handoff to your chosen certification body