Clause 5: Leadership

Requirement
Top management must demonstrate leadership and commitment by ensuring the business continuity policy and objectives are established and compatible with strategic direction, integrating BCMS requirements into business processes, ensuring resource availability, communicating the importance of effective business continuity, ensuring the BCMS achieves its intended outcomes, directing and supporting staff, promoting continual improvement, and supporting other managers in their leadership roles.

How to Implement
Top management should personally approve the business continuity policy, sponsor the business impact analysis, and review exercise results rather than delegating this entirely. Since recovery time objectives and resourcing decisions directly affect operational budgets, visible leadership involvement is what usually determines whether a BCMS gets the investment it needs or quietly stalls after certification.

Mandatory Documents
There is no explicit “shall be available as documented information” statement tied to 5.1 itself. No single mandatory document is required, though evidence of commitment typically surfaces through the approved policy (5.2), management review minutes (9.3), and resourcing records.

Requirement
5.2.1 requires top management to establish a business continuity policy appropriate to the organisation’s purpose, providing a framework for setting objectives, committing to meet applicable requirements, and committing to continual improvement. 5.2.2 requires the policy to be documented, communicated within the organisation, and available to interested parties as appropriate.

How to Implement
Draft a short, high-level policy stating the organisation’s commitment to maintaining continuity of its critical activities, and have top management sign and date it. Distribute it internally through induction and intranet channels, and make a version available externally to clients, regulators, or insurers who request evidence of your commitment.

Mandatory Documents
Yes, explicitly mandatory. ISO 22301 states the policy “shall be available as documented information.” You must produce and maintain:

• A signed, approved Business Continuity Policy

Requirement
Top management must ensure responsibilities and authorities for relevant roles are assigned and communicated, specifically assigning responsibility and authority for ensuring the BCMS conforms to the standard and for reporting on BCMS performance to top management.

How to Implement
Appoint a BCMS Manager with clear authority, and build a RACI matrix covering BIA ownership, risk assessment, plan maintenance, and response team leadership. Since Clause 8.4 later requires named personnel and alternates for each response team, this is also the right place to start identifying who those people will be.

Mandatory Documents
There is no explicit “shall be available” statement for 5.3. No mandatory document is required, though a Roles and Responsibilities Matrix is strongly recommended as groundwork for the more detailed response structure required later in Clause 8.4.