ISO 22301: the standard for business continuity management

What ISO 22301 is and who it applies to

ISO 22301 is the international standard for business continuity management systems (BCMS). It was first published in 2012 and revised in 2019. It sets out how to identify threats to your organisation, assess their impact, and build the ability to keep operating during and after a disruption.

The standard is voluntary. Organisations take it on when customers, regulators or insurers ask for it, when they work in sectors where an outage does serious harm, or when they want a continuity programme that does not depend on a few people who know how things work.

Business continuity

The capability to continue delivering products and services at acceptable predefined levels during a disruption.

BCMS

Business continuity management system: the policies, procedures, plans and resources that manage business continuity.

Disruption

An event that interrupts normal operations, such as a data centre failure, a pandemic or the collapse of a key supplier.

Business impact analysis and risk assessment

The rest of an ISO 22301 programme is built on two pieces of work: the business impact analysis (BIA) and the risk assessment. The BIA identifies which activities are critical and how quickly they must recover. The risk assessment identifies what could disrupt them.

Together they tell you what to protect and what to protect it from. Plans written without them rest on assumptions nobody has checked.

• Business impact analysis. Identify the activities that deliver your products and services. For each, set the maximum tolerable period of disruption (MTPD) and list the resources it depends on.
• Recovery time objectives. Set a target for how quickly each critical activity must resume. The RTO must be shorter than the MTPD.
• Recovery point objectives. For activities that rely on data, decide how much data loss is tolerable. This sets your backup frequency.
• Dependencies. Record what each activity depends on: people, technology, suppliers, facilities and information. Plans that leave out a dependency tend to break when that dependency fails.
• Risk assessment. Identify the threats and vulnerabilities that affect your critical activities, and assess likelihood and impact. This is separate from your information security risk assessment, though the two use similar methods and sometimes overlap.

Business continuity strategies and plans

Once you know what must continue and what could stop it, you choose a strategy for each critical activity and write the plans that carry those strategies out during a disruption.

A strategy is a decision about how to keep or restore an activity, for example an alternative site, a manual workaround or a standby supplier. A plan is the written procedure for carrying it out: who does what, in what order, and with what resources.

• BC strategies. One or more strategies for each critical activity. Each must deal with the dependencies the BIA identified.
• BC plans. Procedures that people follow during an incident. Each plan names the activities it covers, what triggers it, the roles, how people communicate and the recovery steps.
• Incident response structure. Who declares an incident, who leads the response, how teams communicate and how issues are escalated. ISO 22301 expects this to be agreed and written down in advance.
• Communication plans. How you tell staff, customers, suppliers, regulators and the media during a disruption: who speaks, through which channels, and which messages are approved in advance.
• Resource requirements. The people, technology, facilities, information and supplies each plan needs. Check that you can actually get them during a disruption.

Exercising the plans

You only learn whether a plan works by testing it. ISO 22301 requires you to exercise your business continuity arrangements and use the results to improve them.

Exercises can be anything from a tabletop walkthrough to a full simulation. The standard does not set a frequency, but expects a programme that covers every plan over time and uses realistic scenarios.

• Tabletop exercises. Walk the response team through a scenario. They cost little and show up gaps in roles, communication and decision-making.
• Functional exercises. Test one part of the arrangements, such as failing over to a backup site, switching to a manual workaround or running the communication plan.
• Full-scale simulations. Simulate a disruption as realistically as you can. They are expensive and disruptive, so they happen less often, but they find more.
• Post-exercise reviews. Record what worked, what did not and what will change. ISO 22301 expects corrective actions to be tracked until they are closed.

How ISO 22301 fits with ISO 27001, DORA and NIS 2

ISO 22301 uses the same Annex SL high-level structure as ISO 27001 and ISO 42001. The management system clauses (context, leadership, planning, support, performance evaluation, improvement) follow the same structure. If you already run an ISMS, a BCMS can reuse most of it.

ISO 27001 Annex A includes control A.5.30 (ICT readiness for business continuity), which requires ICT continuity plans. ISO 22301 is the full management system behind that control. Running both standards in one management system avoids doing the same work twice.

Annex SL

The high-level structure all new and revised ISO management system standards must follow. It defines common clause numbering, terms and core requirements so standards can be integrated.

Integrated management system

A single management system that meets several standards, with one management review, one internal audit programme and one corrective action process.

DORA

DORA (Digital Operational Resilience Act) requires financial entities in the EU to maintain ICT business continuity and disaster recovery plans. ISO 22301 is a recognised framework for meeting these requirements.

NIS 2

The EU Network and Information Security Directive requires essential and important entities to take measures for business continuity, including backup management and disaster recovery. ISO 22301 certification shows a structured approach to these obligations.

The certification process

ISO 22301 certification follows the same two-stage audit as ISO 27001. An accredited certification body reviews your management system documentation (Stage 1) and then audits it in operation (Stage 2). Certification is valid for three years, with surveillance audits in years two and three and a recertification audit at the end.

How long readiness takes depends on whether you already run an ISO 27001 management system (which shares the same structure), how complex your operations are, and how many critical activities the BIA finds. Organisations with an existing ISMS usually move faster.