What is ISO 22301?
ISO 22301 is the international standard for business continuity management systems (BCMS). It sets out how an organisation identifies its critical activities, analyses the impact of disruptions, defines recovery objectives and puts in place plans, resources and an incident response structure so that it can keep operating when something goes wrong.
The current edition, ISO 22301:2019, follows the same high-level structure (clauses 4–10) as ISO 27001 and ISO 9001, so a BCMS can be integrated with existing management systems. Certification is issued by an accredited certification body after a two-stage audit and is valid for three years with annual surveillance audits.
Who needs ISO 22301 certification?
- Banks, fintech companies and insurers, where DORA and NIS2 expect documented continuity and recovery capabilities
- Data centres, SaaS providers and hosting companies whose customers depend on their availability
- Logistics companies and manufacturers in critical supply chains
- Suppliers to the public sector and critical infrastructure operators
- Any organisation that needs to prove to customers, regulators or insurers that it can recover from a disruption within agreed timeframes
What the ISO 22301 self-assessment checks
- Context, interested parties, legal requirements and BCMS scope (clause 4)
- Leadership, business continuity policy, roles and responsibilities (clause 5)
- Business impact analysis (BIA), risk assessment, RTO and RPO for critical activities (clauses 6 and 8)
- Business continuity strategies and solutions, plans and procedures, incident response structure, warning and communication (clause 8)
- Exercising and testing programme and evaluation of the plans (clauses 8–9)
- Performance monitoring, internal audit, management review and improvement (clauses 9–10)
Typical gaps before an ISO 22301 audit
- No business impact analysis, or one that is several years old and no longer reflects the business
- Recovery time objectives (RTO) and recovery point objectives (RPO) are not defined or not agreed with the business
- Continuity plans exist on paper but have never been exercised
- The continuity of key suppliers and outsourced services has not been assessed
- No crisis communication plan for staff, customers, regulators and the media
From self-assessment to certification
The self-assessment shows where you stand today. Use the gap report to plan the work, update your BIA and plans, run exercises, and then rehearse the audit interview in the BALTUM AI audit simulator. The certification itself is carried out by an accredited certification body of your choice. BALTUM is independent software and does not issue certificates.