ISO 22301 is the international standard that sets out requirements for a business continuity management system, enabling an organization to prepare for, respond to and recover from disruption to its products and services. It is produced by ISO/TC 292, the ISO technical committee for security and resilience, whose scope begins: "Standardization in the field of security to enhance the safety and resilience of society" (ISO, no date).
Standards Academy teaches ISO 22301 as a governance obligation as well as a management system. ISO 37000, written in ISO/TC 309/WG 1 under the convenorship of Standards Academy's director, makes the governing body responsible for ensuring that the organization remains viable and performs over time (ISO, 2021b, Clause 6.11). Business continuity is one of the means by which management gives effect to that responsibility.
The current edition is ISO 22301:2019, amended in 2024 to include climate action changes. On 23 October 2026 the ISO/TC 292 committee page listed 69 published standards and 16 under development, a count that includes updates to existing documents (ISO, no date). This article explains what the standard requires of an organization, how business impact analysis and recovery objectives work, how the standard sits alongside operational resilience expectations, and which PECB credential fits which continuity role.
Scope and purpose of ISO 22301
ISO 22301:2019, titled Security and resilience, Business continuity management systems, Requirements, is intended to be applicable to all organizations, or parts thereof, regardless of type, size and nature (ISO, 2019, Clause 1). Its purpose is practical: to help an organization identify threats and the impacts of disruption, protect its prioritized activities, reduce the likelihood and consequences of disruptive incidents, and maintain or restore the delivery of products and services within agreed timeframes. Because it is a requirements standard, an organization can be audited against it and certified by an accredited certification body.
Business continuity extends beyond the recovery of information technology. The standard is concerned with the continued delivery of products and services as a whole; people, premises, suppliers, processes and information all fall within the analysis.
Two companion documents support the requirements. ISO 22313:2020 provides guidance on the use of ISO 22301, expanding each requirement with explanation and examples (ISO, 2020). ISO/TS 22317:2021 sets out guidelines for business impact analysis, the method at the centre of the discipline (ISO, 2021a).
The standard is not static. In February 2024, ISO published ISO 22301:2019/Amd 1:2024, Amendment 1: Climate action changes, which adds consideration of climate change to the requirements on organizational context and interested parties (ISO, 2024). A revision is in progress: on 23 October 2026, iso.org showed the 2019 edition at stage 90.92 (to be revised), with ISO/CD 22301 under development at committee stage (30.60). No expected publication date has been given (ISO, 2019). A parallel revision of the guidance document, ISO/AWI 22313, is at the approved new work item stage (10.99).
PECB credentials and training routes for business continuity
Certification to ISO 22301 is organizational. It is granted by an accredited certification body after an audit of the management system, never by PECB and never by Standards Academy. A PECB credential attests the competence of a person to work with the standard, whether building a system, running it or auditing it.
PECB structures its business continuity training around three levels. The Foundation level introduces the concepts of a business continuity management system: policy, leadership, audit, management review and continual improvement. The Lead Implementer level develops the capability to design, carry out, operate and improve a system that conforms to ISO 22301. The Lead Auditor level prepares a professional to plan and conduct audits of such a system and to report conformity findings.
The right credential depends on the role the person holds. A coordinator who supports a continuity programme needs a working grasp of the vocabulary and structure; the person accountable for building the system needs implementation depth; an auditor needs audit method. The table below maps role to credential and course.
| Role | Credential | Course | Formats |
|---|---|---|---|
| Continuity coordinator, process owner or team member supporting a BCMS | PECB Certified ISO 22301 Foundation | ISO 22301 Foundation | eLearning |
| Business continuity manager responsible for designing and operating a BCMS | PECB Certified ISO 22301 Lead Implementer | ISO 22301 Lead Implementer | eLearning |
| Internal or third-party auditor assessing BCMS conformity | PECB Certified ISO 22301 Lead Auditor | ISO 22301 Lead Auditor | eLearning |
Organizations and roles within scope
ISO 22301 was written to be sector-neutral, and adoption reflects that. Public bodies, private companies, charities, manufacturers, financial institutions, healthcare providers and operators of critical infrastructure all certify against the same requirements. What varies is the driver. A hospital pursues ISO 22301 certification because interruption endangers patients; a payments firm pursues it because regulators expect demonstrable continuity capability; a manufacturer pursues it because a single supplier failure can halt a production line for weeks.
Within an organization, several roles interact with the management system:
Top management and governing bodies, who set the business continuity policy, allocate resources and remain accountable for the system's effectiveness.
Business continuity managers and coordinators, who run the programme day to day, maintaining the business impact analysis, keeping plans current and organizing exercises.
Risk, compliance, security and crisis-management teams, whose work feeds into and draws from the continuity analysis.
Process owners and department heads, who identify prioritized activities in their areas and validate recovery requirements.
Internal auditors, who assess whether the system conforms to the standard and to the organization's own arrangements.
Employees, suppliers and other interested parties named in continuity arrangements, who know their part when disruption occurs.
This breadth explains why business continuity training is rarely confined to a single job title. The decision table in the previous section maps each of these roles to the appropriate credential.
Requirements of a business continuity management system
ISO 22301 follows the harmonized structure common to ISO management system standards, which means its clauses mirror those of standards such as ISO 9001 and ISO/IEC 27001. That alignment allows an organization to integrate business continuity with existing management systems.
The requirements follow the clause sequence of the harmonized structure. The organization first establishes its context: the internal and external issues that affect continuity, the needs of interested parties, and the scope of the system. Amendment 1:2024 added climate change as a consideration at this stage (ISO, 2024). Leadership requirements follow, top management establishes a business continuity policy, assigns responsibilities and provides resources. Planning addresses risks and opportunities to the system itself and sets measurable business continuity objectives. Support covers competence, awareness, communication and documented information.
Clause 8 carries the operational core. After operational planning and control (8.1), it names six elements (ISO, 2019, Clauses 8.2 to 8.6):
Business impact analysis, determining what matters and how quickly it is to return.
Risk assessment, identifying what could cause disruption.
Business continuity strategies and solutions, deciding how prioritized activities will be protected and resumed.
Plans and procedures, documenting response structures, actions and communications.
An exercise programme, testing the arrangements under conditions that approximate real disruption.
Evaluation of business continuity documentation and capabilities, reviewing the arrangements at planned intervals and after incidents.
The cycle closes with performance evaluation, monitoring, internal audit and management review, and improvement, through corrective action and continual refinement. Certification auditors from an accredited body assess conformity across all of these clauses. A system strong on documentation but weak on exercising will not withstand that scrutiny. Guidance in ISO 22313:2020 explains how each requirement can be met in practice (ISO, 2020).
Business impact analysis, risk assessment and continuity strategies
The business impact analysis is the foundation of a continuity programme. It determines the organization's products and services, the prioritized activities that deliver them, the maximum tolerable period of disruption for each, and the recovery objectives that follow. ISO/TS 22317:2021 provides the method: guidelines for planning, conducting and maintaining a business impact analysis, including how to gather information from process owners and how to analyse impacts over time (ISO, 2021a).
Two terms anchor the analysis. The maximum tolerable period of disruption is the time it would take for the adverse impacts of not providing a product or service, or not performing an activity, to become unacceptable (ISO, 2019, Clause 3). The recovery time objective is the period of time following an incident within which a product or service or an activity is resumed, or resources are recovered (ISO, 2019, Clause 3). The organization sets the recovery time objective within the maximum tolerable period of disruption, so that the target carries a margin.
Risk assessment complements the impact analysis by identifying the threats and vulnerabilities that could cause disruption, together with their likelihood and consequences. Where the impact analysis asks what would hurt and how fast, the risk assessment asks what could cause it.
From these two inputs, the organization selects continuity strategies and solutions proportionate to the recovery objectives. Common solutions include alternative facilities, backup technology and data recovery, remote working arrangements, manual workarounds, alternate suppliers and pre-agreed emergency communications. A three-day recovery time objective might justify a reciprocal arrangement with another site; a four-hour objective demands standing capacity. The analysis disciplines the spending: without defined objectives, continuity investment has no basis for prioritization.
Relationship with operational resilience, ISO 31000 and ISO 28000
Operational resilience, as the term is used by financial regulators, is wider than business continuity. It concerns an organization's ability to keep delivering its important services through severe disruption, taking in third-party risk, technology dependence and communication with authorities. A certified business continuity management system is one component of operational resilience. The Digital Operational Resilience Act is the regulatory example: it imposes obligations on financial entities in the European Union that extend well beyond what ISO 22301 certification alone demonstrates, although a functioning BCMS supplies much of the underlying evidence.
ISO 31000 provides general principles and guidance for risk management across an organization. ISO 22301 applies risk-based thinking to one specific problem, disruption to products and services, so the two fit together naturally: ISO 31000 shapes how risk is assessed, and ISO 22301 dictates what the continuity-specific assessment produces.
ISO 28000 addresses security management systems for the supply chain. Because supplier failure is among the most common causes of disruption, ISO 28000 complements ISO 22301 by strengthening the supplier, logistics and transport controls on which continuity strategies often depend.
A certified business continuity management system is a credible, auditable answer to resilience expectations, and the governing body's oversight of viability over time under ISO 37000 is the level at which that answer is judged. The organization certifies through an accredited certification body; the professionals who build and audit that system evidence their competence through PECB credentials, selected against the decision table above. Standards Academy teaches both levels together. The 2019 edition remains the certifiable text, with Amendment 1:2024 incorporated and ISO/CD 22301 in development with no announced date, so there is no reason to wait for a future edition before acting.
Frequently asked questions
What does ISO 22301 require of an organization?
ISO 22301 requires an organization to establish, carry out, maintain and improve a business continuity management system. This includes defining context and scope, demonstrating leadership, conducting business impact analysis and risk assessment, selecting continuity strategies, documenting plans, running an exercise programme, and evaluating performance through audit and management review (ISO, 2019).
What is a business impact analysis?
A business impact analysis determines an organization's products and services, the prioritized activities that deliver them, and the effects of disruption over time. It establishes the maximum tolerable period of disruption and the recovery objectives for each activity. ISO/TS 22317:2021 provides guidelines for conducting and maintaining the analysis (ISO, 2021a).
What is the difference between the maximum tolerable period of disruption and the recovery time objective?
The maximum tolerable period of disruption is the point after which the impacts of not delivering a product or service become unacceptable. The recovery time objective is the planned target for resuming an activity, set within that maximum. One is a limit; the other is a target with deliberate margin.
Is ISO 22301 the same as operational resilience?
No. Operational resilience, as financial regulators use the term, is wider: it covers continued delivery of important services through severe disruption, including third-party and technology risk. A certified business continuity management system is one component of operational resilience. The Digital Operational Resilience Act illustrates the broader regulatory expectation.
Which credential suits a continuity coordinator and which an auditor?
A continuity coordinator or team member supporting a BCMS suits the Foundation credential, which covers concepts, policy and continual improvement. An auditor assessing conformity needs the Lead Auditor credential, which covers audit planning, conduct and reporting. The professional building and operating the system needs the Lead Implementer credential.
Who certifies an organization to ISO 22301?
An accredited certification body certifies an organization to ISO 22301 after auditing its business continuity management system against the standard. Neither PECB nor Standards Academy certifies organizations. PECB credentials attest the competence of individual professionals who carry out or audit such systems. The two forms of certification are distinct.
References
International Organization for Standardization (2019) ISO 22301:2019 Security and resilience. Business continuity management systems. Requirements. Geneva: ISO. Available at: https://www.iso.org/standard/75106.html (Accessed: 23 October 2026).
International Organization for Standardization (2020) ISO 22313:2020 Security and resilience. Business continuity management systems. Guidance on the use of ISO 22301. Geneva: ISO. Available at: https://www.iso.org/standard/75107.html (Accessed: 23 October 2026).
International Organization for Standardization (2021a) ISO/TS 22317:2021 Security and resilience. Business continuity management systems. Guidelines for business impact analysis. Geneva: ISO. Available at: https://www.iso.org/standard/79000.html (Accessed: 23 October 2026).
International Organization for Standardization (2021b) ISO 37000:2021 Governance of organizations. Guidance. Geneva: ISO. Available at: https://www.iso.org/standard/65036.html (Accessed: 23 October 2026).
International Organization for Standardization (2024) ISO 22301:2019/Amd 1:2024 Security and resilience. Business continuity management systems. Requirements. Amendment 1: Climate action changes. Geneva: ISO. Available at: https://www.iso.org/standard/88412.html (Accessed: 23 October 2026).
International Organization for Standardization (no date) ISO/TC 292 Security and resilience. Available at: https://www.iso.org/committee/5259148.html (Accessed: 23 October 2026).
