ISO 22301, keep the business running when things go wrong
Plan for outages, disasters and disruptions, and prove you can recover.
Official sources
Use these official places to read the text and find the latest version.
What ISO 22301 is
ISO 22301 is the standard for a business continuity management system. It helps you work out which activities matter most, how long you can be without them, and how to recover.
It is useful for any disruption: cyberattack, outage, fire, supplier failure or pandemic.
How ISO 22301 got to where it is today
The milestones that changed what organisations have to do.
BS 25999
The British standard for business continuity management.
ISO 22301:2012
First international edition.
ISO 22301:2019
Revised to align with other ISO management standards. ISO lists it as due for revision.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
A disruption would stop revenue quickly.
Customers ask for a continuity plan.
You are in a regulated sector.
You rely on a few critical suppliers or systems.
What it asks of you
The requirements fall into six areas.
Context and scope
What the programme covers.
Business impact analysis
Which activities matter and how long you can be down.
Risk assessment
What could cause disruption.
Continuity strategies and plans
How you will keep running or recover.
Exercising and testing
Practise and learn.
Review and improvement
Fix gaps after tests and incidents.
The 7 clauses, 26 sub-clauses and 47 requirements
Open any clause to see the sub-clauses of the business continuity standard, what each asks of you in plain English, and the records an auditor would expect.
26 sub-clauses · 47 requirements
c4Clause 4 Context of the organisationUnderstand the organisation, who depends on it and the boundary of the continuity system.4 sub-clauses · 6 requirements
4.1Understanding the organisation and its contextKnow the internal and external factors that could affect continuity.1 requirement
- 4.1
The organisation determines the external and internal issues relevant to its purpose that affect its ability to achieve the intended results of the continuity system.
What you do
- Run a yearly context workshop and record issues such as key suppliers, locations and regulation
- Keep a short list of critical products and services with owners
Evidence to keep
- Context analysis (e.g. PESTLE or SWOT)
- Record of key products, services and dependencies
4.2Interested parties and legal requirementsKnow who has expectations of you and what laws bind you.2 requirements
- 4.2.1
The organisation identifies the interested parties relevant to the system and their requirements.
What you do
- List customers, regulators, insurers, staff and suppliers with what each expects
- 4.2.2
The organisation identifies, has access to and keeps up to date the legal and regulatory requirements related to continuity of its products and services.
What you do
- Assign an owner to monitor sector rules and contract continuity clauses
- Record how each requirement is met
Evidence to keep
- Interested parties register
- Register of legal, regulatory and contract requirements
4.3Scope of the systemDecide and document what the continuity system covers.2 requirements
- 4.3.1
The organisation determines the boundaries and applicability of the continuity system, taking account of context, requirements and its mission.
What you do
- List sites, services and teams in scope
- 4.3.2
The scope is documented and any exclusions are explained and do not affect the ability to deliver continuity.
What you do
- Record each exclusion with a business reason and risk sign-off
Evidence to keep
- Scope statement with exclusions and reasons
- Approved by top management
4.4The continuity systemEstablish, run and improve the system as a whole.1 requirement
- 4.4
The organisation establishes, implements, maintains and continually improves a business continuity management system including the processes needed and their interactions.
What you do
- Adopt a plan-do-check-act cycle with a named system owner
- Map how risk, impact analysis, plans and exercises connect
Evidence to keep
- Documented system overview or manual
- Process interaction map
c5Clause 5 LeadershipTop management owns, resources and directs continuity.3 sub-clauses · 4 requirements
5.1Leadership and commitmentTop management shows ownership of the system.1 requirement
- 5.1
Top management demonstrates leadership and commitment by setting policy and objectives, integrating the system into business processes, providing resources and promoting improvement.
What you do
- Put continuity on the board or leadership agenda each quarter
- Fund recovery tooling and exercises
Evidence to keep
- Management meeting minutes
- Budget approvals for continuity
5.2PolicySet a clear, communicated continuity policy.2 requirements
- 5.2.1
Top management establishes a business continuity policy that fits the organisation's purpose, provides a framework for objectives and commits to meeting requirements and improving.
What you do
- Write a one-page policy signed by the chief executive
- 5.2.2
The policy is available as documented information, communicated within the organisation and made available to interested parties as appropriate.
What you do
- Publish on the intranet and include in induction
Evidence to keep
- Approved policy with version history
- Staff communication record
5.3Roles, responsibilities and authoritiesAssign who does what.1 requirement
- 5.3
Top management assigns and communicates responsibilities and authorities for ensuring the system conforms and for reporting on its performance.
What you do
- Name a continuity manager and deputies
- Write continuity duties into job descriptions
Evidence to keep
- Roles and responsibility matrix
- Appointment letters for continuity team
c6Clause 6 PlanningPlan how risks and opportunities, objectives and changes to the system are handled.3 sub-clauses · 5 requirements
6.1Actions to address risks and opportunitiesPlan for what could stop the system working.2 requirements
- 6.1.1
When planning the system the organisation considers context and requirements and determines the risks and opportunities to address.
What you do
- Review risks to the system itself, such as lack of staff or funding
- 6.1.2
The organisation plans actions to address those risks and opportunities and how to integrate and evaluate them.
What you do
- Track actions in the same register as other risks
Evidence to keep
- Risks and opportunities register for the system
- Action plans with owners
6.2Continuity objectivesSet measurable continuity goals.2 requirements
- 6.2.1
Continuity objectives are set at relevant functions and levels, are measurable, consistent with policy, and monitored and updated.
What you do
- Set targets such as plans exercised yearly and recovery times met
- 6.2.2
The organisation plans what will be done, with what resources, by whom, by when and how results are evaluated.
What you do
- Assign an owner and date to each objective
Evidence to keep
- Objectives list with measures and dates
- Progress reports
6.3Planning of changesControl changes to the continuity system.1 requirement
- 6.3
When a change to the system is needed, it is carried out in a planned manner.
What you do
- Assess purpose, consequences, resources and responsibilities before changing scope or plans
- Update documents after approved changes
Evidence to keep
- Change log for the system
- Impact assessment of changes
c7Clause 7 SupportProvide the people, skills, awareness, communication and records the system needs.5 sub-clauses · 7 requirements
7.1ResourcesProvide enough resources.1 requirement
- 7.1
The organisation determines and provides the resources needed to establish, implement, maintain and improve the system.
What you do
- Budget for alternate site, backup tools and exercise time
Evidence to keep
- Resource plan and budget
- Tooling and facility inventory
7.2CompetenceMake sure people can do the work.1 requirement
- 7.2
The organisation determines the necessary competence of people affecting performance, ensures they are competent and keeps evidence.
What you do
- Train continuity team in impact analysis and crisis communication
- Keep records of qualifications and exercises attended
Evidence to keep
- Competence matrix
- Training and certification records
7.3AwarenessEveryone knows their part.1 requirement
- 7.3
People working under the organisation's control know the policy, their contribution to effectiveness and the implications of not conforming.
What you do
- Run short briefings and include what to do in a disruption in induction
Evidence to keep
- Awareness material and attendance
- Induction content
7.4CommunicationDecide what is communicated, to whom and how.1 requirement
- 7.4
The organisation determines internal and external communications relevant to the system, including what, when, with whom and how.
What you do
- Keep an emergency contact tree tested twice a year
Evidence to keep
- Communication plan
- Contact lists
7.5Documented informationCreate and control the records the system needs.3 requirements
- 7.5.1
The system includes the documented information required by the standard and that the organisation decides is necessary.
What you do
- List required documents such as scope, policy, impact analysis and plans
- 7.5.2
Documented information is created and updated with suitable identification, format and review and approval.
What you do
- Use a template with owner, version and approval date
- 7.5.3
Documented information is controlled so it is available when needed, protected and handled for distribution, storage, retention and change.
What you do
- Store plans where they are reachable during an outage, such as offline copies
Evidence to keep
- Document register
- Access and version control evidence
c8Clause 8 OperationAnalyse impact and risk, choose strategies, write plans and exercise them.6 sub-clauses · 16 requirements
8.1Operational planning and controlPlan and control the processes that deliver continuity.1 requirement
- 8.1
The organisation plans, implements and controls the processes needed to meet requirements, including criteria, control, documented information and control of outsourced processes.
What you do
- Define criteria for activating continuity processes
- Include continuity clauses in outsourcing contracts
Evidence to keep
- Operational control procedures
- Outsourced process controls
8.2Business impact analysis and risk assessmentFind what matters most and what could disrupt it.3 requirements
- 8.2.1
The organisation establishes, implements and maintains processes for analysing business impact and assessing disruption risks, and reviews them at planned intervals and on significant change.
What you do
- Schedule a review at least yearly and after major change
- 8.2.2
The impact analysis identifies activities supporting products and services, assesses impacts over time, sets prioritised timeframes for resuming activities and identifies dependencies including suppliers.
What you do
- Interview process owners to set maximum tolerable disruption and recovery time targets
- Map each critical activity to people, systems, sites and suppliers
- 8.2.3
The organisation implements and maintains a risk assessment process that identifies, analyses and evaluates the risks of disruption to its prioritised activities and the resources they depend on, and determines which need treatment.
What you do
- Assess threats such as outage, cyber attack, loss of staff or site and loss of a key supplier
- Record treatment decisions and residual risk
Evidence to keep
- Business impact analysis reports
- Disruption risk assessment
- Approved recovery objectives
8.3Business continuity strategies and solutionsChoose and resource ways to keep running or recover.5 requirements
- 8.3.1
Strategies and solutions are determined on the basis of the impact analysis and risk assessment.
What you do
- Link each strategy to specific recovery time and recovery point targets
- 8.3.2
The organisation identifies strategies and solutions that meet requirements to protect prioritised activities, stabilise, continue, resume and recover them, and mitigate impacts.
What you do
- Compare options such as alternate site, remote working, redundancy and manual workarounds
- 8.3.3
Selection of strategies and solutions is based on meeting recovery requirements, the amount and type of risk accepted, and cost and benefits.
What you do
- Document why each option was chosen and the risk accepted
- 8.3.4
The organisation determines the resource requirements to implement the selected solutions, including people, information, infrastructure, equipment, finance, partners and suppliers.
What you do
- Price standby capacity and supplier arrangements
- 8.3.5
The selected solutions are implemented and maintained, including measures for protecting and stabilising prioritised activities.
What you do
- Deploy backups, failover, spare equipment and alternate work arrangements and keep them current
Evidence to keep
- Approved strategy document
- Resource requirements and budget
- Implemented solutions evidence
8.4Business continuity plans and proceduresDocument how you respond and recover.5 requirements
- 8.4.1
The organisation implements and maintains a response structure that enables timely warning and communication and effective response to disruption.
What you do
- Define clear escalation levels and authority to invoke plans
- 8.4.2
The response structure identifies thresholds that trigger a response, assesses the nature and extent of the disruption, activates an appropriate response, and has procedures to manage logistics and communicate.
What you do
- Set invocation criteria and a meeting place or online bridge
- 8.4.3
The organisation has procedures for detecting and warning of incidents, communicating with interested parties and authorities, and keeping a log of events and decisions.
What you do
- Use a mass notification tool and a decision log template
- 8.4.4
Documented business continuity plans give guidance on how to respond to disruption and how to continue or recover activities within predetermined timeframes.
What you do
- Write plans per critical activity with roles, steps, contacts and resources
- 8.4.5
The organisation has documented procedures to restore and return business activities from the temporary measures used during and after a disruption.
What you do
- Write return-to-normal steps and confirm data reconciliation
Evidence to keep
- Incident response structure chart
- Business continuity plans
- Warning and communication procedures
- Recovery procedures
8.5Exercise programmeTest that plans work.1 requirement
- 8.5
The organisation implements and maintains a programme of exercising and testing to validate over time the effectiveness of its strategies and solutions, with exercises consistent with objectives, planned, reviewed after the event and reported.
What you do
- Run an annual tabletop and a technical recovery test
- Record lessons and track actions to closure
Evidence to keep
- Exercise schedule and scenarios
- Exercise reports with actions
8.6Evaluation of documentation and capabilitiesCheck that your analysis and capability are still fit.1 requirement
- 8.6
The organisation evaluates the suitability, adequacy and effectiveness of its impact analysis, risk assessment, strategies, solutions, plans and procedures, through reviews, analysis, exercises, tests, post-incident reports and performance evaluations, and acts on the results.
What you do
- Review after each exercise or real incident and after organisational change
- Verify that supplier and partner arrangements still work
Evidence to keep
- Review reports of impact analysis and strategies
- Evidence of corrective updates
c9Clause 9 Performance evaluationMeasure, audit and review the system.3 sub-clauses · 7 requirements
9.1Monitoring, measurement, analysis and evaluationKnow whether the system performs.2 requirements
- 9.1.1
The organisation determines what needs to be monitored and measured, the methods, when, and when results are analysed and evaluated, and retains evidence.
What you do
- Track exercise completion rate and recovery times achieved
- Report results to management
- 9.1.2
The organisation evaluates the performance of business continuity procedures and the effectiveness and suitability of the system and acts when needed.
What you do
- Compare actual recovery against targets after tests and incidents
Evidence to keep
- Performance indicator reports
- Evaluation of continuity procedures
9.2Internal auditIndependently check conformity.2 requirements
- 9.2.1
The organisation conducts internal audits at planned intervals to check the system conforms to its own and the standard's requirements and is effectively implemented.
What you do
- Audit each clause at least over a three year cycle
- 9.2.2
The audit programme considers importance of processes and previous results, defines criteria, scope and frequency, uses objective and impartial auditors, reports to management and retains evidence.
What you do
- Use trained auditors who do not audit their own work
Evidence to keep
- Audit programme
- Audit reports and corrective actions
9.3Management reviewLeadership reviews the system.3 requirements
- 9.3.1
Top management reviews the system at planned intervals to ensure continuing suitability, adequacy and effectiveness.
What you do
- Hold the review at least annually
- 9.3.2
The review considers status of past actions, changes in context, performance information, audit results, nonconformities, opportunities for improvement and relevant external communications.
What you do
- Prepare a standard review pack covering results of exercises and incidents
- 9.3.3
The review outputs decisions on continual improvement opportunities and any need to change the system, and documented evidence is retained.
What you do
- Record decisions and resourcing changes in minutes
Evidence to keep
- Management review agenda and minutes
- Decisions and actions list
c10Clause 10 ImprovementCorrect problems and keep improving.2 sub-clauses · 2 requirements
10.1Nonconformity and corrective actionFix what went wrong and stop recurrence.1 requirement
- 10.1
When a nonconformity occurs the organisation reacts, evaluates the need to eliminate causes, implements actions, reviews their effectiveness, changes the system if necessary and retains evidence.
What you do
- Log findings from audits, exercises and incidents with owners and due dates
- Check that each fix actually worked
Evidence to keep
- Nonconformity and corrective action log
- Root cause analyses
10.2Continual improvementKeep the system better over time.1 requirement
- 10.2
The organisation continually improves the suitability, adequacy and effectiveness of the system.
What you do
- Feed lessons from exercises and real disruptions into plans and strategies
Evidence to keep
- Improvement log
- Evidence of changes following reviews
Nothing matches. Clear the search or pick another clause.
Outcomes and implementation examples are from ISO 22301:2019 Security and resilience - Business continuity management systems - Requirements (with Amd 1:2024), published by NIST. Descriptions of what to do and the evidence lists are our own plain-English guidance. Check the official source for the authoritative text.
Your path to getting started
Five steps from first look to ready. Effort depends on your size and starting point.
- 1
Set the scope
Sites, services, systems.
- 2
Run a BIA
Rank by impact.
- 3
Write the plans
Roles and steps.
- 4
Test them
Walk-throughs and real recovery tests.
- 5
Audit and certify
Internal audit, then a certification body.
How Optimus GRC helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus GRC |
|---|---|
| Context and scope | Scope records |
| Business impact analysis | BIA worksheets |
| Risk assessment | Risk register |
| Continuity strategies and plans | Plans with owners |
| Exercising and testing | Exercise logs |
| Review and improvement | Corrective actions |
Free ISO 22301 readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- BIA template
- Continuity plan outline
- Exercise report
- Contact tree
Share or cite this page
Writing about ISO 22301? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/iso-22301/">ISO 22301 explained in plain English - Optimus CyberX</a>Common questions
Is it the same as disaster recovery?
Disaster recovery is IT-focused. Business continuity covers the whole business.
Is it mandatory?
Not usually, but some regulators expect continuity planning.
Can we certify?
Yes. An accredited certification body can audit and certify your business continuity management system against ISO 22301.
How often should we test?
At least yearly, and after major changes.
Related frameworks
See how ready you are for ISO 22301
Answer questions across every area. We email you a report showing where you comply and where you do not.