ISO 22301 — Business continuity management systems
What is ISO 22301?
ISO 22301 is the international standard for business continuity management systems. It requires the organisation to know which activities must not stop, how long they can be interrupted, and what happens while the disruption lasts.
It covers business impact analysis, risk assessment, recovery strategies, business continuity plans, a response structure and an exercise programme. It isn’t the same as a data backup — it also covers people, premises, equipment and suppliers. The standard is voluntary. A revision is under way; the 2019 edition remains current.
What the standard means by continuity
In practice, the standard requires:
- Business impact analysis — which activities are priorities and how long a disruption can be tolerated.
- Risk assessment — what could cause those activities to stop.
- Strategies and solutions that keep work going within the agreed time.
- Business continuity plans with named people, their authority and the sequence of actions.
- A response structure — who takes over decision-making when the normal flow stops.
- Warning and communication to employees, customers and the authorities.
- An exercise and testing programme. The standard doesn’t accept a plan that has never been tried out as evidence of capability.
- Internal audit and management review.
Who it is for
The standard can be applied by any organisation. It is asked for where a disruption affects others, not just you:
- banking, insurance and financial services;
- IT and telecommunications, data centres and managed service providers;
- healthcare and laboratories;
- manufacturing with contractual delivery deadlines and a supply chain;
- transport, logistics and utilities;
- suppliers to large customers that require the certificate as a condition of working together.
How the system is built
- Defining the scope — which parts of the organisation, locations and services are in the system.
- Business impact analysis for each activity, with recovery times and a minimum level of operation.
- Risk assessment for the resources those activities depend on — people, premises, equipment, information systems, suppliers.
- Choosing strategies — a backup site, remote working, an alternative supplier, stock, moving the work elsewhere.
- Writing the plans and appointing the response team.
- Setting up communication — who is notified, in what order, and through which channel when the usual one doesn’t work.
- Exercises and testing, then improving the plans based on the findings.
- Internal audit and management review, followed by the certification audit.
What you see when a disruption hits
You can’t see the difference while everything is fine. It shows in the first hour of a disruption — in whether people know what their job is, or wait for management to work something out.
- Everyone knows which activities come back first, because that was decided and agreed in advance.
- Someone can make decisions even when the usual manager isn’t available.
- Customers and employees get information from a single source rather than from rumour.
- Dependencies on suppliers are listed, so you know whom to call and whether there is an alternative.
- After the disruption there is a record showing what worked and what needs fixing.
- In tenders and due diligence, there is evidence of resilience.
Impact analysis and risk assessment — two different steps
These are easily merged into one document, and then both lose their point. The standard treats them as separate steps because they answer different questions.
Business impact analysis assumes the activity has already stopped and asks what happens next: how quickly the consequences grow, whom they affect, and when they become intolerable. The result is an order of priorities and the time within which each activity must be back.
Risk assessment asks what could cause that disruption and how likely it is — a breakdown, a fire, a power cut, a cyber attack, a key person leaving, a supplier failing. The result is measures that make a disruption less likely or less damaging.
The order matters: without the impact analysis you don’t know what you are protecting, so the measures are spread evenly instead of where a disruption would cost the most.
Recovery objectives — numbers the organisation sets itself
The standard requires recovery objectives for priority activities, but doesn’t prescribe their values. Three values are used:
- Recovery time objective (RTO) — how soon the activity must be running again.
- Recovery point objective (RPO) — the point to which data must be restored, i.e. how much recent work you can afford to lose; it determines how often backups are taken.
- Minimum business continuity objective (MBCO) — the minimum level of output that is acceptable during a disruption, because things rarely all come back at once.
The values come from the impact analysis and must be achievable with the resources the organisation has. A one-hour recovery time written into a plan, with no solution that makes it possible, is likely to be raised as a nonconformity at the audit.
Climate change in the organisation’s context
Since February 2024, ISO 22301 has had an amendment (ISO 22301:2019/Amd 1:2024), one of the climate amendments ISO made to its management system standards. It requires the organisation to determine whether climate change is a relevant issue, and adds a note that relevant interested parties can have requirements related to climate change.
This isn’t a separate system or new documentation. What is required is that the consideration takes place and can be seen — in the context analysis and in the management review. If you conclude that climate change isn’t relevant to your business continuity management system, that is an acceptable outcome too, provided it is clear the question was asked.
How long implementation takes
Implementing ISO 22301 usually takes 30 to 90 days. Exactly how long depends on the size of the organisation, the number of employees and how much of the above is already in place. The impact analysis needs time from process managers, so their availability sets the pace. We give an estimate for your case after a short conversation about the scope. On your side, for small and medium-sized organisations it takes 2 to 5 hours a week in total, spread across several people — more on this in our frequently asked questions.
What affects the price
Three things affect the cost of implementation:
- the size of the organisation;
- the number of employees;
- the standard being implemented — the amount of work differs from standard to standard.
We can only give an exact price after you get in touch and we have a short conversation about the scope. Without that, any figure would be guesswork, so we don’t give one here.
Frequently asked questions
We have backups and a standby server. Isn’t that business continuity?
It is one solution, and only for information systems. ISO 22301 also covers people, premises, equipment and suppliers — and who makes decisions and how you communicate while the disruption lasts. A backup without a plan for who restores it, and when, isn’t continuity.
How often do we have to run exercises?
The standard requires an exercise and testing programme, but doesn’t prescribe how often — the organisation decides based on the risk and the importance of the activities. Exercises must be planned and carried out, the results recorded, and the plans improved on that basis.
Is the whole company certified?
Not necessarily. The organisation defines the scope, and it is stated on the certificate. What matters is that the boundary is clear and that the scope doesn’t leave out an activity on which the activities inside it depend.
How does it relate to ISO 27001?
ISO 27001 requires continuity as far as information security is concerned. ISO 22301 covers the topic for the whole business and in much more detail. They can be implemented together without duplicating work, because they share the same structure.
Do we need a backup site?
No. The standard requires strategies and solutions that can meet the agreed recovery times — the organisation chooses which ones. A backup site is one; remote working, an alternative supplier, stock or moving the work elsewhere are others.
Will a plan that has never been tested pass the audit?
No. The standard requires an exercise and testing programme and records showing what was exercised, what the exercise showed and how the plan was improved as a result. A plan with no evidence that it has been tried out isn’t accepted as evidence of capability.
General questions — cost and duration, who issues the certificate and how long it is valid — are covered in our frequently asked questions.
Related standards
- ISO 27001 — information security; it also has requirements for information security during disruption and for ICT readiness.
- ISO/IEC 20000-1 — IT service management, where service continuity is one of the requirements.
- ISO 9001 — quality management systems, with a shared structure and documentation.
- Frequently asked questions about ISO standards — how certification works, how long a certificate is valid, what new editions mean.
- Overview of all standards — if you’re not sure what you need.
How STANDARDISO can help
We guide you through the whole process — from the business impact analysis and risk assessment, through choosing strategies and writing the plans, to exercises and the internal audit. The certificate is issued by an independent, accredited certification body.
We work from your real processes: the documentation describes what you actually do, rather than forcing your work into a template. We train your staff so they can keep using the system after the audit. Everyone on our team works in English, and we can prepare your documentation in English, Serbian or both.