Framework Cross-Industry Management Systems
ISO 22301 is the international standard for a business continuity management system (BCMS). It asks an organization to work out which products and services matter most, how quickly each must be recovered, what resources that depends on, and then to build, exercise, and maintain plans that make recovery achievable. The current edition is ISO 22301:2019.
A revision is under way in ISO/TC 292; a committee draft was registered in March 2026, so a new edition is expected but not yet published (verify status before citing a date).
On paper, the standard expects a BCMS scope and policy, a business impact analysis, a risk assessment, a documented continuity strategy, business continuity plans and procedures (including incident response and communications), an exercise and testing program with results, and the usual management system records: objectives, competence, internal audits, management review, and corrective actions.
Voluntary. Common in financial services, outsourcing and managed service providers, data centers, logistics, and any organization whose customers or regulators ask for evidence of continuity capability. Some sector regulators accept ISO 22301 certification as supporting evidence for their own resilience rules but rarely mandate it outright.
Scope and policy; context and interested parties, including legal and regulatory requirements; business impact analysis with recovery time and recovery point objectives; risk assessment and treatment; continuity strategy and resource requirements; business continuity plans, incident response structure, and communication procedures; exercise and test schedule with post-exercise reports; supplier and outsourcing continuity arrangements; awareness and competence records; performance monitoring; internal audit and management review records; corrective actions.
Where the requirement sits: 5.2 policy; 7.5 documented information; 8.2 BIA; 8.4 BC plans; 8.5 exercise programme
ISO/TC 292 approved a project to revise ISO 22301. The committee draft (ISO/CD 22301) was registered on March 12, 2026 with comments closing May 10, 2026. A companion revision of the guidance standard ISO 22313 has also started.
Until the new edition is published and an accreditation transition period is announced, ISO 22301:2019 remains the certifiable edition.
Controls the BC plans and proves staff acknowledgment.
AllyMatter publishes this site.
Assessors
Accredited certification body accredited to ISO/IEC 17021-1 for business continuity management systems. Accredited by National accreditation bodies under the Global ACI (formerly IAF) multilateral arrangement, such as ANAB, UKAS, DAkkS, JAS-ANZ.
Public register of assessors: https://www.iafcertsearch.org/
No firm has claimed a ISO 22301 assessor listing yet. Claim yours →
Consultants
A mature consultant ecosystem exists, often overlapping with information security and risk consultancies. Implementers facilitate the business impact analysis and risk assessment workshops, draft the strategy and plans, design and run exercises, train plan owners, and prepare the organization for the certification audit. First-time engagements typically take four to nine months.
Firms that name this framework in their own material. Listings we have not verified yet come from public filings and partner lists. Each firm can confirm its own.
Software
Tools that name this framework in their own material.
Independent third-party explainers, chosen by hand. Not affiliated with this site and not paid placements. All links are nofollow.
Need a hand implementing it?
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Approve the policies ISO 22301 asks for, keep every version, and record a named acknowledgment from each person who has to read them.