brivellisBCMS Starter Kit for ISO 22301
Free · 14 files · v1.0 · Reviewed 19 Oct 2026
- 14 editable Word and Excel files
- Recovery targets that carry from the impact analysis through to the exercises
- Aligned with ISO 22301:2019 and Amd 1:2024
- Example data from Falcon Ridge IT Services in the workbooks
No sign-up. Free to use within one organisation.
What's included
| File | Component | What you use it for |
|---|---|---|
| 00 | Read Me First | The order of work, how the files connect and the standards you need |
| 00a | Responsible AI Use Guide | Six rules for using AI to tailor the kit, and how to show you followed them |
| 01 | BCMS Scope and Policy | Context, interested parties, scope with exclusions, policy, objectives and roles |
| 02 | Business Impact Analysis Workbook | Impact over time, tolerable downtime, RTO and RPO with checks, and priorities |
| 03 | Continuity Risk Assessment (workbook) | Six disruption scenarios scored 5×5, with treatment, residual risk and a heat map |
| 04 | Strategy and Solutions Register (workbook) | Recovery options per activity, checked against the RTO and RPO from 02 |
| 05 | Business Continuity Plan | Activation, the first hour, call tree, communication, procedures and stand-down |
| 06 | IT Disaster Recovery Runbook | One runbook for all systems: recovery order, steps, restore checks, failback |
| 07 | Exercise and Test Pack | Exercise programme, three tabletop scenarios and a post-exercise report |
| 07 | Exercise and Test Tracker (workbook) | Exercise schedule, results against RTO and RPO, and the corrective-action log |
| 08 | Evidence Register and Management Review (workbook) | Evidence per clause, an internal audit checklist and management review inputs |
| 09 | Crosswalk (workbook) | ISO 22301 against ISO/IEC 27001, ISO/IEC 20000-1 and NIST SP 800-34 Rev. 1 |
| 10 | AI Tailoring Prompt Pack | Eleven guardrailed prompts; every output labelled DRAFT |
| 11 | AI-Use Log (workbook) | One line per AI session: tool, data check, reviewer, approval |
How the kit fits together
Work through the files in this order.
- Scope and policyFile 01
- Business impact analysisFile 02
- RiskFile 03
- StrategiesFile 04
- PlansFiles 05, 06
- ExercisesFile 07
- Evaluation and reviewFile 08
Every file at a glance
What you can use it for
Put a BCMS above your DR runbook
Start from business impact analysis and work up to plans you have tested.
Set recovery targets that hold
Agree RTO and RPO with each activity owner and check every strategy against them.
Run a tabletop exercise
Use the three scenarios with timed injects and record results against your targets.
Learn with the free course
BCMS in Practice: Implementing ISO 22301 with AI. 27 lessons that follow the kit.
Start the free courseHow we use AI
The templates were drafted with AI assistance, then reviewed, corrected and approved by a person before release. The AI Tailoring Prompt Pack helps you adapt them with your own AI tool: use a business account, keep personal and confidential data out, and have a competent person approve every document. AI never creates evidence; your records come from running the processes. Read the Responsible AI Charter.
Questions
Does this kit make us certified?
No. It is a starting document set, not certification or audit advice.
Do I need a copy of the standard?
Yes. The kit references clause numbers and does not reproduce the standard.
Is it really free?
Yes. It is free to use within one organisation, with no sign-up. You may not resell or redistribute it.
Where do the recovery times come from?
From your own business impact analysis, agreed with each activity owner. The kit's figures belong to the fictional example and must be replaced. Nothing in the kit sets a recovery time for you.
Why does the example show a gap?
On purpose. The example's internet link cannot meet its two-hour recovery time, and the register flags it until a second link is in place. A kit that shows every target met would teach the wrong lesson.
Can I use AI to tailor it?
Yes, with care. The kit includes a prompt pack and six rules. AI drafts; a named person reviews and approves. Never use AI to set recovery targets or to create test results, exercise reports or sign-offs.
Is there a course for this kit?
Yes. It is free on YouTube: 27 short lessons across 8 modules (about 70 minutes in total) that walk through the kit template by template. Start the free course.
What changed in this version?
First release.
Start with the business impact analysis
Download the kit, read the Read Me First, then agree the scope (01) and run the business impact analysis (02).
More in this domain
Other free resources and the latest articles in Business Resilience.
Free course
BCMS in Practice: Implementing ISO 22301 with AI (Free Course)
A free video course that walks through the BCMS kit, template by template.
Guide
Operational Resilience Leadership Playbook
A structured approach to critical services, dependencies, scenarios, recovery, and continuous learning.
Latest articles
- BIA and RTO/RPO: the numbers IT cannot set alone
How a business impact analysis sets the MTPD, RTO and RPO, why IT cannot set them alone, and how one number should run from the BIA to the exercise report.
- Resilience is an executive capability
Why recovery plans are not enough, and how leaders can make resilience part of everyday technology governance.
More free template kits
SMS Starter Kit for ISO/
Free · 17 files · v1.1
Scope, policy, SLA, plan and review templates with a worked example.
Cybersecurity Awareness Programme Kit
Free · 11 files · v1.0
Policy, 12-month plan, module outlines and evidence register.
ISMS Starter Kit for ISO/
Free · 13 files · v1.0
Scope, policy, risk register, SoA skeleton and audit plan.
© 2026 Brivellis Technologies FZE LLC. Free to use within one organisation. No resale, redistribution or republication, in original or modified form; keep the Brivellis attribution. Permissions: [email protected].
Brivellis Technologies FZE LLC is an independent company. It is not affiliated with, endorsed by, or licensed by ISO, IEC, NIST or PeopleCert. Standards are referenced by their full designation (e.g., ISO/IEC 27001:2022) and are not reproduced. ITIL® is a registered trade mark of the PeopleCert group. All rights reserved. This material paraphrases requirements, does not reproduce any standard or regulation, and is not legal, certification or audit advice.