Clause 6: Planning

Requirement
6.1.1 requires the organisation, when planning the BCMS, to consider the issues from 4.1 and requirements from 4.2, and determine risks and opportunities needed to give assurance the BCMS can achieve its intended outcomes, prevent or reduce undesired effects, and achieve continual improvement.

6.1.2 requires planning actions to address these risks and opportunities, and how to integrate and evaluate them.

How to Implement
Identify what could undermine the BCMS itself functioning properly, things like inadequate resourcing, poor staff awareness, or weak top management engagement, as distinct from what could disrupt your actual business operations. A useful distinction to keep in mind throughout this clause: this is about risks to your management system working, while Clause 8.2’s risk assessment is about risks to your business continuing to operate.

Mandatory Documents
There is no explicit documentation requirement tied to 6.1 itself. No mandatory document is required, though many organisations maintain a brief BCMS risk and opportunity log for this purpose.

6.2.1 requires the organisation to establish business continuity objectives at relevant functions and levels. These must be consistent with the policy, measurable (if practicable), take applicable requirements into account, be monitored, communicated, and updated as appropriate. 6.2.2 requires determining what will be done, resources required, responsibility, timeline, and evaluation method.

How to Implement
Set specific, measurable objectives tied to your eventual recovery capability, for example, “achieve a tested recovery time objective of 4 hours for the order processing system by Q3,” rather than vague aspirations like “improve resilience.” Review progress at management review and adjust as your business impact analysis results evolve.

Mandatory Documents
Yes, explicitly mandatory. ISO 22301 states the organisation “shall retain documented information on the business continuity objectives.” You must produce and maintain:

• A documented set of Business Continuity Objectives with associated action plans

Requirement
When the organisation determines the need for changes to the BCMS, including those identified in Clause 10, the changes must be carried out in a planned manner, considering the purpose of the changes and potential consequences, the integrity of the BCMS, resource availability, and the allocation or reallocation of responsibilities and authorities.

How to Implement
Before making a significant change to the BCMS (adding a new site to scope, changing a recovery strategy, restructuring response teams), plan it deliberately: define what’s changing, who’s responsible, what resources are needed, and how the change affects existing plans and procedures, rather than letting changes happen informally and discovering gaps only when an exercise or real disruption exposes them.

Mandatory Documents
There is no explicit “shall be available as documented information” statement for 6.3. No mandatory document is required, though a Change Log covering significant BCMS changes is good practice.