ISO 22301 is the international standard for a Business Continuity Management System (BCMS) — a structured approach to making sure an organisation can keep delivering its critical products and services (or recover them quickly) when something disrupts normal operations, whether that's a cyberattack, a natural disaster, a key supplier failing, or the loss of a critical facility.
It shares a structure with ISO 27001 by design
Like ISO 27001, ISO 22301 follows ISO's High-Level Structure (Annex SL) — the same overall clause numbering and management-system approach (context, leadership, planning, support, operation, performance evaluation, improvement) shared across modern ISO management system standards. This is deliberate: an organisation already running an ISO 27001-certified ISMS can integrate a BCMS alongside it far more easily than if the two standards were built from unrelated templates.
Step 1: Understand the organisation and its critical activities
Before building any continuity plan, you need a clear picture of which activities are actually critical to delivering your products and services, and what depends on them — people, technology, facilities, suppliers, and information. This isn't a generic risk register; it's specifically about understanding what the organisation cannot afford to lose without unacceptable consequences.
Step 2: Conduct a Business Impact Analysis (BIA)
The Business Impact Analysis is the engine of the whole BCMS. For each critical activity, it identifies the impact of disruption over time (financial, reputational, regulatory, and operational) and derives two key targets:
- Recovery Time Objective (RTO) — the maximum acceptable time before a critical activity must be resumed after a disruption.
- Recovery Point Objective (RPO) — the maximum acceptable amount of data loss, measured in time (e.g. "no more than 4 hours of data").
Step 3: Run a continuity-focused risk assessment
Alongside the BIA, ISO 22301 requires assessing the risks that could cause a disruption to critical activities — this is distinct from (though it can be integrated with) a security-focused risk assessment like the one ISO 27001 requires, since business continuity risk includes things like supplier failure, facility loss, or key-person dependency that aren't purely information security concerns.
Step 4: Design continuity strategies and solutions
With RTOs, RPOs, and risks identified, the organisation selects strategies to meet them — alternative work locations, backup systems and data replication, cross-training staff so no single person is a single point of failure, and alternative suppliers or manual workarounds for critical processes. The strategy has to actually be capable of meeting the recovery targets set in the BIA, not just exist on paper.
Step 5: Document business continuity plans
The strategies get turned into concrete, actionable plans — who does what, in what order, with what information and access, during an actual disruption. A good continuity plan reads like an instruction manual for a stressed, time-pressured team, not a policy document explaining continuity theory.
Step 6: Exercise and test the plans — this is where most programs fail
This is the single most common gap auditors find: a well-written plan that has never actually been tested. ISO 22301 requires exercising continuity plans, ranging from tabletop discussions (walking through a scenario verbally) to full simulations (actually failing over to a backup system or relocating a team). An exercise that surfaces problems and feeds them back into the plan is far more valuable than one that goes smoothly — untested plans routinely fail on details nobody thought to document, like who actually holds the credentials needed to execute step three.
Step 7: Certification and ongoing maintenance
Like ISO 27001, formal certification against ISO 22301 involves an external audit by an accredited certification body, followed by periodic surveillance audits and recertification on a multi-year cycle. Because the risk landscape and the business itself change constantly, the BIA, risk assessment, and plans all need to be reviewed and updated on a regular schedule — a continuity plan that reflects last year's org chart and supplier list is a liability, not an asset.
This guide is general information, not a substitute for guidance from an accredited certification body — specific requirements and audit expectations can vary by certifier and by your organisation's scope.
Keeping the BIA and plans from going stale
The hardest part of maintaining a BCMS isn't writing the first version of the plan — it's keeping the BIA, risk assessment, and exercise records current as the business changes. ComplianceDesk's ISO 22301 framework gives you the standard's controls pre-built and trackable, with an evidence vault for exercise records and reminders before a scheduled review or test falls overdue.