In brief
ISO 22301 sets the requirements for a business continuity management system. Its core is the business impact analysis (BIA), from which strategies, plans and exercises follow. We implement it stand-alone or as an extension of an ISO/IEC 27001 system and the NIS2 requirements – with one internal audit and one management review.
Who is ISO 22301 for?
- entities under NIS2, which must have business continuity, disaster recovery and crisis management measures (Article 21(2)(c));
- organisations certified to ISO/IEC 27001 that want to support controls A.5.29 and A.5.30 with a complete system;
- service providers whose customers require demonstrable availability;
- manufacturing companies where a system outage means production and delivery stoppages.
What does a business continuity management system include?
- business impact analysis (BIA) with RTO, RPO and MTPD;
- risk assessment for business disruptions;
- business continuity strategies and solutions;
- business continuity and recovery plans;
- crisis communication;
- exercises and testing;
- internal audit and management review.
What do RTO, RPO and MTPD mean?
| Term | Meaning |
|---|---|
| MTPD | maximum tolerable period of disruption – the time after which the impact of not resuming an activity would become unacceptable |
| RTO | recovery time objective – the time within which an activity or resource must be resumed after a disruption; shorter than the MTPD |
| RPO | recovery point objective – the point to which data must be restored, i.e. the maximum acceptable data loss |
The values must be justified in the BIA and verified through exercises – unjustified RTO and RPO values are a common audit and supervision finding.
How does ISO 22301 implementation work?
We use the same five-phase framework as for ISO/IEC 27001; each phase ends with handed-over deliverables.
Current state analysis
Context, system scope, existing plans and dependencies.
Deliverable: gap analysis report with an action plan.
BIA and risk assessment
Critical activities, resources and suppliers, RTO, RPO and MTPD, risks of disruption.
Deliverable: business impact analysis and risk register.
Strategies
Choice of solutions for people, premises, information systems, data and suppliers.
Deliverable: business continuity strategies approved by management.
Plans
Business continuity and recovery plans, crisis team and crisis communication.
Deliverable: documented plans and procedures.
Exercises and certification readiness
Exercise programme, an exercise, internal audit, management review and support during the certification audit.
Deliverable: exercise report, internal audit report and management review minutes.
How does ISO 22301 relate to NIS2, ISO 27001 and ISO 9001?
- NIS2: business continuity and crisis management are part of the risk management measures. More on NIS2
- ISO/IEC 27001: controls A.5.29 (information security during disruption) and A.5.30 (ICT readiness for business continuity). More on ISO 27001
- ISO 9001: the same structure of requirements allows one integrated management system. More on ISO 9001
Current edition: ISO 22301:2019 with Amendment 1:2024 (climate change).
Frequently asked questions about ISO 22301
Is ISO 22301 mandatory under NIS2?
No. NIS2 (Article 21(2)(c)) requires business continuity measures, such as backup management, disaster recovery and crisis management. ISO 22301 is a systematic framework for meeting and demonstrating this; a certificate is not required.
What is the difference between a business continuity plan and an IT recovery plan?
A business continuity plan defines how the organisation continues its critical activities during a disruption – people, premises, suppliers and communication. The IT recovery plan is its technical part: how to restore systems and data within the required time.
Can ISO 22301 be implemented together with ISO 27001?
Yes. The two standards share the same structure of requirements, so we build one set of documentation, one internal audit and one management review; the certification body can carry out a combined audit.
How often do exercises have to be carried out?
The standard requires exercising and testing at planned intervals and when significant changes occur. You set the frequency in the exercise programme according to the criticality of activities; the results are used to improve the plans.
Which edition of the standard applies?
ISO 22301:2019 with Amendment 1:2024, which adds the consideration of climate change when understanding the organisation and its context.
Sources
- ISO 22301:2019 – Security and resilience – Business continuity management systems – Requirements (ISO)
- ISO/IEC 27001:2022 – Information security management systems – Requirements (ISO)
- Directive (EU) 2022/2555 (NIS2), Article 21 – EUR-Lex
Last updated: · Prepared by the Regulus Ai team
Would you like to assess which activities are critical for you?
Book an initial consultation