Key Facts
- Regulator
- ISO/TC 292 Security and resilience (published by the International Organization for Standardization, ISO). It is an ISO standard, not a joint ISO/IEC one.
- Latest version
- ISO 22301:2019, Edition 2, Security and resilience — Business continuity management systems — Requirements. Amended by ISO 22301:2019/Amd 1:2024 (Climate action changes). Revision under way.
- Effective
- 30 October 2019
- Official text
- www.iso.org ↗
What is ISO 22301?
ISO 22301 is the international standard for business continuity management systems (BCMS): a documented system for guarding against disruptive incidents, making them less likely and recovering when they happen. ISO publishes it through technical committee ISO/TC 292. It is a voluntary standard that any organisation, of any size or sector, can adopt.
The current edition is ISO 22301:2019, Edition 2, Security and resilience — Business continuity management systems — Requirements, dated October 2019. It has been amended once, by ISO 22301:2019/Amd 1:2024 (Climate action changes).
A revision is under way. The ISO page has listed the standard as "to be revised" (stage 90.92) since 5 December 2025, and names ISO/CD 22301 as its replacement, still under development. No publication date is given, so the 2019 edition is the one to cite.
ISO 22301 business continuity management means running continuity as a managed system, with an owner, objectives and a review cycle, rather than a plan written once and filed.
Why it matters
The enterprise questionnaire asks when you last tested your continuity plan. The plan exists. Nobody has run it.
ISO 22301 matters because it turns continuity from a document into a system with an owner, a cycle and evidence. That evidence is what a customer, an auditor or a regulator wants to see when they ask about resilience.
Two pressures bring firms to it:
- Customer and tender requirements. A buyer that depends on your service wants to know you can keep it running. Some ask for ISO 22301 certification, which an independent certification body grants after auditing the BCMS. What they want to see is a working system, not a policy.
- Financial regulation. In the UK, the FCA's operational resilience rules cover similar ground. They do not require ISO 22301, but a BCMS supports the outcomes they ask for.
A continuity plan that has never been exercised is a hope, not a plan.
Who it applies to
In practice, the firms that adopt ISO 22301 are those whose customers depend on them staying available: service providers, financial firms, insurers and technology suppliers. A business whose customers don't rely on its uptime has less reason to.
On obligation: ISO 22301 is voluntary. No UK law or regulator mandates it, so it binds a firm only when the firm chooses to adopt it or a customer writes it into a contract. Check what your own contracts and questionnaires say.
ISO 22301 sits beside ISO 27001 rather than replacing it: ISO 27001 protects information, ISO 22301 keeps the operation running, and ISO says ISO 22301 can be integrated with other ISO management standards, so an ISO 27001 holder can run both in one system. Inside the ISO 27001 vault, the nearest control is A.5.30 ICT readiness for business continuity, which covers only the ICT side of continuity.
The UK position
A UK firm usually meets ISO 22301 in one of two ways.
The first is regulatory. The FCA's operational resilience rules (PS21/3) came into force on 31 March 2022. In-scope firms had to identify their important business services, set impact tolerances for the maximum tolerable disruption, and map and test those services; by 31 March 2025 they had to be able to stay within those tolerances. The rules apply to banks, building societies, insurers, PRA-designated investment firms, and payment and e-money firms, among others. The PRA and Bank of England run a parallel regime for dual-regulated firms and financial market infrastructures.
The second is commercial. UK firms that supply financial entities, including those in the EU that fall under DORA, are often asked how they manage continuity. For a UK firm of 25 to 250 people, the usual first encounter is a customer questionnaire, not a regulator.
Key requirements
ISO 22301 is a paid standard, so this summary follows ISO's public description and does not reproduce the text. Unlike ISO 27001, it has no annex of controls: its requirements describe the management system itself. A BCMS built to it has these parts:
- A documented management system. You plan, set up, run, monitor, review, maintain and keep improving it, in the plan-do-check-act cycle shared by ISO management system standards.
- An understanding of impact and risk. A business impact analysis shows which activities matter most and how fast they must recover; a risk assessment shows what could disrupt them.
- Policy and plans. A business continuity policy sets the direction, and plans say who does what when disruption hits.
- Testing and review. Plans are exercised, the results are reviewed, and the system is improved.
- Fit with other management systems. ISO 22301 can be integrated with other ISO management standards, so it can share governance with an existing ISO 27001 or ISO 9001 system.
Recovery times nobody has agreed with the business are guesses, however precise they look.
What ISO 22313 adds
ISO 22313:2020 is the companion guidance, titled Security and resilience — Business continuity management systems — Guidance on the use of ISO 22301. ISO 22301 says what a BCMS must do; ISO 22313 explains how to read and apply those requirements. ISO sells the two together as a bundle.
Frequently asked questions
Yes, both names point to the same standard, but ISO/IEC 22301 is a misnaming found in older material. ISO publishes ISO 22301 alone, through technical committee ISO/TC 292 Security and resilience. Joint ISO/IEC standards such as ISO/IEC 27001 come from a different committee, JTC 1, which is why the prefix differs.
ISO 22301:2019 is current, with one amendment, ISO 22301:2019/Amd 1:2024, which adds climate action changes. It replaced ISO 22301:2012, now withdrawn. ISO reviews each standard every five years; the review of ISO 22301 that opened in October 2024 ended in a decision to revise it. Until ISO/CD 22301 publishes, cite the 2019 edition.
ISO 22301 is about business continuity management (BCM), not only a business continuity plan (BCP). A BCP is the document people follow during a disruption. ISO 22301 requires a management system around that plan, with impact analysis, risk assessment, exercises and review, so the plan stays accurate as the business changes.
Yes. ISO 22301 sets requirements, so an independent certification body can audit an organisation's BCMS against it and issue a certificate. ISO writes the standard but does not certify anyone itself. ISO 22313, the companion guidance, is not a certification standard; it helps an organisation meet the requirements of ISO 22301.
No. The FCA's operational resilience rules do not require ISO 22301, and ISO 22301 certification does not on its own show that a firm meets them. The rules set their own duties, such as impact tolerances for each important business service. A BCMS built to ISO 22301 gives a firm much of the groundwork, including impact analysis and tested plans.