ISO 22301 Gap Analysis: 6 Proven Rules for a Plan That Lands

An ISO 22301 gap analysis that scores every clause out of ten and averages the result will finish late. Not because the scoring is wrong, but because the clauses are not equal — one of them carries everything built on top of it.

Weighting by dependency rather than by count is the difference between a plan that lands and a plan that discovers its real problem in month five.

The clause an ISO 22301 gap analysis must weight highest

Clause 8.2 — business impact analysis and risk assessment — is load-bearing in a way no other clause is. The recovery objectives, the continuity strategies, the solutions you buy and the plans you write are all derived from it.

So a gap in 8.2 is not one gap. It invalidates whatever has been built on top of it, and the work has to be redone rather than extended. An ISO 22301 gap analysis that scores 8.2 as “partial” alongside a “partial” in clause 7.4 communications is telling you the two are comparable. They are not remotely comparable.

Score dependency, not just conformity. For each gap, ask what else has to change if this one turns out to be wrong.

The finding hiding inside clause 8.3

Business continuity strategies and solutions is rarely empty. The usual finding is subtler and more expensive: the solutions were selected before the business impact analysis was done.

A secondary site, a replication arrangement, a standby contract — chosen on engineering judgement or on what was already in the budget, then retrofitted to a BIA written afterwards to agree with them. It reads as conformity in a document review and falls apart the moment an auditor asks which requirement drove which solution.

This is worth a specific question in the gap analysis rather than a score: for each continuity solution, which BIA output justifies it, and which came first?

Cheap to write, hard to pass

Clause 8.4, business continuity plans and procedures, is the clause an ISO 22301 gap analysis most often scores complete when it is not — precisely because plans are cheap to produce. Volume of documentation is not evidence of conformity here; a plan that names roles that no longer exist scores zero in an audit and full marks in a document count.

Clause 8.5, the exercise programme, is the opposite. It is the one gap in the standard that cannot be closed on paper. An exercise has to have run, with a report, findings and consequent changes. Discover that gap late and it sets your certification date regardless of everything else — the same way exercising gates the regulated regimes.

The time gates an ISO 22301 gap analysis has to surface

Two clauses behave like 8.5 and are missed for the same reason. Clause 9.2, internal audit and clause 9.3, management review each have to have happened at least once, with records, before a certification body can test them. Documenting the procedure takes an afternoon; satisfying the clause takes a cycle.

Put these three — 8.5, 9.2 and 9.3 — at the top of the ISO 22301 gap analysis output, because between them they determine the earliest date an audit is worth booking. Everything else is a resourcing question.

Where the ISO 22301 gap analysis should be generous

The clause 7 support requirements — competence, awareness, communication, documented information — are real and they are also fast. They cost days, not months, and they rarely block anything downstream.

Weighting them equally with clause 8 is what produces a remediation plan where the team spends the first six weeks on the cheap half and hits the expensive half with no time left. If a gap analysis output is going to drive a plan, the sequencing has to come out of the weighting.

The shelf life of your checklist

ISO 22301:2019 is the second edition, published October 2019, 21 pages, maintained by ISO/TC 292. Its catalogue record now shows stage 90.92 — International Standard to be revised, so a third edition is in development.

Two practical consequences. A gap analysis keyed to clause numbers will need reworking when the new edition lands, so record findings against the requirement in your own words as well as the clause reference. And this is not a reason to wait — certification runs against the current edition, and transition periods exist for exactly this.

Turning the ISO 22301 gap analysis into something usable

The output of an ISO 22301 gap analysis is not the assessment; it is the plan that comes out of it. Three things make that plan credible:

• An owner per gap, named, not a department.
• A distinction between documenting and operating, so the time-gated clauses cannot be reported as complete on the day the procedure is approved.
• A dated re-score, because the value is in the movement between two snapshots rather than in either one.

How the ISO 22301 gap analysis connects

Where to start

1. Score clause 8.2 first, and treat a gap there as a project rather than an action.
2. Ask which came first — the solution or the BIA output that justifies it.
3. Surface 8.5, 9.2 and 9.3 at the top, since they set the earliest audit date.
4. Separate documented from operating in the scoring scheme.
5. Do not over-invest in clause 7; it is real, cheap and not on the critical path.
6. Re-score on a date, so the plan is measured rather than described.

This guide reflects the ISO 22301:2019 catalogue record on iso.org, read at 16 August 2026. A third edition is in development — check the record before building a clause-numbered checklist you intend to keep.

The ISO 22301 Assessment Tool is an Excel workbook that scores the BCMS clause by clause, weights the findings and produces the remediation list a gap analysis is meant to output — and the ISO 22301 Toolkit supplies the 75+ templates you use to close what it finds.