What ISO 22301 is
ISO 22301 is the international standard for a business continuity management system (BCMS). The current edition is ISO 22301:2019 (with a 2024 amendment on climate-related risks). It sets uniform requirements for how a company plans, implements, checks and improves its ability to keep operating during disruptions.
The standard follows the same logic as other ISO management-system standards (for example, ISO 9001) and runs on the PDCA cycle — "plan, do, check, act."
Key requirements (clauses 4-10)
| Clause | About |
|---|---|
| 4. Context | Understanding the organisation, interested parties, scope of the BCMS |
| 5. Leadership | Role of top management, continuity policy, assignment of responsibility |
| 6. Planning | Continuity objectives, addressing risks and opportunities |
| 7. Support | Resources, competence, awareness, communication, documents |
| 8. Operation | BIA, risk assessment, continuity strategies and plans, drills |
| 9. Evaluation | Monitoring, measurement, internal audit, management review |
| 10. Improvement | Handling nonconformities and continual improvement |
Related standards: ISO 22313 (guidance on implementing ISO 22301) and ISO/IEC 27031 (ICT readiness for business continuity).
How to implement it: main steps
- Define the scope and secure management support.
- Run a business impact analysis (BIA) and risk assessment.
- Choose continuity strategies and develop plans (BCP).
- Train the team and run drills.
- Launch internal audits and management review.
Is certification necessary
Certification is optional for most companies — but the ISO 22301 methodology itself is useful as the framework of a mature system. A certificate makes sense when partners, tenders, an exchange or a parent company require it. In Russia the terminology equivalent is the GOST R series on continuity management; the principles are the same.
See how resilient your business really is
13 questions, 5 minutes, free — results on screen and by email.
FAQ
Which edition of ISO 22301 is current?
ISO 22301:2019 with the 2024 amendment (Amd 1, climate aspects). This is the current edition of the international business continuity standard.
Is ISO 22301 certification mandatory?
No. The standard can be used as a methodology without certification. A certificate is needed when customers, tenders or a regulator require it.
How is ISO 22301 different from ISO 27031?
ISO 22301 is about whole-business continuity. ISO/IEC 27031 is about ICT (IT infrastructure) readiness to support continuity. They complement each other.
