# Continuity duties to BCMS evidence checklist

Use this when DORA or NIS2 reaches your organization and you are building, or already run, a business
continuity management system to ISO 22301. It lists the continuity duties in DORA Article 11 and NIS2
Article 21(2)(c), the BCMS record that usually answers each one, and a box for the owner. It is a working
aid, not legal advice: check the scope of each law with your legal or compliance team, and check
requirement wording against your own copy of ISO 22301:2019, which is sold rather than published.

## Who is in scope

- [ ] DORA (Regulation (EU) 2022/2554) applies to us as a financial entity: yes / no
- [ ] We are a microenterprise under DORA (some duties below do not apply): yes / no
- [ ] NIS2 (Directive (EU) 2022/2555) applies to us through our national law: yes / no
- [ ] A customer contract or tender asks for ISO 22301 certification or equivalent: yes / no

## DORA Article 11: response and recovery

- [ ] 11(1) An ICT business continuity policy, dedicated or part of the overall business continuity policy. Record: BCMS policy, signed. Owner: ________
- [ ] 11(2)(a) Arrangements that keep critical or important functions running. Record: BIA results naming those functions. Owner: ________
- [ ] 11(2)(b) and (c) Incident response and containment that limit damage and put resumption first. Record: incident response procedure and continuity plans. Owner: ________
- [ ] 11(2)(d) Preliminary impact, damage and loss estimates. Record: impact assessment template inside the response procedure. Owner: ________
- [ ] 11(2)(e) Communication and crisis management, with reporting under Article 19. Record: crisis communication plan and reporting procedure. Owner: ________
- [ ] 11(3) ICT response and recovery plans, with independent internal audit review (not microenterprises). Record: recovery plans and the internal audit report. Owner: ________
- [ ] 11(4) Continuity plans kept up to date and tested, notably for functions outsourced to ICT third-party providers. Record: plan register with supplier dependencies and test dates. Owner: ________
- [ ] 11(5) A business impact analysis of exposure to severe business disruptions, using quantitative and qualitative criteria and scenario analysis. Record: BIA method and results. Owner: ________
- [ ] 11(6)(a) Tests of the continuity plans and the response and recovery plans at least yearly, and after substantive changes. Record: exercise program, test reports. Owner: ________
- [ ] 11(6)(b) Tests of the crisis communication plans. Record: exercise report covering communications. Owner: ________
- [ ] 11(7) A crisis management function (not microenterprises). Record: crisis team terms of reference. Owner: ________
- [ ] 11(8) Readily accessible records of activities before and during disruption. Record: incident and activation logs. Owner: ________
- [ ] 11(10) An estimate of aggregated annual costs and losses from major ICT-related incidents, on request (not microenterprises). Record: incident cost register. Owner: ________

## DORA Article 12: backup, restoration and recovery

- [ ] Backup policies and procedures that state the scope of data backed up and how often. Record: backup policy. Owner: ________
- [ ] Restoration and recovery procedures and methods. Record: recovery runbooks, linked to the continuity plans. Owner: ________

## NIS2 Article 21(2)(c)

- [ ] Business continuity, such as backup management and disaster recovery, and crisis management, as one of the minimum cybersecurity risk-management measures. Record: BCMS scope, BIA, continuity plans, recovery runbooks, crisis plan. Owner: ________
- [ ] Management body approval of the measures (Article 20). Record: board or management minutes. Owner: ________

## The ISO 22301 records that answer most of these

- [ ] Scope of the BCMS, with critical or important functions inside it
- [ ] Business continuity policy and objectives, approved by top management
- [ ] Business impact analysis and risk assessment, with the method written down
- [ ] Business continuity strategies and solutions, chosen from the BIA
- [ ] Business continuity plans and procedures, including incident response and recovery
- [ ] Exercise program and exercise reports
- [ ] Internal audit program and reports
- [ ] Management review minutes
- [ ] Nonconformity and corrective action log

Sources: Regulation (EU) 2022/2554, Articles 11 and 12 (http://data.europa.eu/eli/reg/2022/2554/oj);
Directive (EU) 2022/2555, Articles 20 and 21 (http://data.europa.eu/eli/dir/2022/2555/oj); ISO 22301:2019
(https://www.iso.org/standard/75106.html). Read 20 October 2026. From Credential Press, credentialpress.com.