standard
ISO 22301
A voluntary standard for running business continuity as a management system. No law requires the certificate, but customers and tenders ask for it. Read this if one asked you: it says whether you need it and what it proves.
- what it is
- An international standard, ISO 22301:2019, security and resilience, business continuity management systems, requirements. ISO lists one amendment, from 2024.
- who it covers
- Whoever chooses it, or whose customer contract requires it. ISO says organisations of all sizes can use it.
- who checks
- A certification body, against a scope you define. ISO itself does not certify.
- penalties
- None under law. You can lose the certificate or the contract.
- legal weight
- NIS2 and DORA ask for continuity measures in their own words. A certificate is not proof that you meet either.
basis NIS2 Art. 21(2)(c); DORA Art. 11(1)
who asks for it, and what it proves
Customers and tenders ask for an ISO 22301 certificate when they depend on your service staying up. It shows that a certification body checked your business continuity management system, within a scope you chose, against the standard. ISO describes the standard as a framework to plan, run, review and improve a documented system that protects against disruptive incidents and gets you back after them.
The standard asks how you keep continuity going through the year. A first-time company gets the most from the loop: find what the business cannot lose, set limits, plan, practise, check.
the continuity loop the standard asks you to run
- 1business impact analysiswhat stops the business, and how fast it hurts
- 2recovery objectiveshow long each activity may be down, how much data it can lose
- 3planswho does what to get each activity back
- 4exercisewalk through it, then restore for real
- 5internal audit and management reviewwhat failed, what changes
every cycle, with a certification body checking the system
basis working practice. No legal text sets this.
basis ISO 22301:2019, ISO standard page for the description; the steps of the loop are practice, as commonly described and not read in the paid text
which edition is current
ISO lists ISO 22301:2019 as published, edition 2, from October 2019, and one amendment from 2024 titled “climate action changes”. On the day this page was checked, ISO showed the standard as due for revision, with a new version under development. ISO also publishes a separate guidance document on using the standard. Before you sign a contract that names an edition, check the page again and ask your certification body which edition it audits against.
basis ISO standard page, read 2 November 2026; edition, amendment and revision status are ISO’s, not the law’s
how certification works
You choose a certification body and agree a scope. The body audits your system against the standard and decides whether to issue a certificate. ISO states that it does not perform certification or issue certificates, and that a company cannot be certified by ISO. ISO also says accreditation of the certification body is not compulsory, but it advises you to check it, and gives a global database for verifying a certificate.
What happens after the certificate, how often the body returns and how long the certificate runs are set by the certification body and its scheme. ISO’s pages do not give a cycle, so this page does not state one. Ask in writing before you commit.
basis ISO certification page, read 2 November 2026; the follow-up question is practice
do you need it
Probably not for the law. The provisions that matter here ask for continuity in their own words. NIS2 lists business continuity, such as backup management and disaster recovery, and crisis management among the measures. DORA asks financial entities for an ICT business continuity policy and documented backup policies. Ask your lawyer and your supervisor how they treat a certificate, if at all.
Possibly for sales. Customers whose own continuity depends on yours ask for it in questionnaires and tenders. Before you commit to a certification cycle, find out which of them would accept a plan and a restore record.
basis NIS2 Art. 21(2)(c); DORA Art. 11(1), 12(1)
what the work on this site already gives you
do the continuity work once, and show it to whoever asks
- 1do the continuity workanalysis, objectives, plans, exercises
- 2keep the recordsdated, owned, filed
the same records feed
- an ISO 22301 certificatefor the scope you chose
- NIS2 and DORA continuity dutiesyour own answer to a supervisor
- a customer questionnaireyour answer to a buyer
basis working practice. No legal text sets this.
A company that has done the backups and recovery work holds recovery limits, a restore record and a short crisis plan. Those are the raw material for the standard. What you add is the business impact analysis in writing, an exercise programme, an internal audit and a management review.
basis working practice. No legal text sets this.
what a certificate does not cover
A certificate covers only the scope you chose, so one on a single service says nothing about your other systems. It shows a date and an issuer, and it does not show that the plan worked on the day of a real incident. It is not compliance with NIS2 or DORA. When a regulator asks about something outside the scope, the certificate does not answer. The standard is paid and was not read in full for this page, so check clause numbers against your licensed copy.
basis working practice. No legal text sets this.
check it yourself
your next step
Ask your largest customers whether they want a certificate or would accept a restore test record and a continuity plan. Then pick one system and time a restore, because every route starts there.