What is ISO 22301?
ISO 22301 is the international, certifiable standard that sets the requirements for a Business Continuity Management System (BCMS): a management system with which an organisation prepares for disruptions, keeps its critical processes running at an agreed minimum level during an incident and restores them within an acceptable time. The standard makes continuity management planned and demonstrable, with a fixed cycle of analysis, strategy, plans, exercises and improvement. ISO 22301 applies to all types of organisations, from government bodies and healthcare providers to factories, water authorities and energy companies. In OT environments it is not only about data and office systems, but about keeping physical processes running or shutting them down safely.
🕰️ How did ISO 22301 come about?
The first edition appeared in 2012, drafted by ISO/TC 223 Societal security, and built on earlier national continuity standards such as the British BS 25999-2. It was the first ISO standard written entirely in the Annex SL structure for management systems, the same chapter layout used by ISO 27001 and ISO 9001. The current second edition was published in October 2019 by ISO/TC 292 Security and resilience.
| Year | Event | What changed |
|---|---|---|
| 2012 | ISO 22301:2012 published | First international, certifiable BCMS standard in the Annex SL structure |
| 2019 | ISO 22301:2019 (second edition) | Less duplicated text, simpler terminology, stronger BIA and strategy selection |
| 2022 | End of transition period | Certificates against the 2012 edition expired after a three-year transition |
| 2024 | Amendment 1: Climate action changes | Organisations must determine whether climate change is relevant to their BCMS |
In the 2019 revision, terms such as MTPD and MBCO were removed from the standard’s own definitions; they now sit in the ISO 22300 vocabulary and are referred to in explanatory notes. In Europe the standard has been adopted as EN ISO 22301, published in the Netherlands as NEN-EN-ISO 22301.
🧱 How is ISO 22301 structured?
ISO 22301 follows the ten clauses of the harmonised structure for management systems. Clauses 4 to 10 contain the requirements and follow the PDCA cycle. The actual continuity work sits in clause 8:
| Clause | Subject | What it asks for in practice |
|---|---|---|
| 8.1 | Operational planning and control | Plan, implement and control processes, including outsourced ones |
| 8.2 | Business impact analysis and risk assessment | Set priorities, recovery times and dependencies; assess the risks of disruption |
| 8.3 | Strategies and solutions | Choose how to protect, continue and recover processes, including the resources needed |
| 8.4 | Plans and procedures | A response structure with teams, warning and communication, plus continuity and recovery plans |
| 8.5 | Exercise programme | Exercise realistic scenarios at planned intervals and after significant changes |
| 8.6 | Evaluation | Assess documentation and capabilities, including those of partners and suppliers |
Around this the standard requires what every management system requires: context and interested parties (4), top management commitment and policy (5), planning of actions to address risks and opportunities, and objectives (6), resources, competence and documentation (7), monitoring, internal audits and management review (9) and continual improvement (10). Leadership and the assignment of roles tie in with the wider governance of the organisation.
🧠 What does an organisation actually have to do?
The core of ISO 22301 is a chain of four steps that build on each other:
- Business Impact Analysis (BIA) - determine for each process how the damage grows over time and set recovery objectives such as RTO and RPO. Since 2019 the standard explicitly asks you to define impact types and criteria, for example financial, legal, safety and reputational damage, and to assess how that impact develops over time.
- Risk Assessment - map threats and dependencies, from power failure, fire and a pandemic to ransomware and the loss of a supplier. Here the standard ties in with risk management according to ISO 31000.
- Strategies and plans - choose solutions such as redundancy, fallback sites, manual operation or disaster recovery, and document activation, roles and steps in plans. The Incident Response Plan for cyber incidents and the Crisis Communication Plan belong in the same response structure.
- Exercise and evaluate - test plans with a tabletop exercise, a recovery test or a full failover exercise, and record the lessons in a report that feeds into management review.
ISO 22301 does not prescribe a fixed exercise frequency or a minimum recovery time. The organisation sets its own objectives; the auditor checks whether they are justified and whether they are met.
🏭 How do you apply ISO 22301 in OT environments?
The standard is technology-neutral, but in industry and critical infrastructure it takes on a specific form. A production line, pumping station or substation often cannot simply be “restored” from a backup like a server; the physical process must also be shut down and restarted safely.
| OT environment | Typical continuity question | Example measure |
|---|---|---|
| Water authorities, municipalities and drinking water | How long can a treatment plant, pumping station or traffic control system run without central control? | Local automatic operation, manual control and trained on-call teams |
| Manufacturing and process industry | Which lines are critical and how quickly must a PLC program be restored? | Up-to-date offline backups of PLC and SCADA configurations, spare hardware |
| Energy infrastructure | How is the grid restored safely when control fails? | Restoration procedures, redundant links, emergency power via UPS |
| Healthcare and buildings | Do climate control, medical gases and security keep working? | Fallback locations, maintenance contracts with response times |
During a cyberattack on the office network, the key question is whether production can keep running. In 2021 Colonial Pipeline shut down its pipeline as a precaution, even though only the IT network had been hit. A well-developed BIA and network segmentation between IT and OT turn that decision into a reasoned choice rather than a forced one. You take the technical requirements for that segmentation and recoverability from IEC 62443; ISO 22301 provides the management framework around them.
🔄 How does ISO 22301 relate to other standards and laws?
| Standard or law | Focus | Relation to ISO 22301 |
|---|---|---|
| ISO 27001 | Information security (ISMS) | Same structure; controls A.5.29 and A.5.30 cover information security during disruption and ICT readiness |
| IEC 62443 | OT security | Provides technical requirements for zones, backup and recovery of control systems |
| ISO 31000 | Risk management | Guideline for the risk process that returns in clause 8.2 |
| BIO | Dutch government information security | Based on ISO 27001/27002; continuity through those controls, not through ISO 22301 |
| ISO 9001 | Quality management | Same clause layout; easy to integrate |
| NIS2 and the Cybersecurity Act | Legal duty of care | Require business continuity, backup management, recovery and crisis management |
ISO 22301 itself is not mandatory anywhere by law. Business continuity has, however, been a legal requirement since 15 August 2026 for organisations within the scope of the Dutch Cybersecurity Act: Article 9 of the Cybersecurity Decree requires recovery procedures, periodically verified backups and a continuity, recovery and crisis plan. A BCMS according to ISO 22301 is a common way to arrange this demonstrably. Critical entities also have resilience obligations under the Wwke.
🧭 How do you implement ISO 22301 step by step?
- Define the scope - which sites, processes and products fall under the BCMS; start with what matters most to customers and regulators.
- Secure management commitment - adopt a continuity policy, appoint an owner (often the CISO or a BCM coordinator) and involve production and OT operations.
- Carry out the BIA - record for each process the maximum tolerable downtime, RTO and RPO, including dependencies on suppliers and IT.
- Assess risks - combine business, physical and cyber risks in a single risk register.
- Choose strategies and write plans - from manual fallback to immutable backups and fallback sites.
- Exercise and evaluate - at least one tabletop and one technical recovery test per year is common practice.
- Get certified - through an accredited certification body.
A certificate is valid for three years. The initial audit has two stages (documentation and readiness, then operation in practice), followed by annual surveillance audits and a recertification audit. A separate specification, ISO/IEC TS 17021-6, sets the competence requirements for BCMS auditors. Organisations that already run a management system for ISO 27001 or ISO 9001 can reuse much of it, such as document control, internal audits and management review.
❓ Frequently asked questions
Is ISO 22301 mandatory?
ISO 22301 is a voluntary standard, not a law. Since 15 August 2026, however, organisations under the Dutch Cybersecurity Act must arrange business continuity, backups and crisis management, and a BCMS according to ISO 22301 is a recognised way to do so demonstrably. Customers, supply chain partners and tenders in critical infrastructure sometimes ask explicitly for ISO 22301 certification.
What is the difference between ISO 22301 and ISO 22313?
ISO 22301 contains the requirements against which an organisation can be certified. ISO 22313:2020 is a guidance document that explains how to meet those requirements, with examples and good practice. Certification against ISO 22313 is not possible.
Which standards belong to the ISO 22301 family?
Around ISO 22301 sit ISO 22300 (vocabulary), ISO 22313 (guidance), ISO/TS 22317 (business impact analysis), ISO/TS 22318 (supply chain continuity) and ISO/TS 22332 (plans and procedures), among others. These documents are supporting; only ISO 22301 is certifiable.
What did the 2024 amendment change in ISO 22301?
The amendment of February 2024 adds climate change to the context analysis of ISO 22301. The organisation must determine whether climate change is a relevant issue and whether interested parties have requirements about it. The same change was made at the same time in dozens of ISO management system standards, including ISO 27001 and ISO 9001.
Can you combine ISO 22301 with ISO 27001?
ISO 22301 and ISO 27001 share the same clause structure, so a single integrated management system with joint audits works well. ISO 27001 focuses on information security, ISO 22301 on continuing all critical processes, including non-digital ones. Many certification bodies offer a combined audit.
How long does an ISO 22301 implementation take?
The lead time of an ISO 22301 implementation depends heavily on the scope; for a mid-sized organisation six months to a year is a common estimate. The BIA and the first exercise programme take the most time, because they need input from production, IT and suppliers. An existing ISO 27001 or ISO 9001 system shortens the lead time, because document control, audits and management review are already in place.
📌 In summary
ISO 22301 is the international, certifiable standard for a Business Continuity Management System: it requires an organisation to use a BIA, risk assessment, plans and exercises to ensure that critical processes withstand a disruption. The current edition is ISO 22301:2019 with the 2024 climate amendment. In IT and OT environments the standard provides the management framework around technical measures from IEC 62443 and helps you meet the continuity requirements of the Dutch Cybersecurity Act demonstrably.