Certifiable standard
Global
ISO 22301
ISO 22301: Security and resilience. Business continuity management systems. Requirements
ISO 22301 is the international standard for a business continuity management system (BCMS). It requires an organisation to understand which activities matter most, how quickly they must be restored after a disruption, and to plan, test and improve its response. It is voluntary and certifiable, follows the same structure as ISO 27001, and helps IT and SaaS companies meet customer uptime commitments and continuity requirements in laws such as NIS2 and DORA.
Voluntary: Voluntary; often expected by banks, governments and enterprise customers
Quick facts
- What it covers
- Business impact analysis, risk assessment, continuity strategies and solutions, business continuity plans and procedures, exercising and testing, and continual improvement.
- Who needs it
- IT service providers, data centres, SaaS with uptime SLAs
- Why it matters
- Customers depend on IT and SaaS providers to stay available, and banks, regulators and large buyers increasingly ask for tested continuity plans and evidence.
- Key requirements
- Context, interested parties, legal requirements and BCMS scope
- Leadership commitment, business continuity policy and roles
- Business impact analysis and risk assessment
- Business continuity strategies and solutions
- Business continuity plans and incident response structure
- Exercise programme, evaluation, internal audit and management review
- Where it applies
- Global
- Category
- Business Continuity & Disaster Recovery