Standards guides / ISO 22301
Business continuityISO 22301:2019 explained
Security and resilience: Business continuity management systems: Requirements
Current edition: ISO 22301:2019, the second edition, published in October 2019. A 2024 amendment adds climate action changes. ISO lists the standard as to be revised, with a new committee draft (ISO/CD 22301) in development. No publication date for a new edition has been announced.
Last reviewed 19 October 2026. Written by DSQA Consultants in our own words. This guide doesn't reproduce the standard.
What ISO 22301 is
ISO 22301 sets out what a business continuity management system (BCMS) needs so that an organisation can prepare for disruption, keep its most important activities running and recover in a planned way.
Edition status
- The 2019 edition replaced ISO 22301:2012.
- The 2024 amendment asks organisations to consider whether climate change is a relevant issue for their context and interested parties.
- A revision is in progress at ISO. Until a new edition is published, ISO 22301:2019 remains the current standard. We'll update this guide when it changes.
Clause-by-clause summary
Like other ISO management system standards, ISO 22301 follows the Harmonized Structure. Clauses 1 to 3 cover scope, references and terms. The requirements are in clauses 4 to 10, summarised below in our own words.
4 Context of the organization
Understand the issues that could disrupt you, the needs of interested parties and any legal or regulatory requirements, and set the scope of the BCMS.
5 Leadership
Top management leads business continuity, sets a policy and assigns clear roles and responsibilities.
6 Planning
Decide which risks and opportunities to address, set business continuity objectives and plan changes to the system.
7 Support
Provide resources, make sure people are competent and aware of their role during a disruption, plan communication and control your documented information.
8 Operation
Carry out a business impact analysis and risk assessment, choose continuity strategies and solutions, set up a response structure, write business continuity plans and exercise them.
9 Performance evaluation
Monitor and measure how well the BCMS works, review your continuity documentation and capabilities, run internal audits and hold management reviews.
10 Improvement
Deal with nonconformities and their causes, and keep improving the BCMS.
Documented information you'll usually need
The standard expects you to keep certain information documented (maintained) or as records (retained). This is our summary of what's commonly expected. Check it against your own copy of the standard, and add anything else your organisation needs to run the system well.
- Scope of the BCMS
- Business continuity policy
- Legal and regulatory requirements that apply
- Business continuity objectives
- Evidence of competence
- Business impact analysis and risk assessment processes and results
- Business continuity strategies and solutions
- Business continuity plans and procedures
- Exercise programme and results
- Results of evaluating business continuity documentation and capabilities
- Results of monitoring and measurement
- Internal audit programme and audit results
- Results of management reviews
- Nonconformities, corrective actions and their results
How certification works
Certification is optional. If you want it, an independent certification body audits your management system and decides whether to issue a certificate. In the UK, check that the certification body holds UKAS accreditation for ISO 22301.
DSQA Consultants isn't a certification body and doesn't issue certificates. Our toolkits and virtual support help you prepare for certification.