ISO 22301

Stefan Coetzeecreated 2026-05-12updated 2026-06-081 min readMOC
Vault note, not reviewed against the source. Written in the knowledge vault on 2026-05-12 by models working with Stefan Coetzee and published as it stands, with private addresses, e-mail addresses and an employer name redacted. Check claims against the primary source before relying on them.

Map of ISO/IEC 22301:2019 — Business Continuity Management Systems. Annex SL sibling to ISO 27001 + ISO 42001. Certifiable. Used alongside ISO 27001 + DORA for orgs with continuity obligations.

Anchors

Provenance

  • BS 25999 (UK origin, 2006-2007) — first BC management standard.
  • ISO 22301:2012 — first ISO version.
  • ISO 22301:2019 — current. Annex SL-aligned.

What ISO 22301 is

Management system standard for business continuity. Defines requirements for establishing, implementing, maintaining, continually improving a BCMS. Covers planning, preparing for, responding to, recovering from disruption.

Clause structure (Annex SL)

Mandatory clauses 4-10, identical structural pattern to ISO 27001:

  • Cl 4 Context
  • Cl 5 Leadership
  • Cl 6 Planning
  • Cl 7 Support
  • Cl 8 Operation (incl. business impact analysis, risk assessment, BC strategy, BC plans, exercises, evaluation)
  • Cl 9 Performance Evaluation
  • Cl 10 Improvement

Detail in ISO 22301 Clause Structure and Key Concepts.

Key concepts

  • Business Impact Analysis (BIA): identify what processes / activities are time-critical, quantify maximum tolerable period of disruption (MTPD), recovery time objective (RTO), minimum business continuity objective (MBCO).
  • Risk Assessment: identify risks of disruption.
  • BC Strategy: how disruption will be addressed.
  • BC Plans: incident response plans, business recovery plans.
  • Exercises and Testing: tested plans.
  • Evaluation: monitor effectiveness.

Certification mechanics

Same Annex SL pattern as ISO 27001:

  • Stage 1 + Stage 2 initial audit.
  • 3-year certificate.
  • Annual surveillance audits.
  • Recertification at 3-year mark.

Why this matters for SRE and AI-agent work

  • Sibling to ISO 27001 under Annex SL — combined ISMS + BCMS implementation common.
  • DORA business continuity obligations (Pillar 1) align with ISO 22301.
  • NIS2 Article 21(c) business continuity overlaps.
  • AI-feature continuity: model-vendor outages, AI-service unavailability, fallback strategies.
  • ISO 27001 — sibling. A.5.29-A.5.30 align with ISO 22301.
  • DORA — financial services ICT resilience overlap.
  • NIS2 — Article 21(c) business continuity.

See also

ISO 22301 Cluster (pillars MOC) · position · anchors · ISO 27001 Cluster