ISO 22301 business continuity that can operate under pressure.
ISO 22301:2019 remains the current published business continuity management-system (BCMS) standard. It has an applicable Amendment 1:2024 on climate-action changes, and is due to be revised.
- Last verified
- Status
- ISO 22301:2019 with Amendment 1:2024 · under revision
What a business continuity management system should address
Depending on scope:
- Context and interested parties
- Business impact analysis
- Risk assessment
- Continuity priorities
- Strategies and solutions
- Response structures
- Continuity procedures
- Exercising
- Monitoring
- Internal audit
- Management review
- Corrective action
Current edition status
ISO 22301:2019 remains the published edition and is due to be revised.
What you receive
Typical outputs can include:
- BCMS scope
- Business impact analysis methodology and outputs
- Dependency map
- Continuity requirements
- Strategy register
- Response structure
- Exercise programme
- Evidence register
- Audit and review plan
- Readiness actions
Prove the plan works
A continuity plan that has never been exercised provides limited assurance.
Evidence should show testing, results, actions and learning.
Evidence expectations
For example:
-
- Source
- ISO 22301
- Requirement
- Continuity arrangements are exercised
- Control
- Planned exercise programme covering priority activities
- Owner
- Business continuity lead
- Evidence
- Exercise reports with findings and lessons learned
- Monitoring
- Exercise actions tracked to closure
- Review
- Input to management review
How the work happens
Implementation follows the same evidence-first sequence, scaled to your scope, maturity and existing systems.
- Discover
- Assess
- Implement
- Prove
- Assure
Start with a focused discovery conversation
Tell us what you are trying to achieve, what is driving the requirement and where you are today. We use the first discussion to clarify scope and next steps, not to force a predefined package.