ISO 22301: requirements, certification and delimitation
What is ISO 22301?
ISO 22301 is the international standard for business continuity management systems (BCMS). It defines the requirements with which an organisation builds the capability to maintain or quickly restore critical services during disruptions (such as cyber attacks, outages or natural events). ISO 22301 follows the uniform high-level structure of the ISO management system standards and the PDCA principle (plan, do, check, act). The standard can therefore be combined well with ISO/IEC 27001 for information security. As the only BCM standard, ISO 22301 can be certified by accredited bodies. A certificate is therefore recognised evidence towards customers, partners and supervisors.
What does ISO 22301 require?
The requirements are spread over clauses 4 to 10 of the standard:
| Area | Core requirement |
|---|---|
| Context and leadership (clauses 4 and 5) | Scope of the BCMS, commitment of top management, BCM policy and roles. |
| Planning (clause 6) | Objectives of the BCMS, dealing with risks and opportunities. |
| Support (clause 7) | Resources, competence, awareness, communication and documented information. |
| Operation (clause 8) | BIA and risk assessment, continuity strategy, continuity plans and an exercise and testing programme. |
| Evaluation and improvement (clauses 9 and 10) | Monitoring, internal audit, management review and continual improvement. |
Clause 8 is the operational part of the standard: strategy and continuity plans are derived from the business impact analysis and the risk assessment. These plans must demonstrably be exercised.
How does ISO 22301 certification work?
- Build the BCMS: establish and document the management system according to the requirements.
- Internal audit and management review: check effectiveness internally.
- Stage 1 audit: document review by the certification body.
- Stage 2 audit: on-site assessment of the implementation in practice.
- Certificate and surveillance: issue (usually valid for 3 years) with annual surveillance audits and recertification.
ISO 22301 and national guidance
Alongside the international standard there is national guidance, for example NIST SP 800-34 for IT contingency planning in the United States or the German BSI Standard 200-4. Such guidance is well suited to getting started because it leads step by step through the build-up. ISO 22301 provides the certifiable target. Many organisations build their BCM along national guidance and have it certified to ISO 22301 later. The frameworks do not contradict each other; they set different emphases.
ISO 22301 and exercises
In the audit it is checked whether the plans work. For that ISO 22301 requires an exercise and testing programme (clause 8.5). A tabletop exercise meets that with reasonable effort. It tests the continuity plans, reveals gaps and produces an auditable report that you can present to the certification auditor.
ISO 22301 and ISO 27001 together
Because ISO 22301 and ISO/IEC 27001 share the same high-level structure, they can be combined into an integrated management system: a common policy, roles, internal audit and management review. Anyone already operating an ISMS under ISO 27001 can reuse large parts of it (context, leadership, operation and improvement) for the BCMS. That reduces the effort. You then also plan information security and business continuity together, so that both interlock in a crisis. ISO 27001 protects the information, ISO 22301 keeps the processes running.
Frequently asked questions
What is ISO 22301?
ISO 22301 is the international standard for business continuity management systems (BCMS). It sets out the requirements for maintaining or quickly restoring critical services during disruptions. It is the only BCM standard that can be certified by accredited bodies.
How does ISO 22301 relate to national BCM guidance?
ISO 22301 is an internationally certifiable catalogue of requirements. National guidance such as NIST SP 800-34 in the United States or the German BSI Standard 200-4 provides detailed, step-by-step guides for building a BCM but does not come with its own certification. Many organisations build their BCM along such guidance and have it certified to ISO 22301 later.
Does ISO 22301 require exercises?
Yes. ISO 22301 requires an exercise and testing programme with which the effectiveness of the business continuity plans is evidenced regularly. Tabletop exercises are a recognised and efficient way to do that.
Note: This article is for general information and is not legal advice. The applicable laws and regulations, and the current state of national transposition, take precedence.