InfoSecHub

home / frameworks / iso-22301

// International standards

ISO 22301:2019

ISO 22301 sets requirements for a business continuity management system that helps an organization keep delivering its most important products and services during a disruption. The 2019 edition, amended in 2024, is current while ISO works on a revision.

International

Overview

ISO 22301 is the international requirements standard for a business continuity management system, or BCMS. ISO/TC 292 publishes it. The current text is the second edition from October 2019, plus Amendment 1 from February 2024, which adds climate change to the issues an organization must consider when setting the context for its BCMS.

The standard uses the same clause structure as ISO/IEC 27001 and other management system standards. Most of its specific content sits in clause 8, which covers business impact analysis, risk assessment, continuity strategies and solutions, plans and procedures, an exercise program, and evaluation of continuity capabilities. ISO 22313:2020 gives guidance. It covers far more than IT recovery, since people, premises, suppliers, and communications are all part of continuity planning.

ISO's catalogue now lists ISO 22301:2019 as a standard to be revised, with a committee draft of a new edition under development. No dates have been set. Organizations certified to the 2019 edition stay certified until accreditation bodies announce transition rules after a new edition is published. In Canada, the Standards Council of Canada accredits certification bodies for business continuity management systems, and ISO 22301 is a common reference for operational resilience programs at federally regulated financial institutions and critical infrastructure operators. OSFI's Guideline E-21 on operational risk management and resilience reflects the same regulatory interest, although it doesn't require certification. Buyers can verify accredited certificates in IAF CertSearch.

Who it applies to in Canada

Organizations of any size or sector that want a managed way to prepare for, respond to, and recover from disruptions. It's widely used by financial institutions, utilities, telecom operators, and service providers that promise uptime.

Canadian banks, insurers, utilities, and their suppliers use ISO 22301 to show operational resilience to customers and to regulators such as OSFI. The Standards Council of Canada runs an accreditation program for business continuity management systems certification bodies.

Controls at a glance

Requirements follow clauses 4 to 10 of the harmonized management system structure, with continuity-specific requirements concentrated in clause 8.

Context of the organization (clause 4)

  • Identify issues that affect continuity outcomes
  • Consider whether climate change is a relevant issue
  • Identify interested parties and legal requirements
  • Define the BCMS scope and any exclusions

Leadership (clause 5)

  • Top management commits to the BCMS
  • Set a business continuity policy
  • Assign roles, responsibilities, and authorities

Planning (clause 6)

  • Address risks and opportunities for the BCMS
  • Set continuity objectives and plans to reach them
  • Plan changes to the BCMS

Support (clause 7)

  • Provide resources and competent people
  • Build awareness of continuity roles
  • Plan internal and external communication
  • Control documented information

Business impact analysis and risk assessment (clause 8.2)

  • Identify activities that deliver products and services
  • Assess impacts of disruption over time
  • Set recovery priorities and time frames
  • Identify resources each priority activity depends on
  • Assess risks of disruption to priority activities

Strategies, solutions, and plans (clauses 8.3 and 8.4)

  • Choose continuity strategies and solutions
  • Provide resources such as people, sites, and suppliers
  • Set up a response structure and warning process
  • Write business continuity plans and recovery procedures

Exercises and evaluation (clauses 8.5 and 8.6)

  • Run an exercise program that tests plans
  • Review results and report lessons learned
  • Evaluate continuity documentation and capabilities

Performance evaluation (clause 9)

  • Monitor and measure BCMS performance
  • Run internal audits
  • Hold management reviews

Improvement (clause 10)

  • Correct nonconformities and find their causes
  • Take corrective action and check it worked
  • Improve the BCMS on a continuing basis

Certification and assessment

A certification body audits the BCMS in stage 1 and stage 2 audits, including evidence that plans have been exercised. If the system conforms, it issues a certificate for a defined scope. Accredited certificates can be checked in IAF CertSearch.

Dates to know

2019-10
ISO 22301:2019 (Edition 2) published, replacing the 2012 edition
2024-02-23
Amendment 1 (climate action changes) published
2026-10-11
ISO lists the standard as to be revised, with ISO/CD 22301 under development

Resources

Official texts and free tools for ISO 22301. Links open the publisher’s site.

Need help? Browse the directory or read the guides.

References

  1. ISO 22301:2019 Business continuity management systems, ISO
  2. ISO 22301:2019/Amd 1:2024 Climate action changes, ISO
  3. Business continuity management systems accreditation, Standards Council of Canada

General information, reviewed 2026-10-11. Not legal advice. Confirm requirements with the publisher, your regulator, or a qualified advisor.