What is ISO 22301?
ISO 22301 is the international standard for business continuity management (BCMS). The standard is published by ISO , supported in content by ISO 22313 guidance , and certification takes place through accredited bodies supervised by the RvA (Dutch Accreditation Council).
A BCMS helps you keep critical processes running during disruptions. Think of ransomware, supplier failures, power outages, the impact of a pandemic or staff shortages.
ISO 22301 is not only about emergency plans. It is mainly about demonstrable preparation, fast recovery times and manageable continuity in practice.
ISO 22301 in brief
| What is it? | Standard for business continuity management systems (BCMS) |
| Who is it for? | Organisations with critical processes, or with customer or supply chain dependencies |
| Mandatory? | Usually not by law, but often required by contract or driven by risk |
| Certificate validity | 3 years, with annual checks |
| Indicative cost (year 1) | €20,000 - €150,000+ |
| Lead time | On average 4-12 months |
| Starting point | First decide whether ISO 22301 suits your organisation |
Why organisations use ISO 22301
The main drivers are usually:
- Less operational downtime during incidents.
- A stronger position in tenders and enterprise procurement.
- Faster recovery through clear RTO/RPO choices.
- Better risk management at supply chain and process level.
Who is ISO 22301 mainly relevant for?
ISO 22301 is especially relevant for organisations that:
- depend on 24/7 service delivery;
- work with strict SLAs and contractual penalties;
- are part of critical supply chains (IT, logistics, healthcare, finance);
- carry a lot of reputation or revenue risk when they go down.
You can find more detail on Who is it for?.
Core parts of an ISO 22301 BCMS
A mature BCMS usually revolves around:
- Business impact analysis (BIA): what is critical, and what must not go down?
- RTO/RPO choices: how quickly must you recover, and how much data loss is acceptable?
- Continuity strategy: alternatives for people, systems, locations and suppliers.
- Testing and exercises: evidence that the plans work.
- Improvement cycle: evaluate, adjust and test again.
Further reading: BIA, RTO and RPO and the business continuity plan.
Frequently asked starting questions about ISO 22301
| Question | Short answer | Read more |
|---|---|---|
| How quickly can you start? | Often within 2-4 weeks with scope and BIA | Step-by-step plan |
| What does the first year cost? | Often €20k - €150k+ | Costs and timeline |
| What does an auditor check? | BCMS design and demonstrable operation | Audit process |
| What is the main difference from ISO 27001? | 22301 = continuity, 27001 = information security | ISO 22301 vs. ISO 27001 |
| What is the main difference from ISO 9001? | 22301 = continuity, 9001 = quality management | ISO 22301 vs. ISO 9001 |
| Which parts of the standard are critical for audit? | BIA, strategy, testing and corrective actions | Requirements of the standard |
Frequently compared standards with ISO 22301
These comparisons often help with the first choice of standard:
Next steps
Sources
- ISO 22301:2019 - Security and resilience - Business continuity management systems
- ISO 22313 - Guidance on ISO 22301
- Dutch Accreditation Council (RvA)