The gap assessment scores 43 questions across the eight areas of the BCMS, on the same 0 to 4 maturity scale used by the DORA, ISO 42001 and CPS 234 modules.
What it is for, and how it differs from the requirements
The 45 requirement rows record whether each clause is implemented. The assessment measures how well the judgement calls behind the clauses have been made, which is what a certification auditor spends the audit on. The questions deliberately do not restate the clauses. They ask the things the auditor asks: whether an activity inside the scope depends on something outside it, whether the RTO sits inside the MTPD and the dependencies inside the RTO, whether the activity owners validated their own BIA, which strategy options were rejected and why, whether a deputy could follow the plan under pressure, how transactions captured under workarounds would be reconciled, whether the critical suppliers have ever taken part in an exercise, and whether the last three nonconformities had their cause removed or only their symptom corrected.
The eight areas
| Area | Questions | What the questions test |
|---|---|---|
| Scope and context | 5 | The credibility of the scope boundary, the source of the scope, context refresh, contractual and scheme commitments in the interested party register, ownership of the legal register |
| Leadership and resources | 5 | Whether executives know their crisis role, who accepted residual risk, the capacity and succession of the BCMS owner, the authority of deputies, integration into change and outsourcing governance |
| Business impact analysis | 7 | The MTPD and RTO consistency rules, the approval of impact criteria, business owner validation, timing of the disruption, RPO, minimum capacity and reconciliation with the DORA inventory of critical functions |
| Risk assessment and strategy | 5 | Single points of failure beyond technology, the distinction from the ICT register, rejected strategy options, proven capability against the shortest RTO, capacity under concurrent activation |
| Plans and response structure | 6 | Activation thresholds, the interface with incident management, plan usability by an outsider, offline availability, communication channels independent of the corporate tenant, reconciliation on return to normal |
| Suppliers and dependencies | 5 | Continuity obligations in supplier contracts, the age and scope of assurance evidence, supplier participation in exercises, concentration in a provider or region, group services |
| Exercising and evaluation | 5 | Scenario realism, coverage over the cycle, technical tests versus tabletop, closure of exercise actions, the post-incident review after the last activation |
| Performance, audit and improvement | 5 | Whether indicators measure capability or activity, auditor independence and competence, completeness of the management review inputs, decisions taken and carried out, root cause versus correction |
Scoring
| Score | Meaning |
|---|---|
| 0 | Not Implemented |
| 1 | Initial |
| 2 | Developing |
| 3 | Defined |
| 4 | Optimized |
Questions are weighted 1 to 3 by how much an auditor cares about them: the scope boundary, the residual risk acceptance, the MTPD and RTO rules, the RPO, proven capability against the shortest RTO, activation thresholds, the incident management interface, supplier contract clauses, exercise realism, technical testing and the completeness of the management review carry the highest weight. The overall percentage is computed against every question, answered or not, so an unanswered question reads as a gap rather than being excluded from the denominator. A score of 80 percent or above shows as substantially aligned, 50 to 79 as partial alignment, and below 50 as significant gaps.
Answering from data rather than interview
Several BIA questions (the MTPD and RTO consistency, the RPO, the minimum capacity) can be answered from the BIA records rather than from interview if you keep the MTPD, RTO, RPO and minimum capacity per prioritised activity and check the two consistency rules at each cycle. Record the result of the check in the note on the question, with the date of the BIA it was taken from.
Notes and evidence on answers
Each answer takes a note and an evidence URL. Use the note to record the specific fact behind the score, for example which three dependencies have a recovery objective longer than the RTO they support, which suppliers took part in the last exercise, or the date of the last restore test of the most critical system. Those notes are what make a re-assessment next year meaningful rather than a fresh guess, and they are the facts the certification auditor will ask for.
Working through the assessment
Open ISO 22301, then Gap Assessment, and start a new assessment. It is created in progress and can be saved and resumed.
Work through the eight areas in order; the area navigation shows how many questions are answered and the area score once all are. Answers save automatically.
Once every question has a score, complete the assessment. The overall score is recorded, the assessment becomes read-only and the dashboard shows the maturity beside the requirement coverage.
Open the requirements for the areas that scored lowest, read the guidance and attach the evidence or raise the actions. Re-assess after the next exercise cycle to show the movement.