ISO 22301:2019 Business Continuity Management System
ISO 22301 replaces the untested continuity binder with something better: a business impact analysis that sets real recovery targets, and exercises that prove you can meet them.
4.9/5 average client rating · 500+ engagements delivered
What the standard requires
The business impact analysis is the foundation: for every prioritised activity you determine the impact of disruption over time, the maximum tolerable period of disruption, and from that the recovery time and recovery point objectives that your strategies must meet.
Plans alone are not enough. ISO 22301 requires an incident response structure with defined authority, and an exercise and testing programme that validates the plans and feeds improvements back into them.
- Business impact analysis identifying prioritised activities, dependencies and tolerable outage windows
- Risk assessment of disruption scenarios affecting those activities
- Continuity strategies covering people, premises, technology, information, suppliers and stakeholders
- Incident response structure with activation criteria, authority levels and escalation
- Business continuity and recovery plans, plus communication plans for staff, customers and regulators
- Exercise and testing programme with documented outcomes and improvement actions
Key facts
| Standard | ISO 22301:2019 |
|---|---|
| Core artefacts | Business impact analysis, risk assessment, continuity strategies, plans and exercise reports |
| Key metrics | MTPD, RTO, RPO and minimum business continuity objective |
| Typical timeline | 10–16 weeks including a live exercise |
| Integrates with | ISO 27001 (A.5.29–A.5.30), ISO 20000-1, ISO 9001 |
What we deliver
We start from what the business cannot afford to lose, then work backwards to the technical recovery capability required.
Business impact analysis
Activity-level impact over time, dependency mapping, MTPD and derived RTO/RPO agreed with process owners.
Threat & risk assessment
Disruption scenarios across cyber, infrastructure, people, supplier and natural hazards, with likelihood and impact.
Strategy selection
Options analysis and cost-benefit for redundancy, alternate sites, work-from-anywhere, supplier diversification and DR architecture.
Plans & playbooks
Incident response, business continuity, IT disaster recovery and crisis communication plans in a usable format.
Exercise programme
Tabletop, walkthrough, technical failover and full simulation exercises with objective evaluation criteria.
Governance
Performance evaluation, internal audit, management review and continual improvement of the BCMS.
Who needs BCMS certification
Organisations whose downtime has contractual, regulatory or safety consequences — and those whose customers now ask for continuity evidence during due diligence.
- Banks, NBFCs, insurers and payment operators with regulatory continuity mandates
- IT and BPO providers with contractual RTO commitments in client SLAs
- Data centres, cloud and managed service providers
- Manufacturing and logistics operations with single-site or single-supplier dependencies
- Healthcare, utilities and transport operators delivering essential services
Recovery you can prove
Tested RTOs replace optimistic assumptions — most first exercises reveal a gap worth knowing about early.
Contractual credibility
Answers customer and regulator continuity questionnaires with evidence rather than intent.
Ransomware readiness
BIA-driven RPOs force the backup and isolation design that actually survives an encryption event.
Shared with ISO 27001
Continuity controls in Annex A are satisfied by the same BCMS, avoiding duplicate work.
How the engagement runs
Scope & BIA
Prioritised activities, dependencies, impact over time and agreed recovery objectives signed off by business owners.
Risk & strategy
Scenario risk assessment and strategy options appraisal with investment recommendations.
Plan development
Response structure, continuity and DR plans, call trees and communication templates.
Exercise & validate
Tabletop and technical exercises, gap closure and plan revision based on measured results.
Certification
Internal audit, management review and certification body audit support.
What you receive
- BCMS scope, policy and governance structure
- Business impact analysis with MTPD, RTO and RPO per activity
- Disruption risk assessment and treatment plan
- Continuity strategy options appraisal and selected strategy rationale
- Incident response, business continuity, IT DR and crisis communication plans
- Exercise programme, exercise reports and improvement actions
- Internal audit, management review and certification support
ISO 22301 — frequently asked questions
A business continuity plan is one output. ISO 22301 is the management system that determines what needs protecting and to what target, selects strategies, maintains plans, exercises them and improves. Plans without a BIA behind them tend to protect the wrong things.
The standard requires exercising at planned intervals appropriate to the organisation. In practice: tabletop exercises at least annually per critical activity, technical failover tests annually for critical systems, and a full simulation every one to two years. Certification auditors will ask to see recent exercise reports.
No. Disaster recovery is the technology component — restoring systems and data. Business continuity covers people, premises, suppliers, communications and process workarounds. Many organisations have solid DR and no continuity capability at all.
Yes. The scope is defined by you and stated on the certificate, but it must be coherent — a scope that excludes dependencies of the included activities will be challenged. We help you draw a boundary that is both affordable and defensible.
Materially. Ransomware is now the most common continuity trigger, and the BIA-derived RPO usually exposes that backup frequency and isolation are inadequate. Running ISO 22301 alongside ISO 27001 gives you both the prevention and the recovery side of the same scenario.
Still not sure what applies to you?
Ask an assessor directly — we answer scoping questions before anyone talks about a fee.
Get a realistic timeline and a fixed fee
A 30-minute call is usually enough to scope ISO 22301 accurately. You will leave with a timeline, an evidence checklist and a number — whether or not you engage us.