QUICK ANSWER

ISO 22301:2019 is an international standard specifying requirements for a Business Continuity Management System (BCMS). It helps organizations prepare for disruptive incidents, maintain critical products and services at an acceptable predefined capacity during disruption, recover operations, and continually improve organizational resilience.

The standard can be applied to organizations of different sizes and sectors, including IT companies, data centres, financial organizations, manufacturers, healthcare organizations, government departments, service providers and small or medium-sized businesses.

For IT departments and IT service providers, ISO 22301 is particularly relevant to areas such as:

• IT disaster recovery
• Server and network outages
• Cybersecurity incidents
• Cloud or data-centre failures
• Internet and telecommunications outages
• Power failures
• Backup and restoration
• Critical application availability
• Remote-working continuity
• Supplier and third-party failures
• Natural disasters and severe weather
• Workforce or facility unavailability

Important current information: ISO 22301:2019 has Amendment 1:2024 — Climate action changes, published in February 2024. Organizations applying the standard should therefore consider the amendment as part of their current BCMS context.

COMPLETE ARTICLE

What Is ISO 22301:2019?

ISO 22301:2019 is formally titled:

Security and resilience — Business continuity management systems — Requirements

It is the second edition of ISO 22301 and was published in October 2019.

The standard specifies requirements for implementing, maintaining and continually improving a Business Continuity Management System (BCMS).

A BCMS provides a structured management framework that helps an organization understand potential disruptions, determine their business impact, establish continuity priorities, prepare appropriate responses and recover critical activities when disruption occurs.

According to ISO, the framework is intended to help organizations protect against disruption, reduce the likelihood of disruptive incidents where possible, prepare for them, respond effectively and recover when disruptions occur.

Is ISO 22301 an IT Service Management Standard?

No.

This distinction is important.

Standard	Primary Purpose
ISO 22301:2019	Business Continuity Management System (BCMS)
ISO/IEC 20000-1:2018	IT Service Management System (ITSMS)
ISO/IEC 27001	Information Security Management System (ISMS)
ISO 9001	Quality Management System (QMS)

ISO 22301 is nevertheless extremely important for IT departments because modern businesses depend heavily on technology.

For example, an organization's business continuity plan may depend on:

• Microsoft 365 or Google Workspace
• ERP/accounting applications
• CRM systems
• physical or virtual servers
• cloud infrastructure
• Active Directory
• databases
• internet connectivity
• VPN services
• backup infrastructure
• network switches and firewalls
• business applications
• remote-access systems

A failure in any critical IT component can become a business continuity incident.

Therefore, IT disaster recovery normally forms an important component of a wider business continuity strategy.

Business Continuity vs Disaster Recovery

These terms are frequently confused.

Business Continuity

Business continuity addresses the broader question:

How will the organization continue delivering its critical products and services when a serious disruption occurs?

It can therefore include:

• employees
• buildings
• IT systems
• communications
• suppliers
• logistics
• financial resources
• alternate workplaces
• management responsibilities
• customer communication
• regulatory obligations

Disaster Recovery

Disaster recovery generally concentrates more specifically on restoring IT infrastructure, systems, applications and data after disruption.

Examples include:

• restoring servers from backup
• failing over to a secondary data centre
• restoring databases
• activating backup internet connectivity
• rebuilding virtual machines
• switching to disaster-recovery cloud infrastructure

Therefore:

Disaster Recovery is usually part of Business Continuity, but Business Continuity is broader than Disaster Recovery.

Why Is ISO 22301 Important?

Organizations increasingly depend on interconnected technology, suppliers, communications systems, cloud services and digital information.

Even a relatively short disruption can affect:

• revenue
• customer service
• production
• employee productivity
• regulatory compliance
• contractual commitments
• reputation
• data availability
• supply chains

ISO 22301 helps organizations move away from informal emergency planning toward a structured management system.

The objective is not to guarantee that disruption will never occur.

Instead, organizations establish processes and capabilities so that they are better prepared to continue prioritized activities and recover effectively.

ISO identifies benefits including increased organizational resilience, improved risk-management processes and systematic responses to crises.

What Types of Disruption Should an Organization Consider?

The relevant scenarios depend on the organization's operations and risk environment.

Typical scenarios can include:

IT Infrastructure Failure

Examples:

• physical server failure
• storage failure
• virtualization platform failure
• database corruption
• network outage
• firewall failure

Cybersecurity Incident

Examples:

• ransomware
• malware
• compromised administrator accounts
• denial-of-service attacks
• unauthorized access
• destructive cyberattack

Power Failure

An extended power outage can affect:

• servers
• networking equipment
• manufacturing systems
• office operations
• communications infrastructure

UPS systems and generators may provide temporary protection, but continuity planning must consider how long operations can realistically continue.

Internet or Telecom Failure

Businesses increasingly depend on internet connectivity for:

• cloud applications
• email
• VoIP
• remote access
• banking
• payment systems
• customer portals

Organizations may therefore require secondary internet links or alternative communication arrangements.

Cloud Service Failure

A cloud provider or SaaS outage can make business-critical applications temporarily unavailable.

Organizations should understand their dependencies and appropriate contingency arrangements.

Natural Disaster

Examples include:

• flood
• earthquake
• cyclone
• severe storm
• wildfire
• extreme heat

Building or Office Unavailability

A building may become inaccessible because of:

• fire
• flooding
• structural damage
• security incidents
• utility failures

Continuity arrangements may include alternate locations or remote working.

Supplier Failure

Critical suppliers may fail to provide required products or services.

Organizations should therefore understand important third-party dependencies.

Workforce Unavailability

Events affecting significant numbers of employees can disrupt operations even when technology remains operational.

Main Requirements of ISO 22301:2019

ISO management system standards use a structured framework.

The major requirement clauses of ISO 22301 include:

Clause 4 — Context of the Organization

The organization needs to understand its operating environment and factors that can affect its BCMS.

This includes understanding:

• internal issues
• external issues
• interested parties
• relevant requirements
• BCMS scope

The organization determines what parts of its operations are covered by the BCMS.

Clause 5 — Leadership

Effective business continuity requires management involvement.

Leadership responsibilities include establishing:

• business continuity policy
• responsibilities and authorities
• organizational commitment
• appropriate resources
• integration with business processes

Business continuity should not exist solely as an IT department document.

Senior management involvement is essential because disruptions can affect the entire organization.

Clause 6 — Planning

Organizations need to address risks and opportunities affecting the BCMS and establish business continuity objectives.

Objectives should be relevant, measurable where practicable, monitored and updated when necessary.

Planning also needs to consider changes to the BCMS.

Clause 7 — Support

A BCMS requires adequate support and resources.

This includes:

• resources
• competence
• awareness
• communication
• documented information

Employees with business continuity responsibilities should understand their roles before an incident occurs.

Clause 8 — Operation

Clause 8 contains many of the operational elements most directly associated with business continuity.

These include:

• operational planning and control
• business impact analysis
• risk assessment
• business continuity strategies and solutions
• business continuity plans and procedures
• exercise programmes
• evaluation of business continuity documentation and capabilities

Business Impact Analysis (BIA)

A Business Impact Analysis is one of the most important elements of a BCMS.

A BIA helps determine:

• which activities are critical
• what happens if those activities stop
• how quickly they need to resume
• what resources they depend on
• what level of disruption is acceptable

For example:

Business Activity	Dependency	Impact of Failure	Recovery Priority
Customer billing	ERP/accounting system	High	Critical
Email	Cloud email service	Medium/High	High
Online sales	Website/database	Very High	Critical
Payroll	Payroll software	High	High
Internal archive	File server	Medium	Medium

The exact priorities must be established through the organization's own BIA rather than copied from a generic template.

Recovery Time Objective (RTO)

Recovery Time Objective (RTO) describes the target time within which an activity, system or resource should be recovered following disruption, based on the organization's continuity requirements.

Example:

A company determines that its ERP application must be restored within:

RTO = 4 hours

If the system fails at 10:00 AM, the recovery arrangements should be designed to support restoration within the defined target.

Recovery Point Objective (RPO)

Recovery Point Objective (RPO) relates to the point to which data needs to be recovered after disruption.

For example:

RPO = 1 hour

This means the recovery design should support limiting data loss to approximately one hour of data, subject to the system and recovery scenario.

RPO strongly influences backup frequency and replication architecture.

RTO vs RPO

Term	Main Question
RTO	How quickly must the service/activity be restored?
RPO	How much recent data loss can be tolerated?

Example:

RTO: 4 hours

RPO: 30 minutes

The organization therefore designs its recovery solution to restore the relevant service within four hours while targeting no more than approximately 30 minutes of lost data.

Maximum Tolerable Period of Disruption

Organizations also need to understand how long disruption can continue before its effects become unacceptable.

This is important because recovery priorities cannot be established merely by guessing which applications appear important.

A formal BIA should connect business impact with recovery requirements.

Business Continuity Strategies and Solutions

Once requirements are identified, appropriate continuity solutions can be selected.

Examples include:

IT Solutions

• redundant servers
• high-availability clusters
• virtualization
• cloud disaster recovery
• geographically separate backups
• secondary data centres
• immutable or protected backups
• redundant network links
• secondary firewalls
• spare hardware
• alternative DNS arrangements

Workforce Solutions

• remote working
• cross-training
• alternate personnel
• emergency communication systems

Facility Solutions

• alternate offices
• work-from-home arrangements
• secondary operational sites

Supplier Solutions

• alternate suppliers
• emergency procurement arrangements
• geographically diversified providers

The appropriate solution depends on business impact, risk, recovery requirements, cost and organizational needs.

Business Continuity Plans

A Business Continuity Plan (BCP) should provide practical instructions that can be used during disruption.

A useful plan can include:

Activation Criteria

Define when the plan should be activated.

Roles and Responsibilities

Identify people responsible for:

• incident coordination
• IT recovery
• employee communication
• customer communication
• supplier coordination
• management decisions

Emergency Contacts

Maintain current contact details for critical personnel and providers.

Communication Procedures

Determine how communication will occur if normal systems are unavailable.

Recovery Procedures

Document how critical services and operations will be restored or continued.

Escalation Procedures

Define when incidents need to be escalated to senior management or specialist teams.

Example IT Business Continuity Scenario

Consider a company with approximately 50 employees using:

• Active Directory
• Windows file server
• accounting software
• Microsoft 365
• cloud backup
• internet-based applications

The primary server suddenly becomes unavailable.

A continuity response might look like this:

Step 1: Incident detected.

Step 2: IT team confirms the nature and likely duration of the failure.

Step 3: Incident coordinator evaluates whether continuity procedures need activation.

Step 4: Critical users are informed.

Step 5: Temporary working arrangements are activated where required.

Step 6: Server recovery or failover begins.

Step 7: Data is restored from the appropriate backup if required.

Step 8: Applications and services are validated.

Step 9: Users are gradually returned to normal operation.

Step 10: The incident and recovery are reviewed.

Step 11: Lessons learned are incorporated into the BCMS.

This is substantially more effective than deciding what to do only after the server has failed.

Backups Are Not the Same as Business Continuity

One common mistake is assuming:

"We have backups, therefore we have business continuity."

Backups are extremely important, but they solve only part of the problem.

Suppose an organization has a perfect backup but:

• replacement hardware requires five days
• nobody knows the administrator credentials
• internet connectivity is unavailable
• backup restoration has never been tested
• application installation media is unavailable
• application licenses cannot be reactivated
• no employee communication procedure exists

The backup alone cannot maintain business continuity.

A complete continuity strategy considers the entire recovery process.

Backup Testing Is Essential

A backup should not automatically be considered recoverable merely because the backup software reports:

Backup Successful

Organizations should periodically verify restoration procedures.

Testing can include:

• file restoration
• database restoration
• virtual machine recovery
• bare-metal recovery
• cloud recovery
• application validation
• recovery timing

Recovery testing helps determine whether actual recovery capability supports the required RTO and RPO.

Caution: Disaster-recovery tests should be carefully planned. Never perform destructive recovery testing against a production system without appropriate safeguards, authorization and verified rollback arrangements.

Exercising and Testing the Business Continuity Plan

A business continuity plan that has never been exercised may contain serious weaknesses.

Organizations can use different types of exercises.

Tabletop Exercise

Participants discuss how they would respond to a simulated incident.

Example:

The company's main data centre is unavailable for 24 hours. What happens next?

Technical Recovery Test

IT personnel actually restore selected systems or backups in a controlled environment.

Communication Exercise

The organization tests:

• contact lists
• emergency communication
• escalation procedures

Simulation Exercise

A realistic disruption scenario is simulated without deliberately affecting production operations.

Exercises should produce findings that can be reviewed and used for improvement.

Clause 9 — Performance Evaluation

Organizations need to evaluate whether the BCMS is working effectively.

This includes activities such as:

• monitoring
• measurement
• analysis
• evaluation
• internal audit
• management review

Management reviews the BCMS to determine whether it remains suitable, adequate and effective.

Clause 10 — Improvement

Business continuity management is not a one-time project.

Organizations need processes for addressing:

• nonconformities
• corrective actions
• continual improvement

Lessons can come from:

• actual incidents
• exercises
• internal audits
• management reviews
• technology changes
• organizational changes
• supplier changes
• new threats

Plan-Do-Check-Act and Business Continuity

Management systems are commonly understood through the Plan-Do-Check-Act (PDCA) improvement approach.

PLAN

Understand requirements, risks, impacts and continuity objectives.

DO

Implement continuity strategies, procedures, resources and plans.

CHECK

Exercise, monitor, audit and evaluate the BCMS.

ACT

Correct weaknesses and continually improve the system.

This helps transform business continuity from a static document into an ongoing management process.

ISO 22301:2019 Amendment 1:2024 — Climate Action Changes

An important update for organizations implementing ISO 22301 is:

ISO 22301:2019/Amd 1:2024

The amendment was published in February 2024 and applies to ISO 22301:2019.

Its purpose is to incorporate climate-change considerations into the management-system context requirements.

Organizations implementing or maintaining ISO 22301 should therefore evaluate whether climate change is a relevant issue within their organizational context and recognize that relevant interested parties may have climate-related requirements.

For business continuity, potential climate-related considerations can include:

• extreme heat
• flooding
• storms
• water shortages
• power-grid instability
• supply-chain disruption
• transportation disruption
• facility accessibility
• data-centre cooling requirements

The relevance and appropriate response will differ considerably between organizations.

ISO 22301 and IT Disaster Recovery

IT departments frequently play a major role in BCMS implementation because many critical activities depend on technology.

An IT continuity assessment should consider:

Servers

• redundancy
• hardware availability
• virtualization
• replication
• recovery procedures

Storage

• RAID
• snapshots
• backup
• replication
• off-site copies

Network

• secondary internet provider
• redundant switches
• spare network equipment
• firewall redundancy

Cloud

• provider availability
• backup strategy
• account recovery
• administrator access
• data export capabilities

Cybersecurity

• ransomware response
• privileged-account recovery
• offline/immutable backups
• incident-response procedures

Power

• UPS capacity
• generator availability
• shutdown procedures

ISO 22301 and ISO/IEC 27001

ISO 22301 and ISO/IEC 27001 complement each other but have different primary objectives.

ISO 22301	ISO/IEC 27001
Business continuity	Information security
Organizational resilience	Information-security risk management
Continuity during disruption	Confidentiality, integrity and availability
Business impact and continuity requirements	Information-security risks and controls
Continuity strategies and plans	Information-security management system

Organizations operating both systems can coordinate overlapping areas such as:

• risk management
• incident response
• backup
• resilience
• disaster recovery
• supplier management
• documented information
• audits
• management review

ISO 22301 and ISO/IEC 20000-1

For an IT service provider, these standards can also complement each other.

ISO/IEC 20000-1 focuses on establishing and managing an IT Service Management System.

ISO 22301 focuses on ensuring the organization can prepare for, respond to and recover from significant disruptions.

An IT service provider may therefore use both approaches:

ISO/IEC 20000-1 → Manage IT services effectively

ISO 22301 → Maintain organizational resilience and continuity during disruption

Who Should Consider ISO 22301?

ISO 22301 can be useful for organizations including:

• IT service providers
• managed service providers
• cloud service providers
• data centres
• banks
• insurance companies
• healthcare organizations
• hospitals
• manufacturers
• logistics companies
• telecom providers
• government organizations
• educational institutions
• e-commerce businesses
• financial organizations
• professional service firms

The requirements are intended to be generic and applicable to organizations of different types and sizes; implementation should reflect the organization's operating environment and complexity.

Can a Small Business Implement ISO 22301?

Yes.

A small organization does not necessarily require the same continuity architecture as a multinational enterprise.

For example, a small company might identify:

Critical systems

• accounting software
• customer database
• email
• internet
• file server

It could then establish appropriate arrangements such as:

• verified cloud/off-site backup
• secondary internet connection
• spare laptop
• documented administrator credentials stored securely
• remote-working procedures
• supplier contact lists
• recovery documentation
• periodic restore tests

The BCMS should be proportionate to the organization's size, complexity, risks and continuity requirements.

Typical ISO 22301 Implementation Process

A practical implementation project may follow these stages:

1. Obtain management commitment.
2. Understand organizational context.
3. Define BCMS scope.
4. Identify interested parties and applicable requirements.
5. Establish business continuity policy.
6. Assign roles and responsibilities.
7. Conduct Business Impact Analysis.
8. Conduct risk assessment.
9. Define continuity requirements.
10. Select continuity strategies and solutions.
11. Develop response structures and continuity procedures.
12. Establish communication procedures.
13. Train relevant employees.
14. Conduct exercises and recovery tests.
15. Monitor performance.
16. Perform internal audit.
17. Conduct management review.
18. Correct identified nonconformities.
19. Continually improve the BCMS.
20. If certification is desired, arrange an audit with an appropriate accredited certification body.

Documents Commonly Used in a BCMS

Depending on the organization, BCMS documentation may include:

• BCMS scope
• business continuity policy
• objectives
• Business Impact Analysis
• risk assessments
• business continuity strategies
• continuity plans
• IT disaster-recovery procedures
• emergency contact lists
• communication plans
• supplier continuity information
• exercise schedules
• exercise reports
• incident reports
• internal audit records
• corrective-action records
• management-review records

The exact documentation should be determined by the organization's requirements and implementation rather than created simply to increase paperwork.

ISO 22301 Certification

Organizations can implement ISO 22301 without obtaining third-party certification.

However, organizations seeking formal certification normally engage an accredited certification body to independently assess their BCMS against the applicable requirements.

The process commonly includes preparation, internal assessment and management review followed by certification auditing.

After successful certification, ongoing surveillance and subsequent recertification activities are normally required according to the certification programme.

Organizations should verify the accreditation and competence of any certification body before engaging it.

ISO 22313:2020 — Guidance for ISO 22301

Organizations implementing ISO 22301 should also be aware of:

ISO 22313:2020 — Security and resilience — Business continuity management systems — Guidance on the use of ISO 22301

ISO 22313 provides guidance and recommendations for applying ISO 22301 requirements and is based on international good practice.

ISO confirmed the 2020 edition in 2025, although ISO currently indicates that a revision is under development.

Therefore, organizations should verify the latest edition when beginning a new implementation project.

Common ISO 22301 Implementation Mistakes

Treating Business Continuity as an IT-Only Project

IT is important, but business continuity covers people, facilities, suppliers, communications and business processes as well.

Creating Plans Without a BIA

Without understanding business impact, recovery priorities can become arbitrary.

Having Backups but No Recovery Tests

Successful backup jobs do not prove that complete systems can be recovered within required timeframes.

Outdated Contact Information

Emergency contact lists quickly become useless if they are not maintained.

Unrealistic RTOs

Declaring every system must recover within 15 minutes may require extremely expensive infrastructure.

Recovery targets should reflect business requirements and appropriate technical solutions.

Ignoring Third-Party Dependencies

Cloud services, internet providers, suppliers and outsourced applications can all create continuity dependencies.

Never Exercising the Plan

A plan should be exercised periodically to determine whether it actually works.

Failing to Learn From Incidents

Actual incidents provide valuable information that should feed into continual improvement.

Practical Example: Small IT Company

Consider an IT service provider supporting 100 business customers.

Its critical services include:

• ticketing system
• customer database
• email
• remote-support tools
• telephone
• accounting
• internet connectivity

The company performs a BIA and determines:

Service	RTO	RPO
Ticketing	2 hours	30 minutes
Customer Database	2 hours	30 minutes
Email	4 hours	Provider-dependent
Accounting	24 hours	4 hours
Archived Documents	48 hours	24 hours

The company could then design continuity solutions according to those requirements rather than purchasing technology without defined recovery objectives.

Frequently Asked Questions (FAQ)

What is ISO 22301:2019?

ISO 22301:2019 is an international standard specifying requirements for establishing, implementing, maintaining and continually improving a Business Continuity Management System.

What does BCMS stand for?

BCMS stands for Business Continuity Management System.

Is ISO 22301 only for IT companies?

No. It can be applied across industries and organizations of different sizes.

Is ISO 22301 an IT Service Management standard?

No. ISO 22301 concerns business continuity management. ISO/IEC 20000-1 is the principal international management-system standard specifically focused on IT service management.

Is ISO 22301 related to disaster recovery?

Yes. IT disaster recovery can form an important part of business continuity, but business continuity has a wider organizational scope.

What is RTO?

RTO stands for Recovery Time Objective and represents the target time for recovering an activity, service or resource following disruption.

What is RPO?

RPO stands for Recovery Point Objective and relates to how far back data may need to be recovered following an incident.

Is backup enough for ISO 22301?

No. Backup is only one component of continuity and recovery. A BCMS also addresses business impact, continuity strategies, people, communication, suppliers, facilities, exercises, management and continual improvement.

Does ISO 22301 require testing?

The standard requires organizations to exercise and evaluate their business continuity procedures and capabilities. Exercises are essential for determining whether arrangements can work effectively.

Can small businesses use ISO 22301?

Yes. The approach should be appropriate to the organization's operating environment, complexity and continuity requirements.

Can an organization become ISO 22301 certified?

Yes. Organizations can seek independent certification of their BCMS through an appropriate certification body.

What is ISO 22313?

ISO 22313 provides guidance and recommendations for applying ISO 22301 requirements. The current published edition is ISO 22313:2020, although ISO indicates that a revision is under development.

Is ISO 22301:2019 still relevant after 2024?

Yes. ISO published ISO 22301:2019/Amd 1:2024, which applies to ISO 22301:2019 and adds climate-action-related changes.

Does ISO 22301 address climate change?

The 2024 amendment requires climate change to be considered within the management-system context requirements where relevant, and recognizes that interested parties can have climate-related requirements.

FINAL RECOMMENDATION / CONCLUSION

ISO 22301:2019 is one of the key international standards for organizations seeking a structured approach to business continuity and organizational resilience.

Its value is not simply in creating a Business Continuity Plan.

A properly implemented BCMS helps an organization determine:

What must continue → How quickly it must recover → What resources it depends on → What could disrupt it → How continuity will be maintained → How recovery will occur → Whether the arrangements actually work.

For IT-driven organizations, ISO 22301 should be considered alongside information security, IT service management, backup and disaster-recovery practices.

A practical continuity strategy should therefore include:

Business Impact Analysis + Risk Assessment + Defined Recovery Requirements + Continuity Strategies + Disaster Recovery + Tested Backups + Communication Plans + Exercises + Internal Audits + Management Review + Continual Improvement

Organizations implementing ISO 22301 today should also account for ISO 22301:2019/Amd 1:2024 — Climate action changes rather than relying solely on older implementation material.

For implementation guidance, ISO 22313:2020 is an important companion standard because it provides recommendations for applying ISO 22301 requirements.

 

#ISO22301 #ISO223012019 #BusinessContinuity #BCMS #BusinessContinuityManagement #BusinessContinuityPlan #BCP #DisasterRecovery #DisasterRecoveryPlan #DRP #ITDisasterRecovery #ITBusinessContinuity #RTO #RPO #RecoveryTimeObjective #RecoveryPointObjective #BusinessImpactAnalysis #BIA #RiskAssessment #BusinessResilience #OrganizationalResilience #OperationalResilience #CrisisManagement #IncidentResponse #EmergencyPlanning #Backup #BackupRecovery #BackupTesting #DisasterRecoveryTesting #BusinessContinuityTesting #ISO22301Certification #ISO22301Implementation #ISO22301Audit #ISO22301Checklist #ISO22301Requirements #ISO22301Training #ISO22313 #ISO27001 #ISO20000 #InformationSecurity #ITServiceManagement #CyberSecurity #RansomwareRecovery #CloudDisasterRecovery #ServerRecovery #DataRecovery #NetworkRedundancy #BusinessContinuityStrategy #ISOStandards #BusinessContinuityCertification