ISO 22301 is the standard most business continuity programs measure themselves against, whether or not they ever intend to certify. Scoring a program against it is less about the standard’s text and more about the evidence behind each clause. Here is how we do it.
Follow the standard’s structure
The standard runs from context and leadership (clauses 4 and 5) through planning and support (6 and 7), operation (8), performance evaluation (9), and improvement (10). Clause 8 is where most of the practical work lives: the business impact analysis, risk assessment, continuity strategies, plans, and exercising. The ResiliencyPulse ISO 22301 model has 105 questions in 13 categories that follow that same order, so a scoring session moves through the program the way the standard does.
Score the practice, not the document
The most common inflation we see is scoring the existence of a document as a 3. A documented process is only a 3 if it is also standardized and communicated. A business impact analysis template that one analyst filled in two years ago is a 2 at best. Ask: if the owner left tomorrow, would this still happen the same way next quarter?
Look for the loop
Clauses 9 and 10 separate programs that run from programs that improve. Evidence of a 4 is a metric someone looks at and a record of something changing because of it. Evidence of a 5 is that the improvement cycle itself is routine, resourced, and visible to leadership. If exercise findings are logged but never closed, score the exercising practice honestly and let the gap show.
Rationale is the point
Every question in ResiliencyPulse has a rationale field. Use it. A score with a sentence of evidence behind it is defensible to an auditor, a regulator, and a board. A score without one is an opinion. The rationale is also what makes the reassessment a year later meaningful, because you can see what changed.
Three mistakes to avoid
Scoring leadership commitment from the policy statement rather than from what leadership actually does. Scoring third-party continuity from the contract clause rather than from any evidence the supplier can perform. Scoring exercising from the exercise calendar rather than from the findings and whether they closed.
Then compare
Once an assessment is finalized, ResiliencyPulse compares category scores with peers on the same standard, where a publishable cohort exists. That comparison is only as good as the scoring consistency behind it, which is why the level descriptions matter so much. See the ISO 22301 model.