ISO 22301 Guide (2026): Business Continuity Management System Requirements

Who it applies to

Any organisation, of any size and type, that wants to build resilience can use ISO 22301 (ISO). The draft third edition describes its users as organisations that (ISO):

• implement, maintain and improve a BCMS
• seek to ensure conformity with their business continuity policy
• need to keep delivering products and services "at an acceptable predefined capacity during a disruption"

ISO 22301 is voluntary, but regulated sectors often use it as evidence of resilience. In financial services, for example, DORA requires management bodies to approve ICT business continuity and response and recovery plans (FMA). In Australia, APRA's CPS 230 covers business continuity (APRA).

Key requirements

ISO 22301 follows the harmonized management system structure, Clauses 4–10. The 2019 edition is organised as follows (NQA):

• 4 Context: organisation and context, interested parties, and BCMS scope, which must be documented and take location into account.
• 5 Leadership: commitment, business continuity policy, and roles.
• 6 Planning: risks and opportunities, BC objectives, and planning changes to the BCMS (6.3, expanded in 2019).
• 7 Support: resources, competence, awareness of roles before, during and after disruptions, communication, and documented information.
• 8 Operation: the core of business continuity.
• 8.1 Operational planning, including outsourced processes and the supply chain.
• 8.2 Business impact analysis (BIA) and risk assessment. These are systematic processes, reviewed at planned intervals. The BIA covers impact types and criteria and recovery time objectives, and it identifies prioritised activities.
• 8.3 Strategies and solutions. This includes resource requirements and putting solutions in place.
• 8.4 Plans and procedures. This covers response structure and teams (including alternates), a documented warning and communication procedure, and plans that are usable when needed.
• 8.5 Exercise programme.
• 8.6 Evaluation of BC documentation and capabilities, including those of partners and suppliers.
• 9 Performance evaluation: monitoring, internal audit programme, and management review. Review inputs include BIA and risk assessment results.
• 10 Improvement: nonconformity, corrective action, and continual improvement.

Climate action amendment (2024)

The ISO–IAF joint communiqué of 22 February 2024 added climate change considerations to management system standards, including ISO 22301 Amd 1:2024 (IAF; ISO). The overall intent of clauses 4.1 and 4.2 "remain unchanged." The change is treated as a clarification, so no full transition programme was required. Certified organisations should still determine whether climate change is relevant and, if so, consider it in their risk evaluation (IAF).

Supporting guidance

• ISO 22313:2020: guidance on using ISO 22301 (CHF 225, 55 pages). ISO marked it "to be revised" in April 2026 (ISO).
• ISO/TS 22317:2021: guidelines for a formal, documented BIA process. It does not prescribe a uniform method (ISO).

Certification process and timeline

1. Define the scope and gain top-management commitment.
2. Run the BIA and risk assessment. Then set strategies, solutions and plans (Clause 8) (NQA).
3. Exercise your plans and evaluate your capabilities.
4. Complete an internal audit and a management review (Clause 9).
5. Choose a certification body. Evaluate several bodies, check that they use the relevant CASCO standards, and check their accreditation. Global ACI has taken over the IAF and ILAC roles, and certificates can be checked in IAF CertSearch (ISO).

• BCMS auditor competence is set by ISO/IEC TS 17021-6:2014, which supplements ISO/IEC 17021 (ISO).

1. Hold the stage 1 and stage 2 audits. Annual surveillance audits follow, and recertification comes on the usual three-year cycle.

When the 2019 edition replaced 2012, IAF allowed a 3½-year transition. 2012 certificates ceased to be valid on 30 April 2023 (NQA). Expect a similar transition after the third edition is published (ISO).

Costs

ISO lists ISO 22301:2019 at CHF 155 (21 pages) (ISO). ISO 22313:2020 costs CHF 225 (ISO) and ISO/TS 22317:2021 costs CHF 196 (ISO). Each certification body sets its own audit fees.

Penalties

ISO 22301 has no legal penalties. A certificate can lapse if its conditions aren't kept. The regulatory risk comes from laws that require continuity capability, such as DORA's ICT continuity requirements (FMA).

Mapping to related frameworks

• ISO/IEC 27001: it shares the harmonized structure, and ISO lists it as a related standard (ISO). Its Annex A includes "ICT readiness for business continuity."
• ISO 31000: the risk management guidelines behind ISO 22301's risk work (ISO).
• DORA: ICT business continuity and response and recovery plans. The FMA notes that DORA doesn't refer to specific standards (FMA).
• APRA CPS 230: business continuity for APRA-regulated entities (APRA).
• SOC 2: availability criteria and continuity testing evidence can reuse your BCMS artefacts.

Readiness checklist

1. Document the BCMS scope, including locations, products and services (NQA).
2. Approve a business continuity policy and assign roles.
3. Complete a BIA covering impact types, criteria, prioritised activities and recovery time objectives (NQA).
4. Complete a risk assessment of disruption risks.
5. Choose strategies and solutions, and document the resources they need.
6. Write response plans with teams, alternates and a documented warning and communication procedure.
7. Run an exercise programme and record the lessons.
8. Evaluate suppliers' continuity capabilities (NQA).
9. Record whether climate change is relevant (IAF).
10. Hold an internal audit and a management review.

Common pitfalls

• A BIA that isn't reviewed at planned intervals or after significant change (NQA).
• Plans that aren't usable or available when and where they're needed.
• Exercises run one-off rather than as a programme (NQA).
• Ignoring supplier continuity.
• Leaving the climate change determination undocumented (IAF).
• Building to the 2019 text without tracking the third edition (ISO).

How AssureCore helps

• The Controls Register and Cross-framework Mapping reuse ISO 27001 and DORA work for ISO 22301.
• The Risk Register records disruption risks and how you treat them.
• Policy Management drafts business continuity policies with AI-assisted writing and gap analysis.
• Evidence Management stores BIA and exercise records and alerts you before they expire.
• Audit Reports (PDF/CSV) support internal audit and management review.

Frequently asked questions

Official references

• ISO – ISO 22301:2019
• ISO – ISO/CD 22301 (3rd edition)
• ISO/TC 292 – Will ISO 22301 be revised?
• ISO – ISO 22313:2020
• ISO – ISO/TS 22317:2021
• ISO – ISO/IEC TS 17021-6:2014
• ISO – Certification
• IAF – IAF-ISO Joint Communiqué on climate change (Feb 2024)
• NQA – ISO 22301:2019 transition guide
• Infosec Standards – three-year certification cycle
• FMA – DORA ICT risk management
• FMA – DORA resilience testing
• APRA – Cyber security

Related frameworks

• TISAX guide
• ISO 27001 guide
• NIST CSF guide
• DORA guide