ISO 22301: Business Continuity Management Systems

ISO 22301 is the international standard for business continuity management systems, often shortened to BCMS. It is published by the International Organization for Standardization (ISO). It sets out what an organization must do to plan, set up, run, monitor, review and continually improve a documented management system that helps it prepare for, respond to and recover from disruptive incidents.

In plain terms, ISO 22301 is a rulebook for keeping an organization working when something goes badly wrong. The cause might be a fire, a flood, a cyberattack, a pandemic, the failure of a key supplier, a power cut or the loss of a building. The standard does not tell an organization exactly how to survive each of these. It describes a management system: a repeatable way of understanding what matters most, deciding how fast it must come back, preparing plans and resources, practising them, and learning from the results.

Because ISO 22301 is a requirements standard, organizations can be independently audited and certified against it. Certification shows customers, regulators and other stakeholders that the organization has a business continuity programme that meets an internationally agreed benchmark.

This article covers where the standard came from, how it is structured, what its key requirements mean in practice, the core vocabulary such as business impact analysis and recovery time objectives, how certification works, how it relates to other standards, its limits, common misconceptions, and frequently asked questions.

What Business Continuity Means

Core definitions

Business continuity is an organization's ability to keep delivering products or services at acceptable, predefined levels after a disruptive incident. Business continuity management is the ongoing work of building and maintaining that ability. A business continuity management system is the set of policies, processes, roles, documents and reviews through which an organization manages business continuity in a structured, repeatable way.

Business continuity planning is often treated as part of risk management. Its aim is to keep critical operations running before and during recovery from a disaster, rather than only restoring them afterwards.

Business continuity versus disaster recovery

The two terms are often confused. Disaster recovery usually refers to restoring information technology systems and data after an outage. Business continuity is broader. It covers people, premises, suppliers, communications and processes as well as technology. An organization could restore its servers perfectly and still fail to serve customers if staff cannot reach a workplace, a sole supplier is shut down, or nobody knows who is in charge. ISO 22301 deals with the whole organization. Technology recovery is one part of it.

Why it matters

Organizations depend on chains of systems, people and suppliers that can fail in many ways. Some events are local, such as a burst pipe in a data room. Others are regional or global, such as a pandemic. During the 2002–2003 SARS outbreak, for example, some organizations rotated and separated their teams in line with the disease's incubation period so that a single infection could not take out a whole function. That is a business continuity decision. It is about keeping work going, not about technology.

In the United Kingdom, the Civil Contingencies Act 2004 put business continuity duties on certain organizations. In the United States, federal agencies follow continuity-of-operations requirements. Many regulators in finance, health care and critical infrastructure expect regulated organizations to show they can withstand and recover from disruption. ISO 22301 gives organizations a common framework that can satisfy many of these expectations at once.

History of the Standard

British roots: PAS 56 and BS 25999

ISO 22301 grew out of British work. In 2003 the British Standards Institution (BSI) published PAS 56, a Publicly Available Specification on business continuity management. It was replaced by a two-part British Standard:

• BS 25999-1:2006, a code of practice published in December 2006. It gave general guidance on business continuity processes, principles and terminology.
• BS 25999-2:2007, a specification published in November 2007. It set requirements for implementing, operating and improving a business continuity management system. Organizations could be certified against this part.

BS 25999 became widely used and fed directly into the international standards that replaced it. It also influenced other standards, such as ASIS/BSI BCM.01:2010, which ASIS and BSI developed jointly and published in December 2010.

The first edition: ISO 22301:2012

ISO's technical committee ISO/TC 223, Societal security, developed the first edition of ISO 22301. It was published in May 2012. It was the first ISO standard to fully adopt the Annex SL format, the common structure ISO now uses for all of its management system standards (see below).

Once ISO 22301 and its companion guidance standard ISO 22313 were available, BSI withdrew its national standard. BS 25999-2 was withdrawn in November 2012 and replaced by ISO 22301. BS 25999-1 was withdrawn in early 2013 and replaced by ISO 22313.

The second edition: ISO 22301:2019

ISO/TC 223 was later dissolved, and its work passed to a new committee, ISO/TC 292, Security and resilience. TC 292 produced the second edition, published on 31 October 2019. The revision mainly refactored the text to remove repetition and make it clearer. It did not change the basic approach. The 2019 edition is the current version of the standard.

The 2024 climate amendment

In February 2024 ISO published short "climate action changes" amendments to its management system standards. The ISO/IEC 27001 amendment, for example, adds one requirement to the clause on the organization's context: the organization must determine whether climate change is a relevant issue. It also adds a note to the clause on interested parties, saying that they can have climate-related requirements. ISO 22301:2019 received the same kind of amendment, ISO 22301:2019/Amd 1:2024. The change is small in wording, but for a business continuity system it is a natural fit, because climate-related events such as floods, heatwaves and storms are direct sources of disruption.

Timeline

The Shape of the Standard: Annex SL

A shared skeleton

ISO publishes many management system standards: ISO 9001 for quality, ISO 14001 for environmental management, ISO/IEC 27001 for information security, and others. In the past each had its own structure, which made it awkward for organizations to run several at once. ISO's answer was Annex SL, part of the ISO/IEC Directives. It sets a high-level structure, now called the harmonized structure, with the same clause numbers, clause titles, core text and core definitions in every management system standard. Each standard then adds its own discipline-specific requirements.

ISO 22301:2012 was the first standard to adopt this structure fully. ISO 9001 and ISO 14001 moved to it in 2015, and ISO/IEC 27001 also follows it. The practical effect is that an organization with ISO 9001 or ISO/IEC 27001 already has much of the management machinery ISO 22301 needs, such as document control, internal audit, management review and corrective action.

The ten clauses

Clauses 1 to 3 contain no requirements. Clauses 4 to 10 contain the "shall" statements an auditor checks. Most of clauses 4, 5, 6, 7, 9 and 10 are the shared Annex SL text with business continuity wording added. Clause 8 is where the standard's distinctive content lives.

The Plan–Do–Check–Act logic

The clauses follow the familiar Plan–Do–Check–Act cycle:

• Plan (clauses 4–7): understand the organization, get leadership commitment, set objectives and provide resources.
• Do (clause 8): analyse impacts and risks, choose strategies, write plans and exercise them.
• Check (clause 9): monitor, measure, audit and review.
• Act (clause 10): fix problems and improve.

The cycle repeats. Business continuity is treated as an ongoing management discipline, not a one-off project that produces a binder of plans.

The Requirements in Practice

Clause 4: Context

The organization must understand its internal and external situation and the needs of interested parties such as customers, staff, regulators, owners, suppliers and the community. It must identify legal and regulatory requirements that bear on business continuity. It must then define the scope of the BCMS, meaning which parts of the organization, which products and services, and which locations are covered. A defined, documented scope matters because certification applies only to what is in scope.

Scoping is one of the most important decisions in an ISO 22301 programme. A narrow scope, such as one product line at one site, is easier to implement and certify but protects less. A wide scope protects more but takes far more effort. Customers reviewing a supplier's certificate should always read the scope statement.

Clause 5: Leadership

Top management must show leadership and commitment. That means making sure the BCMS fits the organization's strategy, providing resources, communicating its importance and supporting the people who run it. Top management must set a business continuity policy and assign roles, responsibilities and authorities. In practice, a continuity programme without real executive sponsorship tends to stall. The standard makes that sponsorship an auditable requirement.

Clause 6: Planning

The organization must address risks and opportunities to the management system itself, set measurable business continuity objectives, and plan how to achieve them. The 2019 edition added explicit requirements for planning changes to the BCMS, so that changes are made in a controlled way.

Clause 7: Support

This clause covers the resources the system needs: competent people, awareness across the organization, internal and external communication, and documented information that is created, controlled and kept up to date. Communication is especially important for business continuity, because plans must say who tells whom what during an incident, including staff, customers, the media and authorities.

Clause 8: Operation

Clause 8 is the heart of the standard. It is usually described in six parts.

The following sections explain the main ideas in clause 8.

Business Impact Analysis

What it is

A business impact analysis, or BIA, identifies and evaluates how disruption would affect an organization's activities, and uses that to set recovery priorities. It is the foundation of business continuity. Its usual objectives are to:

• Identify critical activities and the resources and dependencies they rely on.
• Assess the impacts of disruption over time: financial, operational, reputational, legal and regulatory.
• Set recovery time objectives and recovery point objectives.
• Provide a basis for choosing strategies.
• Inform the risk assessment.

The key idea is that impacts grow over time. A one-hour outage of a payroll system may not matter. A one-week outage at the end of the month might mean staff are not paid, with legal and reputational consequences. A BIA maps how bad things get as time passes, and that tells the organization how quickly each activity must return.

ISO publishes separate guidance on BIA in ISO/TS 22317. The US National Institute of Standards and Technology (NIST) also describes a BIA process for information systems in its Special Publication 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems (May 2010, updated November 2010). It sets out three steps:

1. Determine mission or business processes and their recovery criticality, including the impact of disruption and estimated downtime.
2. Identify resource requirements, meaning the resources needed to resume processes and their interdependencies.
3. Identify recovery priorities for the system's resources.

The key time and data measures

Several measures recur in business continuity, and different documents use slightly different names for them.

The ISO vocabulary treats maximum acceptable outage and MTPD as the same thing. NIST SP 800-34 defines MTD as the total time leaders and managers are willing to accept for a business process outage, including all impact considerations. It defines RTO as the maximum time a system resource can stay unavailable before there is an unacceptable impact on other resources, supported processes and the MTD. It defines RPO as the point in time before a disruption to which data must be recovered, given the most recent backup. NIST notes that the first version of SP 800-34 used the term maximum allowable outage.

The relationship between these measures is important. The RTO must be shorter than the MTPD, because recovery has to finish before the damage becomes unacceptable. The gap between them is a safety margin. The RPO sets how often data must be backed up or replicated. If the RPO is four hours, backups or replication must happen at least every four hours, and in practice more often to allow for failures.

For some US federal systems the requirement is concrete. NIST notes that any information system supporting continuity-of-operations mission essential functions must be able to meet the function's MTD of 12 hours or less, under Federal Continuity Directive 1.

Worked example: setting recovery targets (hypothetical)

A hypothetical online retailer runs a BIA on its order-processing activity. Its managers estimate the impacts of an outage over time:

From this the managers set an MTPD of 48 hours. They choose an RTO of 12 hours, leaving a 36-hour margin for things to go wrong during recovery. They decide that losing more than 30 minutes of orders would be unacceptable, because each lost order means a refund and an apology, so the RPO is 30 minutes. That rules out nightly backups as the only protection. They need replication or very frequent backups, at least every 30 minutes.

If the order system handles, say, 600 orders an hour, a 30-minute RPO means up to 300 orders might have to be re-entered or apologised for after a worst-case failure (600 × 0.5 = 300). A one-hour RPO would double that to 600. Numbers like these let managers weigh the cost of better replication against the cost of lost data, which is what the BIA is for.

Risk Assessment

The BIA asks what matters and how fast it must come back. The risk assessment asks what could disrupt it. ISO 22301 requires a documented process to identify the risks of disruption to prioritised activities and the resources they need, to analyse and evaluate those risks, and to decide which need treatment.

Risks might include natural hazards, loss of utilities, IT failure, cyberattack, loss of key staff, supplier failure, building damage, and wider events such as pandemics. The standard aligns with general risk management practice in ISO 31000 but does not require any particular method.

Business continuity works on both sides of an incident. Risk treatment reduces the chance or size of a disruption, for example through fire suppression, redundant power or a second supplier. Continuity strategies limit the damage when disruption happens anyway. NIST describes the first kind as preventive controls, which reduce the effects of disruptions and can lower overall contingency costs.

Strategies and Solutions

Once priorities and risks are understood, the organization chooses strategies to protect, stabilise, continue, resume and recover its prioritised activities. The 2019 edition calls these "business continuity strategies and solutions." Strategies must address resources such as:

• People: cross-training, succession for key roles, arrangements for staff absence.
• Information and data: backups, replication, off-site storage, matched to the RPO.
• Buildings and facilities: alternate sites, working from home, reciprocal arrangements.
• Equipment and consumables: spares, stockpiles, rapid-replacement contracts.
• Information and communications technology: redundant systems, failover, cloud recovery.
• Transport and logistics: alternate routes and carriers.
• Finance: access to emergency funds, insurance.
• Partners and suppliers: dual sourcing, supplier continuity requirements, contracts.

ISO publishes further guidance in ISO/TS 22331 on business continuity strategy and in ISO/TS 22318 on supply chain continuity.

Worked example: choosing between strategies (hypothetical)

A hypothetical firm needs its customer service desk back within 8 hours of losing its office. It considers three options:

Option A fails the requirement outright. Options B and C both meet it. The firm might choose B as its main strategy and test that remote access can handle the whole team at once. That last point is easy to miss. Remote access systems sized for a few home workers can fail when everyone logs in at the same moment. An exercise is the way to find out.

Plans and Procedures

ISO 22301 requires a response structure that can deal with disruption, with named teams, clear authority to activate plans, and procedures for warning and communication. Business continuity plans must set out how the organization will respond, continue and recover. A plan typically includes:

• Its purpose, scope and objectives.
• Who can invoke it and on what triggers.
• Roles and responsibilities, with deputies.
• Steps to take and the order in which to recover activities.
• Communication arrangements, including contact lists and call trees.
• Resource requirements and where to find them.
• How to stand down and return to normal operation.

ISO/TS 22332 gives guidance on developing plans and procedures. NIST SP 800-34 describes a related structure for information system contingency plans with three phases: activation and notification, recovery, and reconstitution, which includes testing that the system works and returning it to normal operation.

Many kinds of plan

Organizations often use several related plans. NIST SP 800-34 distinguishes, among others, business continuity plans, continuity of operations plans, crisis communications plans, critical infrastructure protection plans, cyber incident response plans, disaster recovery plans, information system contingency plans and occupant emergency plans. ISO 22301 does not require any particular set of documents. It requires that the plans together cover what the BIA and risk assessment show is needed.

Exercises and Evaluation

Why exercise

A plan that has never been tried is a hypothesis. Exercising shows whether people know their roles, whether contact details are current, whether backup systems actually restore, and whether recovery can really meet the RTO. ISO 22301 requires an exercise programme that tests strategies and plans regularly and after significant changes, produces written post-exercise reports, and leads to improvements.

Kinds of exercise

Practitioners describe exercises in several ways. BSI's 2008 publication Exercising for Excellence describes three levels:

NIST SP 800-34 makes a similar distinction. Tabletop exercises are discussion-based and do not deploy equipment. Functional exercises have staff perform their duties in a simulated environment, ranging up to full-scale exercises. NIST links the depth of exercise to a system's impact level: a tabletop exercise for low-impact systems, a functional exercise including recovery from backup for moderate-impact systems, and a full-scale functional exercise including failover to an alternate site for high-impact systems. NIST suggests reviewing and testing plans at an organization-defined frequency, such as yearly, or whenever there is a significant change. Its broader control guidance also lists checklists, walk-throughs, simulations, parallel tests and full-interrupt tests as methods.

Evaluation

Clause 8.6 of the 2019 edition requires the organization to evaluate its business continuity documentation and capabilities, checking that they remain suitable, adequate and effective. Evaluations can happen through exercises, post-incident reviews, audits and self-assessments. Results flow into clause 9 (performance evaluation) and clause 10 (improvement).

Maintenance

Plans go out of date fast. People leave, phone numbers change, systems are replaced and suppliers change. A common practice is a regular cycle, often annual or twice a year, of confirming and reissuing the plans, testing technical recovery and testing organizational procedures. Problems found in testing often send the programme back to the BIA. NIST describes the plan as "a living document."

Performance Evaluation and Improvement

Clause 9 requires the organization to decide what to monitor and measure, to run internal audits at planned intervals, and to hold management reviews in which top management looks at the system's performance and decides on changes. Clause 10 requires the organization to react to nonconformities, find their causes, take corrective action and continually improve the BCMS.

These clauses are what separate a management system from a set of plans. A plan can sit untouched for years. A management system has audits, reviews and corrective actions that force it to keep up with the organization.

Certification

How it works

Organizations can be certified to ISO 22301 by an independent certification body. ISO itself does not certify anyone. Certification bodies are in turn accredited by national accreditation bodies, which assess them against ISO/IEC 17021-1, the standard for bodies that audit and certify management systems. ISO/IEC TS 17021-6 sets out specific competence requirements for auditing and certifying business continuity management systems.

A typical certification cycle looks like this:

Accreditation is meant to make certificates trustworthy across borders. For many years the International Accreditation Forum (IAF) ran a multilateral arrangement under which accreditation bodies recognised each other's accredited certificates. According to the IAF's archived website, the IAF ceased operations on 1 January 2026 and was replaced by the Global Accreditation Cooperation Incorporated. The principle of mutual recognition between accreditation bodies continues under the new arrangement.

Benefits and limits of certification

Certification gives an outside check that the BCMS exists and works as the standard requires. It can help win contracts, especially with customers who need assurance about their suppliers. It can help with regulators and insurers, and the audit cycle keeps the programme alive. It does not guarantee that an organization will survive any particular disaster. It certifies a management system, not an outcome.

The ISO 22301 Family and Related Standards

ISO 22301 sits within a family of standards, most of them maintained by ISO/TC 292.

Relationship with ISO/IEC 27001

ISO/IEC 27001 is the information security management system standard. Its current edition was published in October 2022. It shares the Annex SL structure with ISO 22301, so the two can be run together as an integrated management system with one document control process, one internal audit programme and one management review. Information security and business continuity overlap heavily. A ransomware attack is both a security incident and a continuity incident. ISO/IEC 27001's Annex A includes controls on information security during disruption and on ICT readiness for business continuity. Many organizations certify to both.

Relationship with ISO 9001 and ISO 14001

ISO 9001 (quality) and ISO 14001 (environmental management) also use the common structure. Organizations already certified to them can add ISO 22301 more easily. ISO 9001 is by far the most widely certified management system standard. According to figures from the ISO Survey quoted on Wikipedia, there were about 1.14 million ISO 9001 certificates worldwide in 2014.

Other frameworks

NIST's seven steps compared with ISO 22301

NIST SP 800-34 sets out seven steps for information system contingency planning:

1. Develop the contingency planning policy statement.
2. Conduct the business impact analysis.
3. Identify preventive controls.
4. Create contingency strategies.
5. Develop an information system contingency plan.
6. Ensure plan testing, training and exercises.
7. Ensure plan maintenance.

Each step maps to parts of ISO 22301. Step 1 matches clause 5, steps 2 and 3 match clause 8.2, step 4 matches clause 8.3, step 5 matches clause 8.4, step 6 matches clauses 7.2 and 8.5, and step 7 matches clauses 8.6, 9 and 10. NIST's guide is narrower, focusing on information systems, and is not a certifiable standard. ISO 22301 covers the whole organization and can be certified.

Implementing ISO 22301: A Typical Path

Implementations differ, but many follow a pattern like this:

1. Secure sponsorship. Get a senior sponsor and agree why the organization is doing this: customer demand, regulation, past incidents or general resilience.
2. Define scope. Decide which products, services, sites and functions are in scope.
3. Establish governance. Write the policy, assign roles and set objectives.
4. Run the BIA. Interview process owners, map dependencies, and set MTPDs, RTOs and RPOs.
5. Assess risks. Identify threats to prioritised activities and decide on treatment.
6. Choose strategies. Select and fund solutions for people, premises, technology, information and suppliers.
7. Write plans. Build the response structure and the plans, keeping them short enough to use under pressure.
8. Train and raise awareness. Make sure people know the plans exist and what their role is.
9. Exercise. Start with tabletop exercises and build up to more realistic tests.
10. Audit and review. Run internal audits and management reviews, and fix what they find.
11. Seek certification if wanted.
12. Maintain and improve continually.

The ISO 22313 guidance standard explains how to meet each requirement and is a useful companion to the requirements text.

Limits and Criticisms

A management system, not a guarantee

ISO 22301 sets requirements for how continuity is managed. It does not set performance levels. It does not say what RTO a hospital or a bank must achieve. Those values come from the organization's own BIA and from regulators. Two certified organizations may have very different levels of real resilience.

Paperwork risk

Like any management system standard, ISO 22301 can be implemented in a box-ticking way that produces impressive documents and little real capability. The exercise and evaluation requirements are meant to counter this, but they depend on honest exercises that are allowed to fail.

Scope games

Because certification applies to a defined scope, an organization might certify a small, easy part of its operations and present the certificate as if it covered everything. Anyone relying on a certificate should read the scope.

Cost for small organizations

Building and certifying a BCMS takes time and money. The standard says its requirements apply to organizations of every type and size, and small organizations can implement it in a simpler way. Even so, the audit costs and the administrative effort weigh more heavily on a small business than on a large one.

Unknown unknowns

A BIA and risk assessment work from the threats people can imagine. Truly novel events can fall outside them. The value of the standard in such cases is less the specific plans than the general capability: a practised response team, clear authority, and tested ways of communicating and working elsewhere.

Common Misconceptions

"ISO 22301 is an IT standard." It covers the whole organization: people, premises, suppliers, communications and processes. IT disaster recovery is one part.

"Having a plan means we're compliant." The standard requires a management system with leadership, a BIA, risk assessment, strategies, plans, exercises, audits, management review and improvement. A plan alone is not enough.

"Certification means we can survive any disaster." Certification shows that the management system meets the standard's requirements within its scope. It does not guarantee outcomes.

"ISO certifies organizations." ISO writes the standard. Independent certification bodies, accredited by national accreditation bodies, carry out certification.

"The standard tells us what our RTOs should be." It requires the organization to determine them through its own BIA. The numbers are the organization's own.

"80 per cent of businesses without a plan fail within two years of a disaster." Figures like this circulate widely in business continuity marketing, and Wikipedia's article on business continuity planning repeats one such claim. The original evidence behind such statistics is often hard to trace, and they should not be relied on as precise facts. The case for continuity planning does not depend on them.

"BS 25999 is still the British standard." BS 25999 was withdrawn in 2012 and 2013 and replaced by ISO 22301 and ISO 22313.

Frequently Asked Questions

What is ISO 22301 in one sentence?

It is the international standard that sets requirements for a business continuity management system, a structured, auditable way for an organization to prepare for, respond to and recover from disruptions.

Which version is current?

The second edition, ISO 22301:2019, published on 31 October 2019, with a 2024 amendment adding climate change considerations.

Who can use it?

Any organization, of any type, size or sector. The requirements are generic. How they are applied depends on the organization's environment and complexity.

Is certification mandatory?

No. Organizations can use the standard as a framework without being certified. Certification is voluntary, although customers or regulators sometimes expect it.

What is the difference between ISO 22301 and ISO 22313?

ISO 22301 contains the requirements an auditor checks. ISO 22313 is guidance on how to meet them and is not used for certification.

What is a BIA?

A business impact analysis identifies an organization's activities, assesses how disruption would affect them over time, and sets recovery priorities and targets such as RTOs and RPOs.

What is the difference between RTO and RPO?

The RTO is how quickly something must be back. The RPO is how much recent data the organization can afford to lose, expressed as a point in time before the disruption.

How often should plans be exercised?

The standard requires exercises at planned intervals and after significant changes, without fixing a frequency. Many organizations exercise at least once a year, and NIST suggests yearly review and testing as an example for federal information systems.

Can it be combined with ISO/IEC 27001 or ISO 9001?

Yes. All three share the Annex SL harmonized structure, which makes integrated management systems practical.

How long does implementation take?

It depends on the scope and on what already exists. An organization with mature management systems and existing continuity plans will move faster than one starting from nothing. The standard does not set a timetable.

Summary

ISO 22301 is the international standard for business continuity management systems. It grew out of the British standards PAS 56 and BS 25999, was first published in May 2012 as the first ISO standard to fully adopt the common Annex SL structure, and was revised in October 2019 by ISO/TC 292. Its ten clauses follow the Plan–Do–Check–Act cycle. The distinctive work happens in clause 8: business impact analysis, risk assessment, strategies, plans, exercises and evaluation.

The standard's central idea is simple. Work out what matters most, how quickly it must return and how much data can be lost. Prepare the resources and plans to meet those targets. Practise them, and keep improving. Certification can show others that this is being done, but the real value lies in an organization that has thought through its weak points and rehearsed its response before the bad day comes.

Sources

• ISO 22301 (Wikipedia)
• Business continuity planning (Wikipedia)
• BS 25999 (Wikipedia)
• ISO/IEC 27001 (Wikipedia)
• ISO 9001 (Wikipedia)
• NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems
• NIST SP 800-34 Rev. 1 full text (PDF)
• Ready.gov, Business Continuity Planning
• IAF MLA (archived International Accreditation Forum site)