# ISO 22301: Business continuity management systems (BCMS)

> Keep critical services running through disruption, and prove it to customers and regulators.

URL: https://securei3.com/standards/iso-22301/
Category: Business continuity & resilience: Certifiable standard
Provider: Secure iQube (independent consultancy; ISO certificates are issued by accredited certification bodies; SOC and ISAE reports by licensed CPA and audit firms, which Secure iQube can arrange through partner firms)

## Edition and transition status (checked 2026-10-28)

- Status: under-revision
- In force: ISO 22301:2019 + Amd 1:2024
- New/next edition: ISO 22301, 3rd edition
- Published: Not yet scheduled
- Note: The revision is at committee draft stage (ISO/TC 292). ISO 22301:2019 remains fully valid; a transition period will be set after the new edition is published.

Milestones:
- 2026: Committee draft (ISO/CD 22301) reviewed; comment period closed


ISO 22301:2019 sets requirements for a **business continuity management system**. It asks you to understand which activities matter most, how fast they must recover, and what strategies, plans and resources make recovery possible, then to exercise and improve those plans.

We run business impact analysis workshops, develop continuity and crisis communication plans, design exercises from tabletop to full failover, and prepare you for certification. Where you hold ISO 27001, we align continuity with your ICT readiness and incident management controls.

## Who it is for

- Financial institutions and their critical vendors
- Telecoms, logistics and utilities
- Healthcare providers and outsourcing companies
- Organisations subject to operational resilience rules such as DORA

## Benefits

- Recover critical activities within agreed timeframes
- Meets bank and regulator continuity clauses in contracts
- Tested plans instead of shelf documents
- Supports DORA, SAMA and central bank resilience expectations

## How Secure iQube helps

1. **Gap assessment**: We compare what you do today with every requirement and control, then give you a prioritised gap report and a realistic timeline.
2. **Design and documentation**: Scope, policies, procedures, risk methodology and records, written to fit how your teams actually work, not a template binder.
3. **Implementation and training**: We help owners put controls in place, train the people who run them and start collecting evidence.
4. **Internal audit and management review**: An independent internal audit and a structured management review prove the system works before the certification body looks at it.
5. **Certification audit support**: We prepare you for Stage 1 and Stage 2 with your chosen accredited certification body and help close any findings quickly.
6. **Surveillance and continual improvement**: Optional managed support keeps evidence current through annual surveillance audits and the three-year recertification.

## Frequently asked questions

### What is a business impact analysis?

A BIA identifies your critical activities, the impact of disruption over time, and the recovery time and resources each needs. It drives every other decision in the BCMS.

### How often must plans be tested?

ISO 22301 requires an exercise programme at planned intervals and after significant change. Most organisations run tabletop exercises at least annually and technical recovery tests for key systems.

Related: https://securei3.com/standards/iso-27001/, https://securei3.com/standards/dora/, https://securei3.com/standards/sama-csf/, https://securei3.com/standards/iso-31000/

Contact: https://securei3.com/contact/: info@securei3.com