Business continuity · BCMS
ISO 22301:2019
Requirements for a business continuity management system: understanding what must keep running, analysing impacts and risks, and having tested plans to respond to and recover from disruption.
1 What it covers
ISO 22301 helps an organisation prepare for, respond to and recover from disruptive incidents. Its core is the business impact analysis (BIA), which identifies prioritised activities and how quickly they must be resumed, followed by a risk assessment, continuity strategies and solutions, documented plans and an exercise programme to test them.
2 Who uses it
Financial services, IT and data-centre operators, utilities, logistics, the public sector and suppliers to critical services. Business continuity managers and resilience teams are the main audience.
3 Structure and key clauses
Clauses 4–10 follow the high-level structure; clause 8 contains the business-continuity specifics:
8 Operation
- 8.2 Business impact analysis and risk assessment (8.2.2 Business impact analysis, 8.2.3 Risk assessment)
- 8.3 Business continuity strategies and solutions
- 8.4 Business continuity plans and procedures
- 8.5 Exercise programme
- 8.6 Evaluation of business continuity documentation and capabilities
4 Key facts for courses and exams
- Current edition: ISO 22301:2019 + Amendment 1:2024; a revision is at committee draft stage (iso.org, October 2026).
- The BIA establishes priorities and timeframes for resuming activities; the risk assessment looks at what could disrupt them.
- Exercises must be planned and their results used to improve plans.
5 ISO 22301 qualifications
6 Prepare
- ISO 22301 business continuity practice quiz
S Sources
Facts on this page last checked 3 October 2026.
- iso.org, ISO 22301:2019 page — https://www.iso.org/standard/75106.html