What is ISO 22301?
ISO 22301 sets the requirements for a business continuity management system (BCMS): the way an organisation prepares to keep delivering its most important products and services through a disruption, and to recover afterwards. Disruptions range from a cyber attack or IT failure to a fire, flood, pandemic or supplier collapse.
The current version is the second edition, ISO 22301:2019, with a 2024 amendment that asks organisations to consider whether climate change is relevant to their system. ISO has decided to revise the standard, and the next edition is at committee draft stage.
What does it require?
ISO 22301 uses the harmonised structure shared by ISO management system standards, so its management clauses (context, leadership, planning, support, performance evaluation and improvement) look like those of ISO/IEC 27001 or ISO 9001. The continuity-specific work sits in its operations clause, which in outline asks an organisation to:
- carry out a business impact analysis, to find which activities matter most, how quickly each must be resumed and what they depend on, such as people, premises, technology, information and suppliers;
- carry out a risk assessment of the disruptions that could affect those activities;
- choose business continuity strategies and solutions to protect them and recover them in time;
- write plans and procedures for responding to a disruption, including how incidents are escalated, communicated and managed;
- run an exercise programme, to test that the plans work and that people know their roles;
- evaluate its continuity documentation and capabilities, and improve them.
How is it certified?
Organisations can be certified by an accredited certification body, on the usual three-year cycle with yearly surveillance audits. Certification shows customers and regulators that continuity is managed as a system, not as a one-off plan in a drawer.
What are the related standards?
- ISO 22313: guidance on using ISO 22301.
- ISO/TS 22317: guidance on business impact analysis.
- ISO/IEC 27031: guidance on ICT readiness for business continuity, which links continuity to IT recovery.
How does it relate to cybersecurity frameworks?
Continuity and security overlap heavily. ISO/IEC 27001 includes controls on information security during disruption and on ICT readiness, and ISO 22301 gives the wider management system those controls sit within. Financial regulation such as the EU’s DORA, and cybersecurity law such as NIS2, expect firms to plan for and test their response to disruption. ISO 22301 is a recognised way to organise that work, though it doesn’t by itself prove compliance with either law.
Common misconceptions
Business continuity is not the same as disaster recovery. Disaster recovery restores IT systems; business continuity keeps the business running, which also involves people, premises, suppliers and communications. A BCMS that only covers IT, or that has never been exercised, is unlikely to satisfy an auditor.
Open questions and items to watch
Points that were unsettled, contested or likely to change when this page was last reviewed. Check the official sources before relying on them.
- The publication date and changes in the next edition of ISO 22301, which is still at committee draft stage.
Sources and official references
- ISO 22301:2019 Business continuity management systems — Requirements — ISO (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud by your own device, in the most natural English voice it has. Nothing is sent anywhere. Pick another voice or speed if you prefer.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with ISO (Technical Committee ISO/TC 292, Security and resilience).
