Requirements of ISO 22301
ISO 22301:2019 sets out requirements for a business continuity management system (BCMS). The standard is published by ISO , with practical explanation in ISO 22313 . Certification takes place under RvA accreditation (Dutch Accreditation Council).
The most important audit point is demonstrable effectiveness: can you show, with evidence, that critical processes return within the agreed recovery times?
Requirements of ISO 22301 in brief
| Theme | What does the auditor look at? | Read more |
|---|---|---|
| Scope and context | Clear boundaries and relevant risks | Who is it for? |
| Leadership and governance | Roles, responsibilities, decision-making | Step-by-step plan |
| BIA and risk assessment | Critical processes and impact thresholds | BIA, RTO and RPO |
| Continuity strategy and plans | A realistic recovery approach | Audit process |
| Testing and improvement | Exercises, CAPA, lessons learned | Audit process |
The core clauses of ISO 22301
1. Context and scope
You determine which parts of your organisation fall within the BCMS scope, and why.
2. Leadership
Management must give direction, set priorities and make resources available.
3. Planning and risk
You assess continuity risks and opportunities, and link them to objectives.
4. Support
You ensure competence, communication, documentation and resources.
5. Operational planning and control
You carry out and maintain the BIA, the strategy and the continuity plans.
6. Performance evaluation
You measure, audit and assess whether BCMS objectives are being met.
7. Improvement
You correct deviations and strengthen continuity based on incidents and tests.
Audit-critical parts of ISO 22301
| Component | Why is it critical? |
|---|---|
| BIA with firm impact criteria | Determines priority and recovery order |
| Management decisions on RTO/RPO | Shows realistic continuity objectives |
| Regular exercises | Proves that plans really work |
| Supply chain and supplier continuity | Reduces dependency risk |
| CAPA follow-up | Shows that you improve in a structured way |
Priorities per phase in ISO 22301
Start-up phase
Focus: scope, governance, BIA framework.
- Identify critical processes.
- Record impact thresholds.
- Fix roles and decision lines.