Security and Resilience — Business Continuity Management Systems — Requirements
Specifies requirements for a business continuity management system: understanding the organisation, business impact analysis and risk assessment, continuity strategies and solutions, documented plans and procedures, and an exercise and evaluation programme.
What this does not cover
stated in the document's own scope- It specifies a management system, not the content of any particular recovery plan or the recovery times an organisation must meet; those are set by the organisation’s own analysis.
- It is not an emergency-response or life-safety standard; protecting people at the moment of an incident falls to occupational-safety and emergency-management arrangements.
- It does not replace GMP obligations for validated systems; restoring a system after disruption remains subject to the organisation’s change and validation controls.
Always verify against the current published text before relying on it for a submission or inspection.
Overview
ISO 22301 specifies the requirements for a business continuity management system (BCMS): a documented management system an organisation uses to plan, establish, implement, operate, monitor, review, maintain and continually improve its ability to protect against disruptive incidents, reduce their likelihood, and recover when they occur. Its operational clause asks the organisation to carry out a business impact analysis and risk assessment, to select business continuity strategies and solutions on that basis, to document plans and procedures, and to test them through an exercise programme. ISO describes it as suitable for organisations of all sizes.
Scope & applicability
Any organisation, of any size or sector, and certifiable by accredited bodies. In regulated manufacturing it is the management-system frame around obligations GMP already implies — EU GMP Annex 11 requires continuity provisions for computerised systems supporting critical processes, and ISO 22301 is how an organisation builds and tests that at enterprise scale rather than system by system.
Legal basis & how it acquires force
It is a voluntary International Standard developed by ISO/TC 292 (security and resilience). The current text is the second edition, ISO 22301:2019, published in October 2019, which replaced ISO 22301:2012; Amendment 1:2024 adds climate-action changes. Following systematic review ISO recorded in December 2025 that the standard is to be revised, and a committee draft of the next edition is under development. It has no legal force of its own: it applies where an organisation adopts it, or where a contract or customer requires it.
Document structure
| Part | Covers |
|---|---|
| Clauses 1–3 — Scope, references and terms | The applicability of the BCMS requirements and the defined terms |
| Clauses 4–7 — Context, leadership, planning and support | The harmonized-structure clauses: interested parties and scope, top-management commitment, objectives, resources, competence and documented information |
| Clause 8 — Operation: analysis | Business impact analysis and risk assessment — the analysis on which the choice of continuity strategies and solutions rests |
| Clause 8 — Operation: strategies, plans and exercises | Business continuity strategies and solutions (8.3), business continuity plans and procedures (8.4) and the exercise programme (8.5) |
| Clauses 9–10 — Performance evaluation and improvement | Monitoring, internal audit, management review, nonconformity and corrective action, and continual improvement |
Key requirements
- Business impact analysis establishing prioritised activities and their recovery time objectives
- Risk assessment of disruption to prioritised activities, feeding continuity strategy selection
- Documented business continuity plans with defined roles, activation criteria and communication arrangements
- An exercise programme that tests the plans, and evaluation of continuity documentation and capability after disruption
- Second edition (2019) cancels and replaces ISO 22301:2012; Amendment 1:2024 adds climate-action considerations
Implementation tips
- Express recovery objectives in terms the operation understands — batches in flight and the point at which the manual fallback stops coping — rather than only in hours
- A restore is a change to a validated system: plan for verification back into the validated state and reconciliation of the gap since the last good backup, not only for the system coming back up
Where this control fails
live FDA enforcementLive FDA recalls SPEQ maps to this standard’s topics — a SPEQ interpretation, not an FDA classification.
International alignment
ISO 22301 follows ISO’s harmonized structure for management system standards, so it integrates with ISO 9001, ISO/IEC 27001 and ISO 45001 under a shared skeleton. ISO 22313:2020 provides guidance on its use, and ISO 31000 provides the general risk-management principles on which its risk assessment can draw. In regulated manufacturing it gives an enterprise frame for a narrower GMP expectation: section 16 of EU GMP Annex 11 asks for provisions ensuring continuity of support for critical processes if a computerised system breaks down.
ISO 22301:2019: frequently asked questions
Quick answers to common questions about ISO 22301:2019.
What is the current version of ISO 22301?
ISO 22301:2019, the second edition, published in October 2019 and amended by Amendment 1:2024 (climate action changes). ISO has decided to revise it, and a committee draft of the next edition is under development.
Where does business impact analysis sit in ISO 22301?
In clause 8, Operation, together with risk assessment. That analysis comes before, and informs, the business continuity strategies and solutions (8.3), the plans and procedures (8.4) and the exercise programme (8.5) that follow in the same clause.
Is there guidance on how to implement ISO 22301?
Yes. ISO 22313:2020, Security and resilience — Business continuity management systems — Guidance on the use of ISO 22301, is the companion guidance document. ISO 22301 holds the requirements.
This standard in practice
Recall domain is a SPEQ mapping of this standard’s topics, not an FDA classification.