ISO 22301:2019 Business continuity management system
When something goes wrong — an outage, a fire, a cyberattack, a failed supplier — you know what is critical, how much time you have and who does what.
- business impact analysis
- BIA
- recovery time objective
- RTO
- mandatory clauses (4–10)
- 7
- certificate validity
- 3 yrs
The third edition is in development
The current edition is ISO 22301:2019 with Amendment 1:2024. The third edition is at an early development stage in 2026, so certifying to the current version is fully up to date.
What is ISO 22301
ISO 22301 sets the requirements for a business continuity management system. It ensures critical activities can continue or be restored within an acceptable time after a disruption.
At its heart is the business impact analysis (BIA): which activities are critical, how long they can stop and what resources they need.
The standard is closely linked to the resilience requirements of NIS2 and DORA and to ISO/IEC 27001 — control 5.30 “ICT readiness for business continuity”.
What does an hour of downtime cost?
ISO 22301 is for every organisation for which stopping is expensive — financially, contractually or reputationally. Work out at least the lost revenue.
- IT, hosting and SaaS
- Banks, insurers and payment institutions (DORA)
- NIS2 entities
- Logistics and couriers
- Just-in-time manufacturing
- Healthcare and laboratories
- Public-sector suppliers
- Call centres and outsourcing
Wednesday, 08:30 — no power, no internet
A failure cuts power and connectivity at a logistics company’s head office. This is what the day looks like when the continuity plan is ready.
Disruption
The office has no power or internet. Orders stop.
- Alert to the crisis team
- Impact assessment
- Decision to invoke the plan
Activation
The crisis team meets online within 15 minutes.
- Roles from the plan
- Message to customers
- Contact with suppliers
Strategy
Teams switch to remote work and backup connectivity.
- Cloud systems
- Backup 4G internet
- Priorities from the impact analysis
Recovery
Critical activities are restored before their RTOs.
- Orders — in 3 hours
- Warehouse — in 6 hours
- Invoicing — in 20 hours
Lessons
The post-incident review improves the plan.
- Post-incident report
- Updated plan and contacts
- New exercise in 6 months
One system — several requirements
Continuity is now a legal and contractual obligation. ISO 22301 is the recognised way to cover it and prove it.
NIS2 Business continuity, backups, recovery and crisis management Impact analysis, strategies, plans and exercises DORA ICT business continuity policy and plan testing Documented plans and an exercise programme ISO 27001 Controls 5.29 and 5.30 — security during disruption and ICT readiness A full system instead of isolated controls GDPR Availability and restoration of personal data (Art. 32) Recovery times and acceptable data loss Customers Contractual SLAs and supplier questionnaires A certificate instead of long questionnaires Insurers Proven measures for cyber and property policies Exercise and test reports A plan that works at 8:30 in the morning
Not a thick manual, but short, clear plans people know because they have practised them.
Free consultation- Business impact analysis (BIA)
- Recovery objectives (RTO and RPO) per activity
- Disruption risk assessment
- Strategies for people, premises, IT and suppliers
- Incident and crisis management plan
- Recovery plans per activity
- Exercise with report and recommendations
- Internal audit and management review
Resilience and security — together
ISO 22301 shares its structure with ISO 27001 and is the natural basis for resilience requirements.
The structure of the standard
Clauses 4–10 are mandatory. The practical core is clause 8 — from analysis to exercises.
Clause 4 — Context of the organisation
Products and services, interested parties, legal requirements, scope of the system.
Clause 5 — Leadership
Management commitment, business continuity policy, roles and responsibilities.
Clause 6 — Planning
Risks and opportunities, continuity objectives, planning of changes.
Clause 7 — Support
Resources, competence, awareness, communication, documented information.
Clause 8 — Operation
BIA and risk assessment, strategies and solutions, continuity plans, exercise programme.
Clause 9 — Performance evaluation
Monitoring, evaluation of documentation and capabilities, internal audit, review.
Clause 10 — Improvement
Nonconformity, corrective action, continual improvement.
The key elements of clause 8
This is the practical core of the standard — from impact analysis to rehearsed exercises.
- 01
Business impact analysis (BIA)
Which activities are critical and what every hour of disruption costs.
- 02
Recovery objectives
Maximum tolerable disruption, recovery time objective (RTO) and acceptable data loss.
- 03
Risk assessment
Which disruptions are likely and how to reduce them.
- 04
Strategies and solutions
Backup sites, backups, alternative suppliers, remote work.
- 05
Continuity plans
Who does what, and in what order, during an incident.
- 06
Exercises and tests
Plans are tested in practice before they are needed.
What you gain
Resilience in an outage
Critical services come back within agreed times.
A basis for NIS2 and DORA
The recognised framework for continuity and recovery requirements.
Client trust
Contracts increasingly require proven continuity.
Smaller losses
Shorter disruption means less lost revenue.
Clear roles in a crisis
Nobody improvises when there is no time.
Synergy with ISO 27001
Shared structure and shared ICT readiness controls.
The route to certification
Six stages with a clear deliverable at each.
- 01 1–2 wks
Scope and context
Which products, services and sites are in the system.
- 02 2–4 wks
BIA and risk assessment
Critical activities, recovery objectives, risks.
- 03 2–3 wks
Strategies
Solutions for resources, people, IT and suppliers.
- 04 2–4 wks
Continuity plans
Response and recovery plans.
- 05 1–2 wks
Exercise and internal audit
Testing the plans in practice.
- 06 Stage 1 + 2
Certification audit
Stage 1 and Stage 2 by an accredited body.
Timeline and cost — what drives them
The cost depends mainly on the number of critical activities and IT dependency. These are the factors — plus an estimator.
Employees and sites
Set the workload and audit days.
Critical activities
How many products and services need protection.
IT dependency
Systems, cloud services, backups and fallback solutions.
Suppliers
Critical suppliers and their own plans.
Exercises
The scale of exercises and tests.
Certification fee
Paid separately to the certification body.
01 What is the difference between a continuity plan and ISO 22301?
A business continuity plan (BCP) is a document. ISO 22301 is the whole system around it — analysis, strategies, exercises, responsibilities and improvement.
02 Is it linked to NIS2 and DORA?
Yes. Both require continuity, backup and recovery measures. ISO 22301 is the recognised framework for meeting them.
03 Can we combine it with ISO 27001?
Yes — the structure is shared, and the continuity controls in ISO 27001 Annex A are covered naturally.
04 How often should we exercise?
The standard requires a programme of exercises and tests at planned intervals. In practice — at least once a year and after significant changes.
05 How long does it take?
Usually 3 to 6 months, depending on the number of critical activities. Use the estimator for guidance.
No such question in the list — ask us directly and we will reply.
Your first consultation is free
Tell us about your company and your goal. You will get a clear plan and a quote within one business day.