Business continuity
ISO 22301:2019 — Business continuity management systems
The business continuity standard: prepare for crises, keep serving customers and recover quickly.
At a glance
- Type
- International standard, certifiable
- Publisher
- ISO
- Edition
- 2019 (+ Amendment 1:2024)
- Links
- NIS2 (Art. 21), DORA (Art. 11)
46 requirements tracked · 66 shared controls
What is ISO 22301?
ISO 22301 sets out the requirements of a business continuity management system (BCMS): the organisation identifies its priority activities, measures the impact of a disruption, selects continuity strategies, writes its plans and tests them regularly.
At its heart are the business impact analysis (BIA) and the assessment of disruption risks, followed by plans and an exercise programme. Built on the same structure as ISO 27001 and ISO 9001, it also answers the continuity and crisis management requirements of NIS2 and DORA.
Key requirements
- 1
Business impact analysis (BIA)
Identify priority activities, maximum tolerable disruption times and the resources required.
- 2
Disruption risk assessment
Assess the scenarios threatening these activities: IT outage, cyberattack, disaster, supplier failure…
- 3
Continuity strategies and solutions
Choose the appropriate fallback solutions and the resources to plan for.
- 4
Plans and procedures
Response structure, warning and communication, continuity and recovery plans.
- 5
Exercise programme
Test the plans, learn lessons and update the arrangements.
Summary written by OK-GRC. The texts of ISO standards are protected by copyright and are not reproduced.
How OK-GRC helps
- ISO 22301 requirements linked to 66 common controls, including 18 continuity controls
- Business continuity plan and IT disaster recovery plan templates
- Disruption risks in the shared register, with treatment plans and tasks
- Tracking of exercises and lessons learned, turned into actions
- A continuity score that also rises with your NIS2 and DORA controls
Related frameworks
With ISO 27001 controls in place, your ISO 22301 starting score is about 61 to 71%.
The controls you put in place for ISO 22301 also count for:
Frequently asked questions about ISO 22301
What is the difference between a BCP and a DRP?
A business continuity plan (BCP) organises the continuation of priority activities during a crisis; a disaster recovery plan (DRP), often IT-focused, organises restarting systems after a disaster. ISO 22301 covers both in one management system.
Do plans have to be tested every year?
The standard requires a regular, proportionate exercise programme. An annual tabletop exercise plus technical restore tests is a common minimum; DORA sets its own testing requirements for the financial sector.
Informational content up to date as of October 2026; it does not constitute legal advice. Always check the official texts in force.
Ready to simplify your compliance?
Create your workspace in minutes. The assistant suggests the frameworks and priorities that fit your company.
14-day trial with every Pro feature · Nothing charged before the trial ends · No commitment