What is ISO 22301?
ISO 22301 sets out what a management system must achieve so that an organisation continues time-critical services during a disruption or resumes them within a set time. It is a requirements standard; certification covers an organisation's management system. ISO alone publishes it, so the designation is ISO 22301, not ISO/IEC 22301.
What business continuity management involves as a whole and how to set it up is covered in the guide Building a Business Continuity Management System (BCMS).
Which edition applies?
| Document | Date | Meaning |
|---|---|---|
| ISO 22301:2019 | October 2019 | current international edition |
| ISO 22301:2019/Amd 1:2024 | February 2024 | Amendment 1 "Climate action changes" |
| DIN EN ISO 22301:2020-06 | June 2020 | German version, replaces DIN EN ISO 22301:2014-12 |
| DIN EN ISO 22301/A1:2024-12 | December 2024 | German version of Amendment 1 |
Amendment 1 is not a new edition; anyone working from the German version needs both documents. BSI Standard 200-4 also names, among others, ISO 22313:2020 as guidance on the use of ISO 22301 and ISO/TS 22317:2021 for the business impact analysis.
ISO 22301 or BSI Standard 200-4?
BSI Standard 200-4 from Germany's Federal Office for Information Security (BSI) describes building a BCMS in three stages: reactive BCMS, build-up BCMS and standard BCMS. According to the standard, the standard BCMS stage conforms to the requirements of ISO 22301:2019. Organisations with a fully implemented and operated standard BCMS thereby reach the maturity to be certifiable under ISO 22301. According to the BSI, certification against the BSI standard itself is not currently planned (as of October 2026).
That gives a decision rule:
| Starting point | Route |
|---|---|
| A customer, tender or contract requires a certificate | build under ISO 22301, or up to the standard BCMS stage under BSI Standard 200-4, then certify against ISO 22301 |
| Limited resources, no certificate required | start with a reactive or build-up BCMS under BSI Standard 200-4 and expand to a standard BCMS later |
| An ISMS under ISO/IEC 27001 exists | build the BCMS on the existing management system processes; add the business impact analysis and plans |
| Working with IT-Grundschutz | BSI Standard 200-4 with its document templates; the BSI's requirements catalogue includes a mapping to ISO 22301:2019 |
If you take the BSI route, the outline is in the business continuity plan template and sample text is in the BSI's supporting material.
Do NIS2 or DORA require ISO 22301?
Neither requires an ISO 22301 certificate. Both require business continuity:
| Rules | Reference | What is required |
|---|---|---|
| BSI Act (BSIG) | § 30(2) sentence 2 no. 3 | business continuity, such as backup management and recovery after an emergency, and crisis management as a minimum measure |
| DORA | Article 11(1) of Regulation (EU) 2022/2554 | a comprehensive ICT business continuity policy as part of the ICT risk management framework |
§ 30 BSIG applies to particularly important entities (besonders wichtige Einrichtungen; "essential entities" in the NIS2 Directive) and important entities. Under § 28(5) BSIG it does not in principle apply to operators of public telecommunications networks, providers of publicly available telecommunications services and energy companies subject to §§ 5c to 5e of the German Energy Industry Act (EnWG). Under § 28(6) BSIG it does not apply to financial entities under DORA either. A BCMS under ISO 22301 is one way to implement and evidence these duties in a structured manner.
How it relates to ISO/IEC 27001
ISO describes ISO 22301 as one that can be integrated with other ISO management system standards. With ISO/IEC 27001, leadership, competence, documented information, internal audit and management review can therefore be run jointly. The analysis stays separate: an ISMS starts from risks to confidentiality, integrity and availability, a BCMS from the impact of an outage on business processes.
Annex A of ISO/IEC 27001 contains information security during disruption in 5.29 and ICT readiness for business continuity in 5.30. Both controls protect information and ICT during a disruption; the business impact analysis, continuity strategies and plans for the business processes come from a BCMS.