What is ISO 22301?

Why business continuity matters

A fire in a data centre, a ransomware attack, a flood, a failed supplier or the sudden loss of a few key people can stop an organization in minutes. In an economy of real-time services and transactions, every hour of downtime costs money, and some customers will not wait for a recovery: a single failed delivery can cost a hard-won client.

ISO 22301, published by the International Organization for Standardization (ISO), addresses this directly. Who decides that an incident is a disaster? Which services are restored first? How long can the organization be down before the damage becomes unacceptable? The standard turns these questions into a planned, tested and auditable system instead of an improvised reaction on the worst day.

What is ISO 22301?

The full title is ISO 22301 Security and resilience – Business continuity management systems – Requirements. The current edition is ISO 22301:2019 (second edition), published in October 2019, which replaced ISO 22301:2012. Amendment 1:2024 adds climate action changes. According to ISO's page, the standard is now in the process of being revised, so confirm the current edition and any transition arrangements with ISO or your certification body.

A BCMS is the part of the overall management system that makes sure business continuity is planned, implemented, maintained and continually improved. Unlike some business continuity guidelines, ISO 22301 contains requirements, which means an accredited certification body can audit an organization against it and issue a certificate.

Business continuity belongs within overall risk management and overlaps with information security and IT management. It is related to ISO 27001, but the focus is different: ISO 27001 protects information, while ISO 22301 protects the delivery of products and services.

Basic terms used in the standard

ISO 22301 uses a small group of terms that auditors expect the organization to understand and apply with real figures, not only definitions.

• Business continuity management system (BCMS): the part of the management system that plans, implements, maintains and improves business continuity
• Business impact analysis (BIA): the process of analysing the impact of a disruption over time on the organization's activities
• Maximum tolerable period of disruption (MTPD): the time after which the impact of not resuming an activity becomes unacceptable; some organizations call it the maximum acceptable outage
• Recovery time objective (RTO): the target time by which an activity, product or service must be resumed or resources recovered, and it must be shorter than the MTPD
• Recovery point objective (RPO): the maximum acceptable data loss, expressed as the point in time to which data must be restored
• Minimum business continuity objective (MBCO): the minimum level of products or services the organization needs to deliver after resuming operations

The structure: clauses 4 to 10

ISO 22301 has the same High Level Structure as ISO 9001, ISO 14001, ISO 27001 and ISO 45001. Clauses 1 to 3 cover scope, normative references and terms, and clauses 4 to 10 contain the requirements that are audited.

• Context of the organization (clause 4): understand internal and external issues, interested parties and their requirements, legal and regulatory obligations, and define the scope of the BCMS. For example, a logistics company decides whether the scope covers all depots or only the main distribution centre
• Leadership (clause 5): top management demonstrates commitment, establishes the business continuity policy and assigns roles and authorities. Is someone with real authority able to declare an incident and release resources?
• Planning (clause 6): address risks and opportunities, set measurable business continuity objectives and plan changes to the BCMS
• Support (clause 7): resources, competence, awareness, communication and documented information
• Operation (clause 8): business impact analysis and risk assessment, business continuity strategies and solutions, plans and procedures, and an exercise programme
• Performance evaluation (clause 9): monitoring and measurement, internal audit and management review
• Improvement (clause 10): nonconformities, corrective action and continual improvement

The operation clause in practice

Clause 8 is where business continuity is actually built. The organization is mandated to carry out these activities in sequence, and each output feeds the next.

• Business impact analysis (clause 8.2.2): identify the activities that support the delivery of products and services, assess the impact of disruption over time, and set MTPD, RTO and the resources needed. For example, a payment system might be critical within one hour, while a marketing website can wait two days
• Risk assessment (clause 8.2.3): identify the risks of disruption to the prioritized activities and decide which to treat
• Strategies and solutions (clause 8.3): select options for protection, continuity and recovery, such as alternate sites, backups, supplier alternatives or cross-training, and identify the resources they need
• Plans and procedures (clause 8.4): document the incident response structure, business continuity plans and recovery procedures, including warning, communication and roles
• Exercise programme (clause 8.5): exercise and test the plans at planned intervals, evaluate the results and improve. A plan that has never been tested is only an assumption

The 2024 climate action amendment

ISO 22301:2019/Amd 1:2024 does not rewrite the standard. It makes explicit that the organization considers climate change when it understands its context, because extreme weather, flooding, heat and related events are increasingly a cause of disruption. In practice the organization determines whether climate change is a relevant issue for its BCMS, and considers whether interested parties have climate-related requirements. If it is relevant, the answer should flow into the risk assessment and continuity strategies.

Always confirm the exact amended wording against the published amendment.

Why organizations adopt ISO 22301

Reasons organizations implement and certify to ISO 22301 include:

• Legal and sector expectations: in some sectors such as energy, finance, transport and health, regulators or customers require continuity arrangements, and ISO 22301 gives a recognized framework
• Customer confidence: a certificate demonstrates to customers, partners and owners that continuity is managed and tested
• Less dependence on individuals: critical tasks are documented and have alternates, so losing a key person does not stop the work
• Lower cost of disruption: faster recovery and fewer prolonged outages
• Better links with other systems: continuity requirements can be integrated with ISO 27001, ISO 9001 and ISO 14001 and reuse their audit and review processes
• These benefits depend on a BCMS that is actually exercised; a certificate alone does not provide recovery capability

How to implement ISO 22301

The sequence below follows the logic of the standard and avoids writing plans that nobody tests.

• Management commitment and scope: define what is covered and obtain resources
• Requirements: identify legal, regulatory, contractual and stakeholder requirements
• Policy and objectives: issue the business continuity policy and set measurable objectives
• Business impact analysis: prioritize activities and set MTPD, RTO, RPO and MBCO
• Risk assessment and treatment: assess threats to the priority activities and decide on treatment
• Strategies and solutions: choose how to protect, continue and recover each activity
• Plans and procedures: write the incident response structure, continuity plans and recovery procedures
• Training and awareness: make sure people know their roles during an incident
• Exercise and test: run exercises, review the results and update the plans
• Monitor, audit and review: measure performance, run an internal audit, hold a management review and correct findings

Documents, certification and how ComplyEncrypt helps

ISO 22301 requires documented information including the scope of the BCMS, the business continuity policy and objectives, the legal and other requirements, evidence of competence, records of communication with interested parties, business impact analysis and risk assessment outputs, the incident response structure, business continuity plans and recovery procedures, exercise results, monitoring results, internal audit results, management review results and corrective actions. Confirm the exact required list against the published standard.

An accredited certification body audits the BCMS in two stages: a review of documentation and readiness, then a main audit of how the system works in practice. A certificate is followed by surveillance audits and recertification. ISO itself does not issue certificates.

ISO 22301 is on the ComplyEncrypt roadmap. ComplyEncrypt is built to bring BCMS scope and policy drafts, BIA and risk records, continuity plans, exercise evidence, internal-audit preparation and corrective-action tracking into an AI-assisted workflow, and to connect them with ISO 27001 and DORA work. AI assistance applies to documentation work; people still decide priorities, run exercises, manage incidents and carry out corrective actions, and certification remains the decision of an accredited body. A vigorous continuity programme is judged on the day something goes wrong. See the ISO 22301 framework page for current availability.