Disruptions happen: cyber incidents, supplier failure, extreme weather, loss of a site. ISO 22301 helps you prepare, respond and recover. Certification shows your continuity arrangements are planned, tested and maintained.
What Is ISO 22301?
ISO 22301:2019 (amended 2024) specifies requirements for a business continuity management system (BCMS).
Key Requirements
| Clause | Topic | In practice |
|---|---|---|
| 4–7 | Context, leadership, planning, support | Scope, policy, objectives, competence |
| 8.2 | BIA and risk assessment | Prioritized activities, recovery objectives, dependencies |
| 8.3 | Strategies and solutions | Options to protect and recover prioritized activities |
| 8.4 | Plans and procedures | Response structure, communication, continuity and recovery plans |
| 8.5 | Exercise programme | Exercises and tests that validate plans |
| 9–10 | Evaluation and improvement | Internal audit, management review, corrective action |
The Certification Process
- Application: share your scope, sites and headcount; we confirm the route and audit time.
- Proposal and agreement: written proposal and certification agreement.
- Stage 1 audit: documentation and readiness review.
- Stage 2 audit: on-site evaluation of implementation and effectiveness.
- Certification decision: made by a competent reviewer who was not on the audit.
- Surveillance and recertification: annual surveillance, recertification every three years.
What ISO 22301 Auditors Focus On
- A business impact analysis driven by business impact, not IT preference.
- Dependencies: suppliers, people, premises, technology, information.
- Strategies that can meet recovery objectives.
- Current, owned plans and an exercise programme with lessons acted on.
FAQs
What is the difference between ISO 22301 and ISO 27001?
ISO 22301 covers continuity of all critical activities; ISO/IEC 27001 covers information security. They work well together.
Is disaster recovery the same as business continuity?
No. IT disaster recovery is one part of business continuity, which also covers people, premises, suppliers and communication.