ISO 22301 business continuity for Canadian organisations, built so the business impact analysis and the infrastructure agree.
One Canadian team runs the business impact analysis, builds the business continuity management system (BCMS), and proves the plan against the infrastructure you actually run.
Critical activities ranked and tolerable disruption periods agreed with the people who own them, then mapped through to the systems, suppliers and people each activity depends on.
Clauses 4 to 10 built: scope, policy, continuity strategy, plans, exercise programme, management review, and the records an ISO 22301 certification audit asks to see.
Continuity plans exercised against the estate you actually run, not against a boardroom table. Where the agreed target and the infrastructure disagree, our engineers fix the infrastructure.
OSFI expected full adherence to its operational resilience guideline by 2026-09-01, and that deadline has passed. ISO 22301 is the continuity planning standard most Canadian boards reach for when they have to show their work.
IN PRODUCTION
Our plan promised four hours for the order system. Nobody had asked whether the infrastructure could do four hours, and it couldn't. SMEnode found the gap in the first workshop, then fixed the platform instead of quietly editing the plan down to match it.
I run this practice, so this is written by the engineer who'll own the gap between your plan and your platform, not a product page.
Most continuity plans get written by people who have no authority to change the systems the plan depends on. That's the problem in one sentence. A business impact analysis sets a tolerable period of disruption for each critical activity, and the plan then promises it. Almost nobody checks whether the estate can deliver it, and the certificate won't tell you, because ISO 22301 certifies that a business continuity management system exists and runs, not that your platform can come back inside the window you wrote down. Both things matter. Only one of them is what a customer experiences during an outage.
Risk sits in three predictable places. A business impact analysis done with a consultant and a spreadsheet rather than with the people who own the critical activities, which produces numbers nobody will defend under pressure. Plans exercised only as tabletop discussions, so the first real test is a real incident. And suppliers whose own continuity arrangements nobody has ever asked about, which is where a surprising share of Canadian outages start.
The Canadian calendar makes this urgent for one sector in particular. OSFI published Guideline E-21, Operational Risk Management and Resilience, on 2024-08-22, began compliance checks on 2025-09-01, and expected full adherence by 2026-09-01 (source: OSFI, 2024). It calls for business continuity, disaster recovery and crisis management to sit inside one resilience framework, with scenario testing across all critical operations by 2027-09-01. E-21 names no standard, so ISO 22301 is one credible way to evidence it rather than a requirement. ISO 22301:2019 is still the current version of this continuity planning standard, and it now carries the 2024 climate amendment (source: ISO).
Four steps, and step 01 is the one that gets skipped. A business impact analysis is a series of uncomfortable conversations with the people who own each critical activity, and it produces numbers they'll stand behind. Done as a questionnaire it produces numbers nobody owns. We run it as workshops, we write down who agreed to what, and the output is short enough that an executive will read it.
Critical activities identified with their owners, tolerable disruption periods agreed and recorded, and dependencies mapped through to the systems, suppliers and people each activity actually needs.
Scope, policy, continuity strategy, plans, exercise programme, management review, and the records a certification body will ask to see, sized so your team can keep it running.
Where the agreed target and the infrastructure disagree, our engineers fix the infrastructure. This is the step no continuity consultancy can offer, and it's why the plan stops being fiction.
Real exercises against real systems, findings fed back into the plans, an internal audit, and stage 1 and stage 2 support with the accredited body that issues the certificate.
Answers first, including what the certificate does not prove. An architect takes the call, not a salesperson.
LET'S CONNECT
A senior engineer replies within an hour, 24/7.