What is ISO 22301
ISO 22301 is the international standard for a business continuity management system (BCMS). The current edition is ISO 22301:2019 (with a 2024 amendment on climate risks). It sets common requirements: how to plan, implement, check and improve a company’s ability to keep working during disruptions.
The standard follows the same logic as other ISO management system standards (for example, ISO 9001) and works on the PDCA cycle: “plan – do – check – act”.
Key requirements (clauses 4–10)
| Clause | What it covers |
|---|---|
| 4. Context | Understanding the organisation, interested parties, scope of the BCMS |
| 5. Leadership | Role of top management, continuity policy, assignment of responsibilities |
| 6. Planning | Continuity objectives, addressing risks and opportunities |
| 7. Support | Resources, competence, awareness, communication, documentation |
| 8. Operation | BIA, risk assessment, continuity strategies and plans, exercises |
| 9. Evaluation | Monitoring, measurement, internal audit, management review |
| 10. Improvement | Handling nonconformities and continual improvement |
Related standards: ISO 22313 (guidance on implementing ISO 22301) and ISO/IEC 27031 (ICT readiness for business continuity).
How to implement it: the main steps
- Define the scope and secure management support.
- Carry out a business impact analysis (BIA) and a risk assessment.
- Choose continuity strategies and develop plans (BCP).
- Train the team and run exercises.
- Launch internal audits and management reviews.
Is certification needed in Russia
Certification is not mandatory for most companies, but the ISO 22301 method itself is useful as the frame of a mature system. A certificate makes sense when counterparties, tenders, an exchange or a parent company ask for it. The Russian equivalent of the standard is direct: GOST R ISO 22301.
GOST R ISO 22301: the same standard in Russian
GOST R ISO 22301-2021, Dependability in technics. Business continuity management systems. Requirements, is identical to the international ISO 22301:2019. It was approved by Rosstandart order 1059-st of 5 October 2021 and came into force on 1 January 2022, replacing GOST R ISO 22301-2014, which translated the previous edition of the standard. If a 2014 document reaches your desk, it has been superseded and its requirements differ from the current ones.
What identical means here: not a retelling and not an adaptation, but a translation of the same text, with the same numbering of clauses 4 to 10. So the system can be built from either document, while internal policies are easier to reference to the GOST: it is simpler to show to a Russian auditor or inspector.
| Designation | What’s inside | Status |
|---|---|---|
| ISO 22301:2019 | The international standard, current edition | In force |
| GOST R ISO 22301-2021 | An identical translation of ISO 22301:2019, in force since 01.01.2022 | In force |
| GOST R ISO 22301-2014 | A translation of the 2012 edition | Superseded |
The difference in the titles should not worry anyone: the international standard sits under security and resilience, the Russian one under dependability in technics. That is a rule of GOST drafting, not a difference in content. The term continuity of operations in the GOST corresponds to business continuity in everyday use.
The standard and Bank of Russia requirements side by side
In Russia a company usually has two sources of requirements, and they do not contradict each other. The international standard sets the management framework: the cycle, roles, evidence. The Bank of Russia, in its regulations on operational continuity and recovery, sets the mandatory minimum for supervised organisations: what the plan must contain, recovery times, and how to notify the regulator.
In practice it is easier to build the system around the standard and cover the regulator’s requirements as a mandatory subsection inside it. Doing it the other way round (first do what the regulator orders, then build a system “some day”) leads to a folder of documents that lives apart from the company. What exactly the regulator requires and what a working plan looks like is covered in operational continuity and recovery (ONiVD) and the ONiVD plan.
The order of implementation
Order matters more than speed. The steps people skip most often cost the most later.
- Define the boundaries. Which units, sites and processes are in the system. Trying to cover everything at once is the most common reason a project stalls in its third month.
- Carry out an impact analysis. Without it, recovery priorities are set by intuition. See business impact analysis.
- Write the plans. Keep people’s actions separate from the recovery of systems: a business continuity plan and a disaster recovery plan.
- Train people and run exercises. A document the team sees for the first time in a crisis does not work. See business continuity exercises.
- Check and improve. Internal audit, exercise debriefs, review of target times. This closes the cycle, and closing the cycle is what the standard was written for.
Two tools help you quickly understand the current state before the project starts: the readiness checklist and the continuity stress test.
What the auditor will ask to see
Compliance is proven by evidence of real work. Auditors usually ask for the same things: approved system boundaries and a policy signed by management; impact analysis results with target times confirmed by process owners; current plans with the date of the last review; exercise reports listing the weaknesses found; and, most importantly, evidence that something was done about those weaknesses.
The last item is what separates a living system from a paper one. An exercise report in which everything went perfectly raises more questions for an experienced auditor than a report with ten findings and a plan to fix them. How to prepare the team for this is covered in the corporate business continuity course.
The standard describes the requirements for the system. What the system itself is, in plain language, is explained in business continuity.
Frequently asked questions
Which edition of ISO 22301 is current?
ISO 22301:2019 with the 2024 amendment (Amd 1, climate aspects). This is the current version of the international business continuity standard.
Is ISO 22301 certification mandatory?
No. You can use the standard as a methodology without certification. A certificate is needed when customers, tenders or a regulator require it.
How does ISO 22301 differ from ISO 27031?
ISO 22301 covers business continuity as a whole. ISO/IEC 27031 covers the readiness of ICT (IT infrastructure) for business continuity. They complement each other.
From the requirements of the standard to a working system
The assessment shows the gap between your documents and reality. Then the system is built either by your own team in the programme or by us as a turnkey project.
Implementation and standards
This is the core page of the section. Below are the other materials in the section. They cover specific parts of the topic.
- ONiVD and the ONiVD plan (Bank of Russia requirements)Bank of Russia requirements, plan structure, common mistakes
- Continuity exercisesTabletop exercises, simulations, technical tests and how to run them
- Crisis readiness checklistA practical 12-point checklist
- Corporate BCM/BCP courseCorporate course: 6 modules, 16 hours, with a certificate
- Business continuity stress test: verdict and plan in 2 daysVerdict and plan in two days, stress simulation