# Clause 5.2.1: Establishing the business continuity policy

Top management must set a business continuity policy that suits the organization's purpose, gives a frame for setting continuity objectives, and commits the organization to satisfying applicable requirements and to continually improving the BCMS.

Cloud: When the policy is established, give it the levers that matter with a provider: continuity terms in the contract, a named contact in an incident, and a right to test. A policy without those levers is a statement of hope.

Evidence: Approved policy carrying an explicit commitment to applicable requirements and to improvement; Approval record naming the top management body and the date; Traceability from the policy to the continuity objectives set under it.

Test: Map each policy commitment to a contract clause or an internal control that delivers it.

Citation: ISO 22301:2019, clause 5.2.1. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.