Clause 7: Support

Requirement
The organisation must determine and provide the resources needed for establishing, implementing, maintaining, and continually improving the BCMS.

How to Implement
Identify what your BCMS genuinely needs to function: budget for exercise programmes, backup infrastructure, staff time for plan maintenance, and specialist tools where relevant. Build this into annual budgeting rather than treating it as a one-off certification cost, since recovery capability (standby sites, alternative suppliers, redundant systems) often carries ongoing cost.

Mandatory Documents
There is no explicit documentation requirement in 7.1. No mandatory document is required.

Requirement
The organisation must determine necessary competence for persons whose work affects business continuity performance, ensure competence through education, training, or experience, take action to close gaps and evaluate effectiveness, and retain documented evidence of competence.

How to Implement
Define competence requirements for BCMS-critical roles, particularly response team members and the BCMS Manager, and close gaps through training, mentoring, or hiring. Since response team competence is tested directly through the exercise programme in Clause 8.5, treat exercises themselves as a competence-building tool, not just a compliance checkbox.

Mandatory Documents
Yes, explicitly mandatory. ISO 22301 states the organisation “shall retain appropriate documented information as evidence of competence.” You must keep:

• Training certificates, CVs, or competence assessment records for relevant personnel

Requirement
Persons doing work under the organisation’s control must be aware of the business continuity policy, their contribution to BCMS effectiveness, the implications of nonconformance, and their own role and responsibilities before, during, and after disruptions.

How to Implement
Run induction and refresher awareness sessions covering the policy and general business continuity principles, but go further than most management standards require here: every employee, not just response team members, should know what’s expected of them personally if a disruption actually happens, since the standard explicitly calls this out as a distinct awareness item.

Mandatory Documents
There is no explicit “shall be available as documented information” statement for 7.3. No mandatory document is required, though attendance records for awareness sessions are useful supporting evidence.

Requirement
The organisation must determine internal and external communications relevant to the BCMS: what to communicate, when, with whom, how, and (uniquely among Annex SL standards) who will communicate.

How to Implement
Build a communication plan covering routine BCMS matters (policy updates, objective progress), and note that the “who will communicate” requirement here is a direct precursor to the detailed warning and communication procedures required later in Clause 8.4.3. Start identifying your designated spokespeople now, since that decision shouldn’t be made for the first time during an actual disruption.

Mandatory Documents
There is no explicit documentation requirement for 7.4 itself. No mandatory document is required at this stage, though this groundwork becomes mandatory once you reach 8.4.3.

Requirement
7.5.1 General, 7.5.2 Creating and Updating, and 7.5.3 Control of Documented Information follow the standard Annex SL pattern: documented information required by the standard plus whatever the organisation determines necessary, created and controlled with appropriate identification, format, review, approval, distribution, storage, and retention.

How to Implement
Apply standard document control practice across all your BCMS documentation, with particular attention to your business continuity plans, since these need to remain usable and accessible during an actual disruption, including scenarios where your normal IT systems might be unavailable. Many organisations keep printed or offline copies of critical plans for exactly this reason.

Mandatory Documents
There is no single stand-alone mandatory document tied to 7.5 itself; instead, it sets the control rules that govern every other mandatory document already identified across Clauses 4 to 10. A Document Control Procedure is strongly recommended as the practical mechanism for this.