ISO 22301 for IT companies and SaaS
For IT companies and SaaS providers, business continuity is not a theoretical topic. Customers expect uptime, contracts include SLAs with penalty clauses, and downtime is immediately visible. ISO 22301 provides an international standard for business continuity management. You can find more detail in ISO 22313 . Certification runs through bodies supervised by the Dutch Accreditation Council (RvA) .
The relationship with ISO 27001 is especially relevant for IT companies. Information security and business continuity overlap strongly, but they are not the same. You can read more about that distinction on the page ISO 22301 vs. ISO 27001.
ISO 22301 is about the availability of your business processes, not only your systems. That is exactly what enterprise customers want to see: that you, as a supplier, keep delivering even during serious disruptions.
Why IT companies consider ISO 22301
IT companies and SaaS providers come to ISO 22301 via three routes:
- Enterprise customers ask for proof of continuity management in tenders, sometimes alongside or in addition to ISO 27001.
- SLA risks grow as you scale. The more enterprise revenue you have, the higher the penalties for downtime.
- Regulation such as NIS2 requires demonstrable continuity management for providers in critical sectors. You can read more about this on ISO 22301 and NIS2.
Disaster recovery vs. business continuity management
This distinction causes a lot of confusion in the IT sector. Disaster recovery (DR) is a part of business continuity management, not the same thing.
| Aspect | Disaster recovery (DR) | Business continuity management (BCM) |
|---|---|---|
| Focus | Restoring IT systems and data | Continuity of all critical business processes |
| Scope | Technical infrastructure | People, processes, systems, suppliers |
| Owner | IT department | Management and all process owners |
| Evidence | Failover test, backup restore | BIA, crisis plan, exercises, governance |
| Customer asks for… | RTO/RPO specifications, test results | ISO 22301 certificate or BCMS description |
A SaaS company with excellent DR (automatic failover, multi-region) but no BCM still runs a risk. For example, the customer service team may be unable to switch over during an office outage. Or the on-call engineer may be the only person who knows the critical recovery steps.
DR without BCM protects you technically. BCM without DR is paper without execution. You need both.
Uptime requirements and SLAs: what ISO 22301 adds
SaaS customers set high demands on availability. 99.9% or higher is standard in enterprise contracts. That translates to a maximum of 8.76 hours of downtime per year. ISO 22301 helps you substantiate and secure those requirements.
| SLA level | Maximum downtime per year | RTO requirement (indicative) |
|---|---|---|
| 99.0% | 87.6 hours | 4-8 hours |
| 99.5% | 43.8 hours | 2-4 hours |
| 99.9% | 8.76 hours | less than 1 hour |
| 99.95% | 4.38 hours | 15-30 minutes |
The RTO in your business impact analysis must demonstrably match your SLA commitments. If you promise 99.9% but your RTO is 4 hours, you have a gap. An auditor or customer will notice it.
ISO 22301 and ISO 27001 for IT companies
Many IT companies start with ISO 27001 and add ISO 22301 later. That is a logical order: information security is the most urgent customer requirement, and continuity management follows.
Already have ISO 27001
You already have ISO 27001:
- You have a working ISMS structure. Use it as the basis for your BCMS.
- Annex A of ISO 27001 already contains continuity controls (A.17). Build on those.
- Combined governance and internal audit saves time and cost.
- The extra effort lies in the BIA, exercises and the crisis organisation.
Practical BCM approach for an IT company
A SaaS company with 50 employees can tackle ISO 22301 concretely with this focus:
- Scope: define your critical services (which customer platforms, which internal systems).
- BIA: map the impact of downtime per service after 1 hour, 4 hours and 1 day.
- RTO/RPO: set recovery targets that fit your SLAs, not the other way round.
- DR link: verify that your technical DR capacity actually meets the BCM targets.
- Crisis organisation: appoint owners per service, including deputies. Avoid a single point of failure in your team.
- Practise: run at least one tabletop exercise per year and one DR test per quarter.