Last updated: 4 November 2026
Quick answer: ISO 22301 is the international standard for business continuity management systems. It requires organisations to understand their context, run a business impact analysis and risk assessment, set recovery objectives, build continuity strategies and plans, exercise them, and improve through audits and management review. It is certifiable and maps well to DORA, NIS2 and UK operational resilience rules.
Disruption rarely announces itself. A cloud outage, a ransomware attack, a supplier failure or a flood can stop critical services within hours. ISO 22301 business continuity management gives organisations a structured, auditable way to prepare for that moment and recover in a controlled way.
For risk managers, the standard is increasingly the backbone for regulatory continuity requirements too. This guide explains what ISO 22301 requires clause by clause, how the business impact analysis works, how it relates to EU, UK and US rules, and a step-by-step plan to implement it.
What is ISO 22301 business continuity management?
ISO 22301 specifies the requirements for a business continuity management system (BCMS): a documented management system to protect against, reduce the likelihood of, prepare for, respond to and recover from disruptions. Like ISO 27001, it follows the ISO harmonised structure with clauses 4 to 10.
The current edition is ISO 22301:2019. According to the ISO catalogue entry, it was published on 30 October 2019, amended in 2024 to add climate action changes, and, following systematic review, is being revised, with a committee draft (ISO/CD 22301) under development. Until a new edition is published, certification continues against the 2019 version with its amendment.
Supporting guidance sits in related standards: ISO 22313 gives guidance on using ISO 22301, and ISO/TS 22317 gives guidance on business impact analysis. Neither is certifiable on its own.
What does ISO 22301 require, clause by clause?
Clauses 4 to 10 contain the requirements. Most of the continuity-specific content sits in clause 8, while the others set up the management system around it.
| Clause | Topic | Key outputs |
|---|---|---|
| 4 | Context of the organisation | Internal and external issues (including climate change), interested parties, legal requirements, BCMS scope |
| 5 | Leadership | Top management commitment, business continuity policy, roles and responsibilities |
| 6 | Planning | Actions to address risks and opportunities, business continuity objectives, planning changes |
| 7 | Support | Resources, competence, awareness, communication, documented information |
| 8 | Operation | BIA and risk assessment, strategies and solutions, plans and procedures, exercise programme, evaluation |
| 9 | Performance evaluation | Monitoring and measurement, internal audit, management review |
| 10 | Improvement | Nonconformity, corrective action, continual improvement |
Clause 8 in more detail
- 8.2 Business impact analysis and risk assessment: identify prioritised activities, the impact of disruption over time, resources needed and the risks of disruption.
- 8.3 Business continuity strategies and solutions: choose options to protect prioritised activities, reduce the likelihood of disruption and shorten its duration.
- 8.4 Business continuity plans and procedures: response structure, warning and communication, and plans to continue and recover activities.
- 8.5 Exercise programme: exercises and tests that validate strategies and plans over time.
- 8.6 Evaluation: assess the suitability, adequacy and effectiveness of continuity documentation and capabilities.
Common mistake: Writing plans before the business impact analysis. Plans built on assumptions rather than agreed recovery priorities tend to protect the wrong things and fail their first exercise.
How does the business impact analysis work?
The business impact analysis (BIA) identifies which activities matter most and how quickly they must be restored. It converts business priorities into measurable recovery objectives that drive every later decision.
A good BIA sets four values for each prioritised activity:
| Term | Meaning | Example for online payments |
|---|---|---|
| MTPD (maximum tolerable period of disruption) | Time after which the impact becomes unacceptable | 8 hours |
| RTO (recovery time objective) | Target time to resume the activity, set within the MTPD | 4 hours |
| RPO (recovery point objective) | Maximum acceptable data loss, measured in time | 15 minutes |
| MBCO (minimum business continuity objective) | Minimum service level acceptable during disruption | 70% of normal transaction volume |
The examples above are illustrative, not benchmarks. Your own values must come from interviews with activity owners and agreement from top management.
In practice: Record the dependencies behind each prioritised activity, including people, sites, applications, data and suppliers. Those dependencies are what your strategies must protect, and they often reveal single points of failure in third-party services.
How does ISO 22301 relate to DORA, NIS2 and UK rules?
ISO 22301 is voluntary, but many regulations now require continuity capabilities that an ISO 22301 BCMS delivers. Certification does not prove compliance with any regulation on its own, yet it gives you most of the processes and evidence regulators ask for.
In the EU, Article 11 of the Digital Operational Resilience Act (DORA) requires financial entities to have an ICT business continuity policy, carry out a BIA and test ICT business continuity and response and recovery plans at least yearly, with cyber-attack scenarios for non-microenterprises. Article 21(2)(c) of the NIS2 Directive lists “business continuity, such as backup management and disaster recovery, and crisis management” among the minimum cybersecurity measures.
In the UK, the FCA and PRA operational resilience rules required in-scope firms to have completed mapping and testing by 31 March 2025, so that they can remain within impact tolerances for each important business service, as the FCA’s operational resilience page explains. In the US, federal agencies and many contractors use NIST SP 800-34 Rev. 1, the contingency planning guide for federal information systems, which includes BIA templates.
| Region | Key rule or guide | How ISO 22301 helps |
|---|---|---|
| EU | DORA Article 11 (financial entities); NIS2 Article 21(2)(c) | BIA, continuity policy, yearly exercises and evidence of review |
| UK | FCA and PRA operational resilience (important business services, impact tolerances) | Mapping of dependencies, scenario testing, lessons learned |
| US | NIST SP 800-34 Rev. 1; sector rules | A management system around system-level contingency plans |
Because the same continuity controls answer several regimes, it pays to manage them once. Enactia’s AI-powered GRC platform cross-maps ISO 22301 with ISO 27001, DORA, NIS2 and other frameworks through its Compliance Universe, so a single exercise record or BIA can evidence several requirements. To see how that works for your programme, start your 14-day free trial.
How do you implement ISO 22301 step by step?
Most organisations can implement a BCMS in a structured sequence of eight steps. Timelines vary with scope and maturity, so plan the programme around your first full exercise rather than a fixed date.
- Define scope and context: Choose the products, services, sites and activities in scope, and record legal and regulatory requirements.
- Secure leadership: Approve a business continuity policy, appoint a BCMS owner and assign roles.
- Run the BIA: Identify prioritised activities, set MTPD, RTO, RPO and MBCO, and record dependencies.
- Assess risks: Identify risks of disruption to prioritised activities and their resources, using your enterprise risk management process.
- Select strategies: Decide how to protect, continue and recover each activity, including alternative sites, backups, manual workarounds and supplier options.
- Write plans: Create incident response, crisis communication and recovery plans, and keep them version-controlled in a policy management tool.
- Exercise: Run a programme of tabletop, walkthrough and technical recovery tests, and record results and actions.
- Evaluate and improve: Carry out internal audits and management review, correct nonconformities and prepare for certification.
What evidence will an auditor ask for?
Expect requests for the scope statement, business continuity policy, BIA and risk assessment records, approved strategies, plans, the exercise programme and reports, competence and awareness records, internal audit reports, management review minutes and corrective action logs. Keeping them linked to the underlying risks and incidents makes the audit trail much easier to follow.
How does ISO 22301 connect to ISO 27001 and supplier risk?
ISO 22301 and ISO 27001 share the same management system structure, so you can run one set of governance processes, internal audits and management reviews for both. ISO 27001:2022 Annex A also includes controls on information security during disruption and ICT readiness for business continuity, which overlap with ISO 22301 clause 8.
Suppliers are the other key link. Many disruptions start at a third party, so your BIA dependencies should feed directly into vendor and third-party risk management, with continuity requirements in contracts and exit plans for critical providers. For the risk method behind this, see our ISO 27005 risk assessment guide.
Key takeaways
- ISO 22301:2019, amended in 2024, is the certifiable standard for business continuity management systems; a revision is under development.
- Clause 8 holds the core: BIA and risk assessment, strategies, plans, exercises and evaluation.
- The BIA sets MTPD, RTO, RPO and MBCO and should come before any plan is written.
- DORA, NIS2 and UK operational resilience rules all require continuity capabilities that a BCMS supports.
- Run ISO 22301 alongside ISO 27001 and supplier risk management to avoid duplicated effort.
Frequently asked questions
What is the difference between ISO 22301 and ISO 22313?
ISO 22301 contains the requirements for a business continuity management system and is the standard you certify against. ISO 22313 provides guidance on how to apply those requirements, with explanations and examples. Organisations typically use ISO 22313 as a companion while implementing ISO 22301, but auditors assess conformity against ISO 22301 only.
Is ISO 22301 certification mandatory?
No. ISO 22301 is a voluntary standard. However, regulations such as DORA and NIS2, and UK operational resilience rules, require continuity capabilities that closely match its requirements. Certification is often requested by customers and partners as independent evidence that your organisation can continue delivering critical services during disruption.
How often must business continuity plans be exercised under ISO 22301?
ISO 22301 requires an exercise programme that validates your strategies and solutions over time, at planned intervals and when there are significant changes, but it does not set a fixed frequency. Regulations can be stricter: DORA, for example, requires financial entities to test ICT continuity plans at least yearly.
What is a business impact analysis in ISO 22301?
It is the process in clause 8.2 that identifies prioritised activities, assesses the impact of disruption over time and sets recovery priorities and objectives. Typical outputs are the maximum tolerable period of disruption, recovery time objective, recovery point objective and the resources and dependencies needed for each prioritised activity.
Can ISO 22301 and ISO 27001 be certified together?
Yes. Both follow the ISO harmonised structure, so many certification bodies offer combined or integrated audits. You can share governance, document control, internal audit, management review and corrective action processes, while keeping the continuity-specific requirements of clause 8 and the information security controls of ISO 27001 Annex A distinct.
Building resilience you can prove
ISO 22301 business continuity management turns good intentions into tested, auditable capability. Start with scope and a solid BIA, choose strategies that protect your real dependencies, exercise regularly and use audits and management review to keep improving. The same work supports DORA, NIS2 and UK operational resilience expectations, which makes a BCMS one of the most reusable investments a risk team can make.
To discuss your continuity programme, contact us or book a demo or start your 14-day free trial.
