2019
Current edition
Second edition, published October 2019, amended in 2024. A new edition is in development.
ISO 22301 explained
The business continuity standard, in plain English, and where it stops.
What ISO 22301 is, what each part of it asks you to do, how certification works, and why regulators in Australia and the UK ask for more than the standard does.
What is ISO 22301?
ISO 22301 is the international standard for a business continuity management system: how an organisation prepares for disruption, responds to it, recovers, and keeps improving how it does all three.
Audit
Certifiable
Accredited certification bodies audit organisations against it.
Choice
Voluntary
Neither APRA's CPS 230 nor the FCA's PS21/3 mentions it.
What does ISO 22301 actually cover?
ISO 22301:2019 sets out the requirements for a business continuity management system. A management system is the machinery around continuity that keeps running between incidents: who owns it, how priorities are set, how plans are written and tested, and how the whole thing is reviewed and improved over time.
The current edition is the second, published in October 2019, and it replaced the 2012 edition. A 2024 amendment added climate action changes, and ISO lists the standard as due for revision, with a new edition in development. In Australia, Standards Australia publishes it as AS ISO 22301:2020, amended in March 2025.
It is written for any type of organisation, whatever its size or sector. The standard says what must be in place; its companion, ISO 22313:2020, gives guidance on how to apply it. For the discipline itself, in plain terms, start with the business continuity guide.
What does ISO 22301 require?
Clauses 1 to 3 set out the scope, references and definitions. Clauses 4 to 10 hold the requirements: each card gives what the clause asks for, and what that looks like once it is working.
Clause 4: Context of the organisation
Understand the organisation, its obligations and the people with a stake in it, and set the scope of the management system.
In practice: A written scope that names the services, sites and obligations the system covers, and the ones it leaves out on purpose.
Clause 5: Leadership
Top management commits to the system, sets a business continuity policy, and assigns roles, responsibilities and authority.
In practice: A signed policy and named owners who can act and spend money during a disruption.
Clause 6: Planning
Address the risks and opportunities facing the management system, and set business continuity objectives with a plan to meet them.
In practice: Objectives you can measure, with an owner and a date against each.
Clause 7: Support
Provide the resources, competence, awareness, communication and documented information the system needs.
In practice: Trained people, a communication plan, and records an auditor can find on the first request.
Clause 8: Operation
The core of the standard: business impact analysis and risk assessment (8.2), strategies and solutions (8.3), plans and procedures (8.4), an exercise programme (8.5), and evaluation of documentation and capabilities (8.6).
In practice: An impact analysis that sets priorities and recovery times, plans that set out the response, and exercises that show the plans work.
Clause 9: Performance evaluation
Monitor, measure and evaluate the system, run internal audits at planned intervals, and hold management reviews.
In practice: An audit programme on a calendar, and review minutes that record the decisions made.
Clause 10: Improvement
Deal with nonconformities, take corrective action, and keep improving the system.
In practice: A log of what went wrong in tests and incidents, what changed as a result, and who closed it.
See what a business continuity plan must contain
Business continuity plan guide
Clause 8.4 asks for documented plans and procedures. The plan guide sets out the ten sections a plan needs, and the question an auditor or regulator asks of each.
How do ISO 22301, a business continuity plan and a management system fit together?
The plan is one output of the management system. Clause 8.4 asks for plans and procedures; the rest of the standard asks for everything that keeps them true: an impact analysis that sets priorities, a strategy that decides how each priority recovers, exercises that test the plan, and reviews that change it when the organisation changes.
That is why an organisation can hold a well-written plan and still fall short at audit. The document exists, but nothing around it shows that it is owned, tested or current. The plan guide covers the document; the business continuity guide covers the discipline around it.
Is ISO 22301 a legal requirement?
No. ISO 22301 is a voluntary standard. Organisations adopt it, and some go on to certification, by choice.
In regulated financial services the obligations come from the regulator instead: APRA's CPS 230 in Australia and the FCA's operational resilience rules, set out in PS21/3, in the UK. Neither mentions ISO 22301. Outside regulated sectors, a customer or a contract may ask for it, which is often what starts the work.
How do you get ISO 22301 certified?
You build and run the management system first. An independent certification body then audits it against the standard, and keeping the certificate means periodic reassessments after that.
The audit looks for evidence that the system works, not that it was written: a defined scope, an impact analysis and risk assessment, documented plans, exercises that have run and been reviewed, internal audits and management reviews.
Check the certification body's accreditation before you engage it. In the UK, UKAS accredits certification bodies, which are assessed against ISO/IEC 17021-1, the standard for bodies that audit and certify management systems. In Australia, ask the body for its accreditation and check it independently.
Certification shows the management system is in place. For regulated firms it is one part of the picture: see where ISO 22301 stops and what the regulators add.
Does CPS 230 or PS21/3 ask for ISO 22301?
Two regulators, their own rules
Neither mentions ISO 22301. Each sets its own expectations for critical services, tolerances and testing, and each page sets out what its regulator asks for.
Where ISO 22301 stops and operational resilience begins
ISO 22301 looks at disruption from the organisation's side. Its impact analysis asks when not resuming an activity would harm the organisation, and sets recovery times from there. Operational resilience rules start from the outside and ask more of you:
- Whose harm counts. The FCA defines an impact tolerance as the first point at which disruption to an important business service would cause intolerable harm to consumers or risk to market integrity. APRA expects entities to keep critical operations within tolerance levels through severe disruptions.
- Who signs off. Under CPS 230 the board approves the business continuity plan and the tolerance levels for disruptions to critical operations.
- How hard you test. CPS 230 requires a systematic testing program covering all critical operations, with an annual business continuity exercise and a range of severe but plausible scenarios, including disruption at material service providers.
- What you map. PS21/3 asks firms to identify and document the people, processes, technology, facilities and information behind each important business service.
- When it applies. CPS 230 has applied since 1 July 2025. Under PS21/3, firms had to be able to stay within their impact tolerances by 31 March 2025.
A working ISO 22301 system gives a firm a strong base for both regimes, and the regulators' additional expectations still need evidence of their own. The impact tolerance and important business services guides explain the UK terms, and the operational resilience guide covers the wider picture.
Take continuity further with operational resilience
ISO 22301 gives business continuity a structure. Operational resilience asks a harder question: can your most important services stay within tolerance through severe disruption, and can you prove it?
RunReady, Drova's operational resilience solution, maps your critical services and their dependencies, runs scenario tests against your tolerances, and keeps continuity plans and recovery workflows beside the evidence they rest on, aligned to APRA CPS 230 and the FCA's PS21/3. See how RunReady works.
The plan guide sets out what a business continuity plan must contain, section by section.
Start with the plan the standard asks for
ISO 22301, answered
What is the latest version of ISO 22301?
ISO 22301:2019, the second edition, published in October 2019. A 2024 amendment added climate action changes. ISO lists the standard as due for revision, and a new edition is in development. In Australia it is published as AS ISO 22301:2020, amended in March 2025.
What is the difference between ISO 22301 and ISO 22313?
ISO 22301 sets out the requirements an organisation is audited against. ISO 22313:2020 is guidance on the use of ISO 22301: it explains how to meet the requirements rather than adding new ones.
How does ISO 22301 relate to ISO 27001?
Both are ISO management system standards built on Annex SL, the shared clause structure, so they have the same clauses for context, leadership, planning, support, performance evaluation and improvement. ISO/IEC 27001 covers information security; ISO 22301 covers business continuity. Organisations running both can share the common parts.
Does APRA CPS 230 require ISO 22301?
No. CPS 230 does not mention ISO 22301. It sets its own requirements: critical operations, tolerance levels approved by the board, a credible business continuity plan, a testing program with an annual business continuity exercise, and management of material service providers. The CPS 230 page sets them out.
Does the FCA's PS21/3 require ISO 22301?
No. PS21/3 does not mention ISO 22301. It asks firms to identify important business services, set impact tolerances, map the resources behind each service, test against severe but plausible scenarios and keep a self-assessment. The PS21/3 page sets them out.
What does clause 8.2 of ISO 22301 ask for?
Business impact analysis and risk assessment. The impact analysis prioritises activities, assesses how impacts grow over time, identifies the point at which not resuming an activity would harm the organisation (the maximum tolerable period of disruption) and when it must resume (the recovery time objective), and identifies the resources and dependencies each activity needs. The risk assessment identifies, analyses and evaluates the risks to those activities.
Is ISO 22301 only for large organisations?
No. Any type of organisation can implement it, whatever its size or maturity. A small organisation can run a proportionate system, scoped to the services that matter most.
How often is ISO 22301 reviewed?
ISO reviews its standards every five years. ISO 22301:2019 is currently marked for revision, and a new edition is in development.
Operational resilience hub
Explore related topics
Business continuity guide
What business continuity is and how the discipline works.
Business continuity plan
The ten sections a plan must contain.
Impact tolerance
Set the limit a service must not cross.
Important business services
Decide which services the rules apply to.
APRA CPS 230
What CPS 230 asks of Australian entities.
FCA PS21/3
What PS21/3 asks of UK firms.
Operational resilience
Where continuity sits in the wider picture.
