ISO 22301: The Complete Guide to Business Continuity Management

ISO 22301:2019 is the international standard for a Business Continuity Management System (BCMS) — the framework an organisation uses to prepare for, respond to and recover from disruptive incidents while keeping critical operations running. Like several other modern ISO management system standards, it follows the shared Annex SL structure, with clauses 1–3 setting the scene and clauses 4–10 carrying the mandatory requirements an organisation is actually audited against. This guide walks through that structure clause by clause, explains in general terms who typically needs it, and outlines how certification unfolds.

What is ISO 22301:2019?

ISO 22301:2019, formally titled Security and resilience — Business continuity management systems — Requirements, specifies the requirements for planning, establishing, implementing, operating, monitoring, reviewing, maintaining and continually improving a documented management system that protects against, reduces the likelihood of, and ensures recovery from disruptive incidents. In plain terms, it is a structured way of answering the question: if a major disruption hit tomorrow — a cyber incident, a supplier failure, a natural disaster, a loss of key premises or people — could the organisation keep its most important activities running, and how quickly could it recover the rest?

The standard is published by ISO (the International Organization for Standardization) and is designed to be applicable regardless of an organisation's size, sector or type. It does not prescribe a specific continuity plan or technology — it defines the management system an organisation must build so that its own continuity arrangements are deliberate, tested and continually improved, rather than improvised when an incident actually happens.

The Annex SL structure: why ISO 22301 looks like ISO 9001 or ISO 27001

ISO 22301 follows the "High Level Structure" set out in Annex SL, a common framework ISO uses across many of its modern management system standards — including ISO 9001:2015 (quality), ISO 14001:2015 (environmental) and ISO 27001:2022 (information security), and ISO 45001:2018 (occupational health and safety), among others. The practical benefit is significant: an organisation that already has one of these systems in place will recognise the shape of ISO 22301 immediately, and integrating a BCMS alongside an existing quality or security management system becomes far more straightforward than building each one from scratch in isolation.

Under this shared structure, the first three clauses are introductory and set no direct requirements of their own:

• Clause 1 — Scope: defines what the standard covers and confirms it is intended to apply to organisations of any size, type or nature.
• Clause 2 — Normative references: lists the other documents the standard relies on.
• Clause 3 — Terms and definitions: establishes the vocabulary used consistently throughout, such as "disruption," "business impact analysis" and "recovery time objective."

The substance of the standard — the requirements an organisation is actually audited against — sits in clauses 4 through 10. These seven clauses are the mandatory core of the BCMS, and each one is significant enough that we cover it in its own dedicated article. Below is an overview of each; follow the links to the deep-dives for the full requirement-by-requirement breakdown.

Clause 4 — Context of the Organization

Clause 4 requires the organisation to understand itself and its environment before building anything: the internal and external issues that affect its ability to achieve its BCMS objectives, the needs and expectations of interested parties (customers, regulators, employees, suppliers), and — critically — the scope of the BCMS itself, meaning which products, services, locations and activities it actually covers. Getting the scope right here shapes everything that follows. We cover the full detail in our dedicated article on Clause 4.

Clause 5 — Leadership

Clause 5 places accountability squarely with top management. It requires demonstrated leadership and commitment to the BCMS, a documented business continuity policy, and clearly assigned roles, responsibilities and authorities. This is the clause auditors use to test whether continuity is genuinely a business priority backed by resources, or exists only as a document on a shelf. It is explored in full in our Clause 5 deep-dive.

Clause 6 — Planning

Clause 6 requires the organisation to identify risks and opportunities affecting the BCMS, set measurable business continuity objectives, and plan how to achieve them. It establishes the forward-looking discipline that connects the context defined in Clause 4 to concrete, trackable goals. Our Clause 6 article covers objective-setting and planning in detail.

Clause 7 — Support

Clause 7 covers the resources needed to run the BCMS effectively: people, competence and awareness, communication (both internal and with external parties during a disruption), and documented information — the procedures, plans and records the standard requires to be created, controlled and kept current. Our Clause 7 article goes into competence, communication and document control in detail.

Clause 8 — Operation

Clause 8 is the largest and most technical clause, and it is the linchpin of the whole standard. It covers operational planning and control, the Business Impact Analysis (BIA) and risk assessment that identify which activities matter most and what could disrupt them, the selection of continuity strategies and solutions, the development of business continuity plans and procedures, and the response structure and recovery actions an organisation puts into motion when an incident actually occurs. This is where most of a BCMS's day-to-day substance lives, and it is the subject of our dedicated Clause 8 deep-dive.

Clause 9 — Performance Evaluation

Clause 9 requires the organisation to monitor, measure, analyse and evaluate how well the BCMS is performing, including through internal audits and periodic management review by top management. It is also where exercising and testing plans — a distinctive feature of business continuity compared with some other management systems — comes into sharpest focus. The full requirements are covered in our Clause 9 article.

Clause 10 — Improvement

Clause 10 closes the loop. It requires the organisation to identify nonconformities, take corrective action, and continually improve the suitability, adequacy and effectiveness of the BCMS — including by feeding lessons learned from exercises and real incidents back into the system. We explore this in our Clause 10 deep-dive.