4.4 Gap Analysis & the BCMS Implementation Methodology

Chapters 2 and 3 established the context, scope, leadership, and policy. Section 4.1 set the objectives. A question remains that the standard itself never answers, because ISO 22301 specifies what a conforming BCMS must contain and never how to get there: given an organization that has none of this today, in what order do you build it, and how do you know how much work it is?

That is what the implementation methodology and the gap analysis are for. Both appear explicitly in the PECB Domain 3 knowledge statements — "Knowledge of the principal approaches and methodology used to implement a BCMS" and "Knowledge of the gap analysis to determine the current state, the desired state, and the difference between the two" — and both are habitually under-studied because neither has a clause number to revise from.

---

1. Initiating the Implementation Project

Before methodology comes mandate. A BCMS implementation that begins with a consultant writing policy drafts, rather than with an approved project, fails predictably: it has no budget line, no decision forum, and no authority to compel departmental participation in the BIA.

The initiation phase produces four artefacts:

Note the sequencing dependency: the charter authorises the gap analysis, and the gap analysis then corrects the charter's assumptions. A charter that fixes a certification date before anyone has measured the gap is committing to a date on no evidence, and it is the single most common cause of BCMS projects that miss Stage 2 readiness.

Choosing an implementation approach

Three approaches recur in practice, and the exam expects you to be able to justify a choice rather than name a favourite:

• Full-scope simultaneous implementation. All in-scope activities are addressed in one programme. Fastest to certification and cheapest per unit of scope, but requires sustained resource commitment and high organizational maturity.
• Phased implementation by business unit or site. A pilot unit is taken to full conformity, lessons are harvested, and the pattern is replicated. Slower and more expensive overall, but de-risks method errors and builds internal competence. Preferred where the organization has no prior management system.
• Integrated implementation alongside an existing management system. Where ISO 9001, ISO 14001, or ISO/IEC 27001 is already certified, the shared Annex SL clauses — context, leadership, planning, support, performance evaluation, improvement — are extended rather than duplicated (see Section 1.3). Substantially the cheapest route where it is available.

PECB's IMS2 Methodology

PECB teaches implementation through its own IMS2 Methodology (Integrated Implementation Methodology for Management Systems and Standards), and the course learning objectives state that participants will "initiate and plan the implementation of a BCMS based on ISO 22301, by utilizing PECB's IMS2 Methodology and other best practices."

IMS2 is a phased project methodology whose sequence mirrors the structure of this guide and of the standard itself:

1. Initiation — mandate, business case, charter, governance, preliminary gap analysis
2. Planning — context, scope, policy, objectives, risk and opportunity treatment, resourcing, documented information (Clauses 4-7)
3. Implementation — BIA, risk assessment, strategies and solutions, plans and procedures, exercising (Clause 8)
4. Monitoring and measurement — metrics, internal audit, management review (Clause 9)
5. Continual improvement and certification — nonconformity treatment, improvement, certification audit (Clause 10 and beyond)

The examinable point is not the trademark. It is that a BCMS is implemented as a governed project with phases, gates, and deliverables, and that the phase sequence follows the clause sequence for a reason: you cannot scope what you have not contextualised, and you cannot build continuity solutions for activities you have not yet prioritised in the BIA.

---

2. The Gap Analysis: Three Questions in Order

A gap analysis is deceptively simple in structure and frequently botched in execution.

The failure mode is stopping at step one. An assessment that reports "we score 2.1 out of 5 on Clause 8" has described a current state and called it a gap analysis. It has not defined the target, so it cannot state the difference, so it cannot size a project.

Determining the current state honestly

The evidence standard matters more than the questionnaire. For each requirement, record what was seen, not what was claimed:

• Documented information reviewed — the actual policy, procedure, register, or plan, with its version and approval date
• Interviews — with the process owner, not only with the person sponsoring the project
• Observation — does the mass notification system actually reach staff? has the alternate site ever been occupied?
• Records — evidence that the process has operated, not merely that it is written down

The distinction between a documented process and an operating process is the same distinction Stage 1 and Stage 2 certification audits draw (Section 11.1). An organization with excellent documentation and no records is far from certifiable, and a gap analysis that scores it on documentation alone will understate the project by months.

Defining the desired state

The desired state is not "5 out of 5 everywhere." ISO 22301 requires conformity, not maximum maturity, and over-specifying the target inflates the project and wastes capital. Set the target as:

• Conformity for every "shall" in Clauses 4 through 10 that applies within the declared scope — this is non-negotiable and binary
• Proportionate maturity beyond conformity, driven by the organization's risk appetite, regulatory exposure, and customer commitments

An organization subject to DORA or APRA CPS 230 will set a higher target for exercising and third-party dependency management than a domestic manufacturer with no regulatory continuity obligation, even though both must merely conform to Clause 8.5.

A clause-by-clause gap analysis instrument

A five-point maturity scale (0 = absent, 1 = ad hoc, 2 = partially documented, 3 = documented and conforming, 4 = operating with records, 5 = optimised and improving) is sufficient. What makes the instrument defensible is the evidence column, which is what a certification body will effectively re-perform at Stage 1.

---

3. From Gap Register to Implementation Roadmap

The gap register is not a report to be filed. Each gap becomes a work package:

Three dependency rules govern sequencing and are examinable:

1. Clause 8.2.2 (BIA) precedes Clause 8.3 (strategies). You cannot select continuity solutions for activities whose recovery priorities and time objectives are unknown.
2. Clause 8.3 (strategies) precedes Clause 8.4 (plans). A plan documents how an approved strategy is executed; drafting plans first produces documents nobody has funded the resources to honour.
3. Clauses 9.2 and 9.3 (internal audit and management review) precede Stage 1. A certification body will check that at least one full cycle of each has occurred. This is the single most common reason organizations are refused progression to Stage 2, and because internal audit and management review can only audit a BCMS that has operated for a period, they must be scheduled backwards from the certification date with real operating time in front of them.

The roadmap is then presented to the steering committee as a re-baselined plan, and — critically — the charter's original certification date is revised against evidence rather than defended.

---

4. Gap Analysis Is Not an Internal Audit

Candidates conflate these constantly, and Domain 3 and Domain 5 both test the boundary.

The consequence that matters: a finding in a gap analysis creates no Clause 10.1 corrective-action obligation, whereas a nonconformity raised in an internal audit does. And because the Lead Implementer typically runs the gap analysis, that same person is disqualified from auditing the clauses they remediated — the independence rule in Section 10.2.

---

5. Worked Implementation Scenario: A Regional Insurer's Re-Baselined Roadmap

Context. A regional insurer with 900 staff across three sites holds ISO/IEC 27001 certification. The board approves a charter targeting ISO 22301 certification in nine months, driven by a broker consortium that has made certification a panel-eligibility condition.

Gap analysis findings. The Lead Implementer scores all of Clauses 4-10 against evidence:

• Clauses 4, 5, 7, and parts of 9 and 10 score 3 or above — the ISO/IEC 27001 management system already satisfies context, leadership, competence, documented information, and corrective action, needing only scope extension. Estimated effort: 25 person-days.
• Clause 6.2 scores 1. Objectives exist but are not measurable. Effort: 10 days.
• Clause 8.2.2 scores 0. No BIA has ever been performed across 46 in-scope activities. Effort: 90 days.
• Clause 8.4.4 scores 1. Two IT runbooks, last tested in 2023, cover none of the business activities. Effort: 110 days.
• Clause 8.5 scores 0. No exercise programme. Effort: 45 days.

The difference. Roughly 280 person-days of remediation — but the binding constraint is not effort, it is dependency and elapsed time. The BIA must complete before strategies can be selected; strategies before plans; plans before the first exercise; and internal audit plus management review must then run over an operating BCMS before Stage 1.

Outcome. The Lead Implementer re-baselines to fourteen months and presents the dependency chain to the steering committee, showing that a nine-month date would deliver documented plans that had never been exercised and no completed internal audit cycle — an organization that would be refused progression from Stage 1 to Stage 2. The board accepts the revised date and notifies the broker consortium. Certification is achieved in month thirteen with two minor nonconformities and no majors.

The value delivered was not the assessment. It was the difference — quantified early enough to correct a commitment made without evidence.

---

6. PECB Exam Warning Traps & Implementation Pitfalls

[!WARNING] Trap 1 (Gap analysis is not required by ISO 22301): No clause of ISO 22301 mandates a gap analysis. It is an implementation best practice PECB expects you to know and apply — but an organization that never performed one is not thereby nonconforming. An organization that never performed an internal audit (Clause 9.2) is.

[!WARNING] Trap 2 (The three-part definition): If asked what a gap analysis determines, the complete answer is current state, desired state, and the difference between the two. An option describing only the current-state assessment is the most attractive distractor.

[!WARNING] Trap 3 (Target state is conformity, not maximum maturity): Setting every requirement to maturity 5 is a planning error that inflates cost and delays certification. The desired state is conformity with every applicable "shall", plus proportionate maturity where risk and obligations justify it.

[!WARNING] Trap 4 (Independence carries forward): The person who ran the gap analysis and remediated the gaps cannot later audit those clauses under Clause 9.2. Plan the internal audit resource — a trained second auditor, a peer from another site, or an external contractor — during initiation, not two months before Stage 1.

[!WARNING] Trap 5 (Sequencing is not preference): BIA before strategies before plans before exercises is a dependency, not a stylistic choice. Exam scenarios that show an organization drafting business continuity plans before completing the BIA are describing a nonconformity against Clause 8.3 and 8.4, because the plans cannot be traceable to prioritised activities and their recovery time objectives.