Rapid Momentum Consulting

A ten-question diagnostic of your organisation's business continuity management posture under the ISO 22301 framework. Calibrated for manufacturing, services, and digital-first organisations. Multi-entity groups will find the third section particularly relevant.

0 of 10 questions answered

BIA & scope

1.How recent and substantive is your Business Impact Analysis (BIA)?

Substantive BIA refreshed within the last 18 months
Refreshed recently but coverage is partial
More than 3 years old
No formal BIA

2.How are your RTO and RPO targets calibrated?

Calibrated to business reality and demonstrably tested under representative conditions
Calibrated on paper but not tested operationally
Generic targets not specifically calibrated to our processes
No formal RTO/RPO framework

3.How comprehensively does your continuity programme map dependencies?

Cloud, third-party, internal-tech, people, regulatory — all explicitly mapped
Physical infrastructure and key suppliers covered; digital dependencies less developed
High-level only, without substantive depth
Not formally mapped

Operational design

4.How do you verify third-party continuity capability?

Substantive operational verification beyond contractual attestation
Contractual attestation only
Ad hoc verification on specific suppliers
No third-party continuity verification

5.How developed are your recovery strategies for critical processes?

Documented and tested under exercise conditions
Documented but not tested
Informal strategies known by key personnel
No documented recovery strategies

6.How structured is your incident management framework?

Tiered response structure with defined roles, tested under exercises
Documented but not exercised
Informal — relies on individual judgement
No formal incident management framework

Exercises & maintenance

7.What is your exercise cadence for continuity plans?

Regular cadence (at least semi-annual) with substantive exercises
Annual tabletop exercise only
Ad hoc when specific concerns arise
No regular exercise programme

8.For digital-dependent processes, do you run technical (chaos-engineering-style) exercises?

Regular technical exercises that actually fail and recover services
Occasional technical exercises
Tabletop only — never actually trigger failures
Not applicable — operations are not digital-dependent in a way that warrants this

9.If your organisation is a multi-entity group, how is BCM coordinated across entities?

Group framework with entity-level execution; cross-entity exercises
Group-level only, missing entity-specific reality
Entity-level only, missing shared-infrastructure considerations
Not applicable — single-entity organisation

10.Is BCM addressed at management review (ISO 22301 Clause 9.3)?

Formal management review with documented inputs and outputs
Annual management review only
Informally reviewed by leadership when issues arise
No management review of BCM

ISO 22301 business continuity readiness self-assessment

BIA & scope

Operational design

Exercises & maintenance

Companion content