Build an ISO 22301 business continuity programme that stands up

ISO 22301 is the international standard for business continuity management systems. Published by ISO, its current edition is ISO 22301:2019, which replaced the 2012 version and was amended in 2024 to address climate change. It sets out how an organisation should understand its context, analyse the impact of disruption, choose continuity strategies, write and exercise plans, and keep improving, and it can be certified by an accredited certification body.

No, ISO 22301 is a voluntary standard and no law requires certification on its own. In practice it is often expected by customers, public sector buyers and partners who rely on your services, and it can help demonstrate resilience to regulators. Many organisations adopt it because a contract or tender asks for evidence of a certified or aligned business continuity programme.

The main requirements sit in clauses 4 to 10. They cover context and scope, leadership and policy, planning and objectives, support such as competence and documented information, and operation, which includes business impact analysis, risk assessment, continuity strategies and solutions, plans and procedures, an exercise programme and evaluation. Clauses 9 and 10 require monitoring, internal audit, management review, corrective action and continual improvement.

ISO 22301 and ISO 27001 share the same high level management system structure, so clauses on context, leadership, internal audit and management review align closely. ISO 27001 focuses on information security, while ISO 22301 covers the continuity of all prioritised activities. Many organisations run both as an integrated management system, reusing policies, risk processes and evidence across the two.

You get ISO 22301 certified by implementing a business continuity management system that meets clauses 4 to 10, running internal audits and a management review, then passing an audit by an accredited certification body. Certification is typically maintained through periodic surveillance audits and a recertification audit. You should choose a certification body accredited by a recognised body, such as UKAS in the UK.

A business impact analysis is the process ISO 22301 requires in clause 8.2.2 to understand how disruption would affect your activities over time. It identifies the activities that support your products and services, assesses impacts, sets prioritised timeframes for resuming them, and identifies the dependencies and resources they need. Its results drive the continuity strategies and plans in the rest of clause 8.

There is no fixed timeframe for ISO 22301. It depends on your size, how many sites and services are in scope, and how mature your existing continuity and risk processes are. Organisations that already run ISO 27001 often move faster because the management system clauses and many controls are already in place, leaving the business impact analysis, plans and exercises as the main new work.

Yes. OneClickComply supports ISO 22301 today, and your existing controls, policies and evidence for frameworks such as ISO 27001 can count towards it. The risk register, policy generation and our audit team help you build your business continuity records. OneClickComply does not issue certificates, which come from an independent accredited certification body.