ISO 22301: The Complete Guide to Business Continuity Management (2026)

ISO 22301:2019 is the international standard for business continuity management systems (BCMS), published by the International Organization for Standardization under the official title: Security and resilience, Business continuity management systems, Requirements. It gives organisations a structured framework to prepare for, respond to, and recover from disruption such as cyberattacks, supplier failures, power and IT outages, or natural disasters, so that critical activities keep running within predefined timeframes. This guide explains what the standard requires clause by clause, how to implement it and get certified, and how it maps to the EU's DORA regulation, the NIS2 directive, and Switzerland's FINMA operational-resilience expectations.

What is ISO 22301?

The current edition, ISO 22301:2019, replaced the 2012 version, which itself evolved from the British standard BS 25999. It adopts Annex SL, the common high-level structure shared by ISO 27001 and ISO 9001, which is why the three integrate cleanly into a single management system. The aim throughout is operational availability: knowing in advance which activities are critical, how fast they must recover, and exactly what to do when disruption hits.

ISO 22301 vs ISO 27001: how they differ and when to combine

The two standards are often confused. ISO 27001 protects information; ISO 22301 protects the organisation's ability to keep operating. Because both follow Annex SL, many organisations run a single integrated management system and certify to both.

The ISO 22301 clauses explained (Clauses 4 to 10)

Clauses 1 to 3 cover scope, normative references and terms. The certifiable requirements live in Clauses 4 to 10 and follow the Plan-Do-Check-Act logic.

The BCMS lifecycle (Plan-Do-Check-Act)

ISO 22301 follows the Plan-Do-Check-Act cycle that underpins every Annex SL management system. Each phase maps to specific clauses:

How to implement ISO 22301, step by step

Implementation is sequential: you cannot choose continuity strategies before you know which activities are critical and how fast they must recover. The business impact analysis drives everything downstream.

ISO 22301 and the regulatory landscape: DORA, NIS2 and FINMA

This is where ISO 22301 has become strategically important. A wave of resilience regulation now requires the very capabilities ISO 22301 builds, and while none of these laws mandate ISO 22301 certification, implementing the standard gives you an evidenced, auditable framework that maps onto each of them.

ISO 22301 and the EU DORA regulation

The Digital Operational Resilience Act (DORA), which applies to EU financial entities from 17 January 2025, requires an ICT business-continuity policy (Article 11) and ICT response-and-recovery plans (Article 12). These map directly onto ISO 22301's BIA, documented plans, testing regime and management review, extended with ICT-specific RTO/RPO, third-party ICT continuity, and the register of information for critical providers.

ISO 22301 and the NIS2 directive

The NIS2 directive explicitly lists business continuity, including backup management, disaster recovery and crisis management, among its required security measures (Article 21). NIS2 does not require ISO 22301, but implementing it substantially satisfies the obligation and provides defensible evidence during supervisory inspections, which matters given the directive's significant fines and management accountability.

ISO 22301 and FINMA Circular 2023/1 (the Swiss angle)

For Swiss financial institutions, FINMA Circular 2023/1 on operational risks and resilience sets the recognised minimum standard. It requires identifying critical functions, board-approved tolerances for disruption, a BIA with RTO/RPO, continuity and recovery plans, and testing against severe-but-plausible scenarios, the same building blocks ISO 22301 provides. This is the home-turf advantage for a Swiss organisation: a certified BCMS becomes the operating model behind FINMA resilience expectations.

The practical takeaway is convergence: rather than running separate projects for each regulation, organisations can build one ISO 22301 management system and map it to DORA, NIS2 and FINMA at once. The crosswalk below shows how the same capabilities satisfy all four.

ISO 22301 certification: process, timeline and cost

Organisations are certified by an accredited certification body through a two-stage audit, then maintain certification over a three-year cycle with annual surveillance audits. The path runs as follows:

1. Gap analysis against the ISO 22301 requirements
2. Implement the BCMS and run it long enough to generate records
3. Stage 1 audit: review of documentation and readiness
4. Stage 2 audit: review of implementation and effectiveness
5. Certificate issued, valid for a three-year cycle
6. Annual surveillance audits to maintain the certificate
7. Recertification at the end of the three-year cycle

Timeline and cost depend on organisation size, number of sites, the maturity of existing continuity arrangements, and the certification body. For a mid-sized organisation, six to twelve months from kick-off to certificate is a realistic planning assumption. Note that certification-body fees are separate from the cost of training your implementation and audit team.

ISO 22301 training and professional certification

Individual PECB certifications build the competence to implement or audit a BCMS. Choose the level that matches your role: