certification
ISO 22301
A voluntary standard for running business continuity as a management system. No law requires the certificate. Customers and tenders ask for it, and it gives the continuity duties in NIS2 and DORA an owner and a yearly cycle to run on.
at a glance
- what it is
- An international standard, ISO 22301:2019, security and resilience, business continuity management systems, requirements. ISO lists one amendment, from 2024.
- who it covers
- Whoever chooses it, or whose customer contract requires it. ISO says organisations of all sizes can use it.
- who checks
- A certification body, against a scope you define. ISO itself does not certify.
- penalties
- None under law. You can lose the certificate or the contract.
- legal weight
- NIS2 and DORA ask for continuity measures in their own words. A certificate is not proof that you meet either.
basis NIS2 Art. 21(2)(c); DORA Art. 11(1)
does it apply to you?
A few questions, answered in your browser, tell you which rules are yours. Nothing is sent anywhere.
find my rulesthe continuity loop the standard asks you to run
- 1business impact analysiswhat stops the business, and how fast it hurts
- 2recovery objectiveshow long each activity may be down, how much data it can lose
- 3planswho does what to get each activity back
- 4exercisewalk through it, then restore for real
- 5internal audit and management reviewwhat failed, what changes
every cycle, with a certification body checking the system
basis working practice. No legal text sets this.
do the continuity work once, and show it to whoever asks
- 1do the continuity workanalysis, objectives, plans, exercises
- 2keep the recordsdated, owned, filed
the same records feed
- an ISO 22301 certificatefor the scope you chose
- NIS2 and DORA continuity dutiesyour own answer to a supervisor
- a customer questionnaireyour answer to a buyer
basis working practice. No legal text sets this.
the whole job, in order
Phases, with who carries each step and the proof it leaves. Open a phase to see its steps.
- decide whether to certify, and what for
Find out who needs the certificate, what they would accept instead and which part of the company it should cover.
- find what the business cannot lose
List the activities that matter, measure what an interruption costs and set the limits you will recover to.
- write the plans and build the ability to recover
Turn the objectives into plans that other people can follow and into recovery that works.
- practise it
Test the plans with the people who would carry them out and fix what fails.
- check the system and let management review it
Find out whether the system runs as written, and put the result in front of management.
- pass the external audit
Choose a certification body, go through its audit and deal with what it finds.
- keep it alive each year
Run the system through the year, repeat the exercises, audit and review, and meet the certification body's follow-up.
what a certificate does and does not show
Read this before a customer asks you for one.
anyone who chooses it, or whose customer contract requires it
a business continuity management system, assessed by a certification body
what it asks, and ways to meet it
The rule says what must be true in the company. It names no tools or methods: you choose them, and the people implementing it and the board answer for the choice. Under each requirement are the controls that usually deliver it. That grouping is our reading of the rule, not a list from the act.
the long read
The full explanation, section by section, with the sources.