← Standards
ISO 22301:2019 CertifiableISO
Business continuity management systems — Requirements
The global reference for building, running and certifying a business continuity management system (BCMS). It states what an organisation must have in place — not how — and is the only text in the 223xx family against which an accredited body can issue a certificate.
Official textWho it applies to
- Business continuity managers and CISOs
- Organisations subject to DORA, NIS2 or contractual client requirements
- Internal and external management-system auditors
- Suppliers that must evidence robustness to their clients
Structuring points
- The BCMS scope must be justified: exclusions require an argued rationale
- BIA and risk assessment are two distinct exercises, both mandatory
- Recovery objectives (RTO, RPO, MBCO) are a management decision, not an IT one
- Response procedures must be documented, exercised and maintained
- The exercise programme and performance evaluation close the PDCA loop
Any organisation, regardless of size, sector or location. It follows the Harmonized Structure (Annex SL) shared with ISO 9001, ISO 14001 and ISO/IEC 27001, which makes integrating management systems straightforward.