What it covers. An international standard specifying requirements for a business continuity management system. It helps organisations prepare for, respond to and recover from disruptive incidents, using the same management system structure as ISO/IEC 27001.
In practice. Applying it well means performing a business impact analysis and risk assessment, setting priorities and recovery objectives, developing continuity strategies and plans, and exercising them regularly. Leadership is involved and results feed improvement. Evidence includes the impact analysis, plans, exercise reports and management review records. It supports operational resilience expectations such as those in DORA and NIS2.
Common gaps. Common gaps are plans that do not reflect dependencies on IT and suppliers, exercises limited to desk reviews and objectives that were never validated.