Is ISO 22301 mandatory?
ISO 22301 is a voluntary standard. The certificate is not part of the Dutch Cybersecurity Act (Cbw, Cyberbeveiligingswet) or the European NIS2 Directive. Those rules do require certain organisations to have their business continuity in order. Customers and public contracting authorities also often ask for a demonstrable BCMS (business continuity management system). Whether you need ISO 22301 therefore depends on your sector, your size and your contracts. The Cbw has been in force since 15 August 2026. See the news item from the Dutch government (Rijksoverheid) and the NIS2 Directive on EUR-Lex . See also who ISO 22301 is relevant for.
The measures are mandatory, not the certificate. A law can require you to manage business continuity without you needing an ISO certificate to prove it.
The short answer per situation
| Situation | Legally mandatory? | What you do need |
|---|---|---|
| Regular SME (small and medium-sized enterprise), not in a critical sector | No | Voluntary. You can start with a BIA |
| Organisation that falls under NIS2/Cbw | Yes, business continuity is a required measure | Demonstrable measures, such as backup, recovery and crisis management |
| Supplier to a customer that requires ISO 22301 | No, but contractually required | Certificate or equivalent evidence |
| Tender that lists ISO 22301 as a requirement | No, but decisive for the award | Certificate or a demonstrable BCMS |
| Organisation supervised by a sector regulator | Sometimes, through sector rules | Requirements of the regulator, possibly with ISO 22301 as a translation |
The difference between the first and second rows is large. Many businesses think they must obtain ISO 22301 because NIS2 is mentioned. NIS2 names business continuity as a topic, but it does not prescribe an ISO certificate. Sector rules from a regulator may handle this differently, so check those for your own sector.
What does NIS2 say about business continuity?
NIS2 is the European directive on cybersecurity (EUR-Lex, Directive (EU) 2022/2555 ). Article 21 requires organisations to take appropriate risk management measures. According to paragraph 2, point (c), these include business continuity, backup management, disaster recovery and crisis management. These topics are the core of a BCMS. Read the exact wording of that part on EUR-Lex.
The directive itself is not a Dutch law. The Netherlands has implemented it in the Dutch Cybersecurity Act (Cbw). That law has applied since 15 August 2026, together with the Dutch Act on the Resilience of Critical Entities (Wwke, Wet weerbaarheid kritieke entiteiten). According to the Dutch government (Rijksoverheid) , the Cbw contains a duty of care (appropriate and proportionate measures), a duty to report significant incidents and a duty to register with the NCSC (Dutch National Cyber Security Centre). You determine whether your organisation falls under the law yourself, based on your sector and size.
You can read how this applies to you in detail at ISO 22301 and NIS2.
Why the question is often asked wrongly
People search for “ISO 22301 mandatory” with different intentions. The question has three layers:
- Legal: do I have to do this under the law? Answer: only if your sector and size fall under NIS2/Cbw.
- Contractual: does a customer want to see this? Answer: that determines your revenue, not the law.
- Internal: do I want proof that I am resilient? Answer: then ISO 22301 is a useful framework, but not the only one.
Note: you can meet the legal measures without a certificate. A customer’s auditor can still ask for evidence, such as a BIA, a tested business continuity plan and exercise reports.
How to find out what applies to you
Follow this order. Each step takes little time and prevents you from starting a project you do not need.
- Check whether your sector falls under NIS2. That depends on your activities and size, not on how you feel about it.
- Ask your largest customers and public contracting authorities whether they require ISO 22301, and if so, in what form.
- Read your contracts for SLAs, penalties and obligations around downtime.
- Based on those answers, decide whether you need the certificate or whether your own BCMS is enough.
Common mistakes
| Mistake | Why it goes wrong | Better approach |
|---|---|---|
| ”NIS2 requires ISO 22301” | NIS2 requires measures, not a specific standard | Ask which measures you need to demonstrate |
| Getting certified before the law took effect | You pay for a certificate you do not need | First map the legal requirements |
| Only writing a handbook | Auditors and regulators ask whether it works | Test your plans, see exercising and testing |
| Waiting until a customer asks | Tenders often have long lead times | Start with a BIA |
Example: a software company with a large customer
Suppose a software company with 60 employees supplies a customer portal to an insurer. The contract states that the supplier “demonstrably manages business continuity”. The law does not require the company to obtain ISO 22301. The customer does want to see how the company responds if the portal goes down.
The company therefore provides three things:
- a BIA that covers the portal, the support desk and invoicing, with recovery times;
- a description of the business continuity plan with the people responsible;
- a report of a tabletop exercise from the past six months.
With those three documents, the company meets the request without a certificate. Only when the customer explicitly requires the certificate does a certification process become the logical next step.
Evidence that auditors and customers often ask for
Whether or not you certify, the same evidence keeps coming back:
| Evidence | What it shows | Common mistake |
|---|---|---|
| Business impact analysis | Which processes must return first | Everything is marked “high” |
| Continuity plans | What you do when something fails | The plan is not known to employees |
| Exercise report | That the plan works | An exercise without conclusions |
| Supplier agreements | That your supply chain is involved | No contact with critical suppliers |
| Management approval | That management owns the plan | The plan was never formally adopted |
You can read more about exercises at exercising and testing.
When ISO 22301 is the right choice
- You have customers who do not accept downtime and use certification as a selection criterion.
- You sell to government or healthcare, where continuity is often in the specification.
- You want to organise your NIS2 measures in a system that you can also have audited.
- You are already ISO 27001 certified and want to make continuity equally demonstrable.
For costs and the process, see costs and timeline and the step-by-step plan.
Summary
ISO 22301 is generally voluntary. It becomes mandatory through contracts and tenders, or indirectly through NIS2 if your organisation falls under it. In the latter case, the obligation is to demonstrably manage business continuity. The certificate is one possible form of that proof.
Frequently asked questions
See also the frequently asked questions about ISO 22301 for broader answers. You can read more about the audit format in the audit process.