ISO 22301 — Business Continuity Management Systems (BCMS)
- ClassificationCategoryBusiness ContinuityDomainOperational ResilienceFramework FamilyISO Management Systems
- Regulatory ContextTypeStandardLegal InstrumentStandardSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionGlobalRegion DetailInternationalPublisherInternational Organization for Standardization (ISO)
- VersioningVersionISO 22301:2019 (second edition, with Amendment 1:2024)Effective DateOctober 2019 (second edition published; ISO sets no separate effective date)Issue DateOctober 30, 2019 (date listed by the Swedish Institute for Standards); Amendment 1 approved February 23, 2024
- AdoptionAdoption ModelCertificationImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: No
ISO 22301:2019 is copyrighted by the International Organization for Standardization and sold through ISO and its national member bodies. License not included with platform.
Framework text is licensed by its publisher and is included only where stated above.
- ISO 22301:2019 specifies requirements for a business continuity management system that protects against, prepares for, responds to, and recovers from disruptions.
- ISO/TC 292 published the second edition in October 2019, replacing ISO 22301:2012; Amendment 1:2024 applies.
- The requirements are generic and apply to any organization regardless of type, size, and nature.
- The discipline-specific requirements sit almost entirely in Clause 8: business impact analysis, risk assessment, strategies, plans, and exercises.
- Conformity can be shown by self-declaration, confirmation from interested parties, or certification of the BCMS.
Overview
ISO 22301:2019, Security and resilience - Business continuity management systems - Requirements, is the international standard for implementing, maintaining and improving a business continuity management system (BCMS) that protects against, prepares for, responds to and recovers from disruptions. ISO/TC 292 published the second edition in October 2019, replacing ISO 22301:2012. Amendment 1:2024 (climate action changes) applies to it.
The requirements are generic and apply to any organization, regardless of type, size and nature (clause 1). An organization can demonstrate conformity by self-declaration, by confirmation from parties with an interest in it such as customers, by external confirmation of its self-declaration, or by certification of its BCMS (introduction, 0.5). The standard follows ISO's high level structure, with the discipline-specific continuity requirements almost entirely in Clause 8.
Organizations implement it by determining context and scope (clause 4), securing leadership and a business continuity policy (5), planning objectives (6) and support (7), running the business impact analysis, risk assessment, strategies, plans and exercises in Clause 8, evaluating performance (9) and improving (10).
Why does it matter?
ISO 22301:2019 turns business continuity into a managed system. It requires the organization to analyze the impact of disruptions over time, choose and resource continuity strategies, document response plans and test them, so that it can continue to operate during disruptions (introduction, 0.2).
Key benefits include:
- Impact analysis over time
The business impact analysis is the process of analyzing the impact of a disruption on the organization over time. Its outcome is a statement and justification of business continuity requirements (clauses 3.5 and 8.2.2).
- Plans that guide response and recovery
A business continuity plan is documented information that guides the organization to respond to a disruption and to resume, recover and restore delivery of products and services (clauses 3.4 and 8.4.4).
- Exercises and evaluation
Clause 8.5 sets an exercise program, and 8.6 evaluates business continuity documentation and capabilities.
- Legal and regulatory requirements
Clause 4.2.2 addresses legal and regulatory requirements as part of understanding interested parties.
- One structure across management systems
The standard shares ISO's high level structure and core text with other management system standards, such as ISO 9001, ISO 14001, ISO/IEC 20000-1, ISO/IEC 27001 and ISO 28000 (0.3 and 0.5).
How does it work?
Clause 4 covers the organization and its context (4.1), interested parties and legal and regulatory requirements (4.2), the scope of the BCMS (4.3) and the BCMS (4.4). Clause 5 covers leadership and commitment (5.1), the business continuity policy (5.2) and roles, responsibilities and authorities (5.3). Clause 6 covers risks and opportunities (6.1), business continuity objectives (6.2) and planning changes (6.3). Clause 7 covers resources, competence, awareness, communication and documented information.
Clause 8 holds the operational requirements: operational planning and control (8.1); business impact analysis and risk assessment (8.2); strategies and solutions, from identification and selection to resource requirements and implementation (8.3); plans and procedures, including response structure, warning and communication, business continuity plans and recovery (8.4); an exercise program (8.5); and evaluation of documentation and capabilities (8.6).
Clause 9 covers monitoring, measurement, analysis and evaluation (9.1), internal audit (9.2) and management review (9.3). Clause 10 covers nonconformity and corrective action (10.1) and continual improvement (10.2). The BCMS applies the Plan-Do-Check-Act cycle (0.3).
Key Elements
- Context, interested parties and scope (clause 4)
Understanding the organization, its interested parties and their legal and regulatory requirements, and setting the scope of the BCMS.
- Leadership and policy (clause 5)
Top management commitment, a business continuity policy, and assigned roles, responsibilities and authorities.
- Objectives and planning (clause 6)
Actions on risks and opportunities, business continuity objectives and planned changes to the BCMS.
- Business impact analysis and risk assessment (8.2)
Analysis of the impact of a disruption over time and assessment of disruption risks, as the basis for continuity requirements.
- Strategies and solutions (8.3)
Identification and selection of strategies and solutions, their resource requirements and their implementation.
- Plans, response and recovery (8.4)
Response structure, warning and communication, business continuity plans and recovery.
- Exercises and evaluation (8.5 and 8.6)
An exercise program and evaluation of business continuity documentation and capabilities.
What does it cover?
ISO 22301:2019 specifies requirements to implement, maintain and improve a management system to protect against, reduce the likelihood of, prepare for, respond to and recover from disruptions. The requirements are generic and apply to all organizations or parts of them, regardless of type, size and nature. It applies to organizations that implement a BCMS, seek conformity with a stated business continuity policy, need to continue delivering products and services at an acceptable predefined capacity during a disruption, or seek to enhance resilience through the BCMS. The extent of application depends on the operating environment and complexity (clause 1).
What are its objectives?
A BCMS under ISO 22301:2019 is designed to help an organization (introduction):
Continue to deliver products and services within acceptable time frames at predefined capacity during a disruption (clause 3.3).
Support strategic objectives, protect reputation and credibility, and contribute to organizational resilience (0.2).
Reduce legal and financial exposure and the direct and indirect costs of disruptions (0.2).
Protect life, property and the environment, and consider the expectations of interested parties (0.2).
Framework in Context
ISO 22301:2019 is a requirements standard that can be assessed. ISO 22313:2020 gives guidance on its use, and ISO/TS 22331:2018 and ISO/TS 22318:2021 give guidelines on business continuity strategy and supply chain continuity. The 2019 edition added no new requirements: it applied ISO's management system requirements, restructured Clause 8 and modified terms (foreword). Amendment 1:2024, Climate action changes, was approved on February 23, 2024, and the 2019 edition with that amendment is the current text.
Common Framework Mappings
Organizations map ISO 22301 to complementary resilience, continuity, and security standards to integrate incident response, risk management, operational resilience, and information security controls across enterprise programs.
Mapped frameworks include:
BCI Good Practice Guidelines
Digital Operational Resilience Act (DORA)
ISO 22313
ISO 22317
ISO/IEC 27001
ISO/IEC 27003
NFPA 1600
How SmartSuite Supports ISO 22301:2019
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Operational Resilience & Business Continuity to link critical services, impact analysis results, continuity plans and recovery, and Enterprise Risk Management and Internal Audit Management to hold disruption risks, audits and management review actions, with owners and status.
Context, Scope and Policy
Record interested parties, legal and regulatory requirements, the BCMS scope and the business continuity policy (clauses 4.2, 4.3 and 5.2).
Business Impact Analysis
Link activities, products and services to impact over time and the resulting continuity requirements (clause 8.2.2).
Disruption Risk Assessment
Maintain disruption risks with owners, ratings and treatments (clause 8.2.3).
Strategies and Plans
Hold selected strategies, resource requirements, response structure and business continuity plans for each service (clauses 8.3 and 8.4).
Exercise Program
Schedule exercises, record outcomes and track actions from evaluations (clauses 8.5 and 8.6).
Audit, Review and Improvement
Track internal audits, management review actions, nonconformities and corrective actions to closure (clauses 9.2, 9.3 and 10.1).
Frequently Asked Questions For ISO 22301 (Business Continuity Management System)
It requires a management system to implement, maintain and improve business continuity: context and scope (clause 4), leadership and policy (5), planning (6), support (7), operation including the business impact analysis, strategies, plans and exercises (8), performance evaluation (9) and improvement (10). The requirements are generic and apply to organizations of any type, size and nature (clause 1).
The standard does not require certification. Introduction clause 0.5 lists four ways to demonstrate conformity: self-declaration, confirmation by interested parties such as customers, external confirmation of a self-declaration, and certification or registration of the BCMS by an external organization.
It is the process of analyzing the impact of a disruption on the organization over time (clause 3.5). Its outcome is a statement and justification of business continuity requirements, and the requirements for performing it are in clause 8.2.2, followed by risk assessment in 8.2.3.
The second edition cancels and replaces ISO 22301:2012. ISO's management system requirements were applied, requirements were clarified with no new requirements added, discipline-specific requirements moved almost entirely into Clause 8, and some terms were modified. Amendment 1:2024, Climate action changes, was approved on February 23, 2024.
ISO 22313:2020 is the guidance document on using ISO 22301. ISO 22301 and ISO/IEC 27001 follow the same management system structure, which is intended to support consistent and integrated implementation across related management systems (0.3). ISO 22301 itself covers business continuity, not information security.
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.