Continuity programmes are usually judged after something has already gone wrong, which is the worst time to discover a gap. An ISO 22301 gap assessment run while nothing is happening costs an afternoon and tells you what a disruption would find.
On this page:
- Size the gap before you commit to a certification date
- What is inside the ISO 22301 gap assessment pack
- What an ISO 22301 gap assessment tells you, and what it does not
- Who the ISO 22301 gap assessment pack is written for
- What the ISO 22301 gap assessment pack does not do
- Frequently asked questions
- Related toolkits
Size the gap before you commit to a certification date
The common failure is committing to a timetable and discovering mid-way that the business impact analysis was never completed properly, or that recovery time objectives were set by assertion rather than analysis. Both are findings; both move the date.
The workbook works through the management system clause by clause – context, leadership, planning, support, operation, performance evaluation and improvement – and scores as you answer, so the weak areas surface while you are still in a position to plan around them.
It is designed to be usable by people who are not continuity specialists, which matters because the honest answers usually sit with operational managers rather than with the person running the programme. A tool that requires expertise to complete gets completed by one person, and a self-assessment completed by one person tends to be optimistic.
What is inside the ISO 22301 gap assessment pack
One Excel workbook, immediately usable, with no add-on, macro requirement or login.
- Clause-by-clause questionnaire – across the full management system structure.
- Scoring – calculated as you answer, with the weakest areas visible immediately.
- Gap view – policies, processes and procedures examined in enough detail to show what is actually missing.
- Prioritisation – so remediation effort goes where the exposure is rather than where it is easiest.
- Plain Excel – editable, shareable and yours to adapt.
What an ISO 22301 gap assessment tells you, and what it does not
It tells you three things: whether the management system exists in the form the standard expects, which clauses have nothing behind them, and where to spend first. That is enough to have a credible conversation with an executive team about scope, timetable and budget.
It does not tell you whether your recovery time objectives are achievable, because that needs an exercise rather than a questionnaire. It is not an audit and a certification body will not treat it as evidence. And it does not produce the documentation – if the assessment shows you need a business impact analysis, a continuity strategy and exercise records, the ISO 22301 documentation pack builds those.
Used in sequence it works well: the assessment first to decide whether to proceed and where to focus, the full pack once the answer is yes.
Who the ISO 22301 gap assessment pack is written for
- Organisations considering ISO 22301 certification and sizing the work involved.
- Continuity and resilience managers who need a defensible number for a budget conversation.
- Companies asked by a customer or an insurer about their continuity posture.
- Consultants running a first-meeting readiness review.
What the ISO 22301 gap assessment pack does not do
It is not an audit, and it does not certify anything.
It does not test your recovery capability. That needs an exercise, not a questionnaire.
It does not produce documentation. It shows what is missing; building it is the documentation pack.
Frequently asked questions
Is this enough to get certified?
No. It sizes the gap. Certification requires a documented management system and an audit by an accredited body.
Who should fill it in?
Ideally not one person. The honest answers usually sit with operational managers, and the workbook is written to be usable by non-specialists for that reason.
Does it need macros?
No. Plain Excel, fully editable.
Can we move to the full toolkit afterwards?
Yes, and the assessment tells you which clauses to prioritise when you do.
Related toolkits
When the assessment shows the gaps, the ISO 22301 toolkit is the documentation set that closes them. Organisations in EU financial services should also look at the DORA toolkit, and risk functions at the ISO 31000 toolkit. ISO publishes the standard at iso.org.
Implementing for clients? The Consultant Package licenses all 86 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.
Delivery, format and licence
The ISO 22301 gap assessment pack downloads immediately after checkout as a single native Microsoft Excel workbook. Nothing is locked, nothing is a PDF you cannot edit, and no add-on or portal login is needed to open it. Every organisation-specific value is marked as a placeholder so you can see what still has to be decided.
One payment, no subscription and no annual renewal. The source files behind the ISO 22301 gap assessment pack are yours to adapt for your own organisation for as long as you need them, including future revisions of your own documents.
Reviews
There are no reviews yet.