ISO 22301 explained: business continuity that survives a real disruption

Somewhere in your shared drive there is probably a file called business_continuity_plan_FINAL_v3.docx. It was written for an audit, it is gloriously out of date, and if the building actually caught fire, nobody would think to open it. We have all met that file. ISO 22301 exists so you never have to rely on it again.

It is the international standard for a Business Continuity Management System, which is a grand way of saying: a repeatable, tested habit of staying open when something goes wrong. Fire, flood, ransomware, a cloud region falling over, your one payroll person quitting the week before payday. The standard does not promise nothing bad will happen. It promises that when it does, you will not be improvising.

The question a buyer is really asking is not 'do you have a plan?' It is 'if you go down, do I go down with you?'

Why your company should care (beyond the certificate)

Downtime is not an IT inconvenience, it is a revenue event. If your service is dark for a day, you are not just losing that day, you are losing the renewal conversations, the trust, and the awkward status-page updates that customers screenshot and share. For anyone selling into banks, healthcare, government, or critical infrastructure, business continuity is now a line item in the contract, not a nice-to-have.

That is the real reason 22301 keeps showing up in procurement. It turns 'trust us, we will figure it out' into 'here is our tested plan, here are our recovery targets, and here is the report from the last time we rehearsed it.' One of those answers wins deals.

The moving parts, without the fog

If you have done ISO 27001 or 42001, the skeleton will feel familiar, because clauses 4 to 10 are the shared management-system spine. The interesting, business-continuity-specific work lives in clause 8:

• Business Impact Analysis (BIA): for each activity, how long can it be down before it really hurts, and how fast must it come back. This is where the famous MTPD, RTO and RPO numbers come from.
• Risk assessment: what could realistically knock those activities over, and which of those risks you are actually going to do something about.
• Strategies and solutions: the concrete arrangements (backups, alternate sites, standby suppliers) that let you hit those recovery targets.
• Plans and response structure: who does what, in what order, when the pager goes off. Life safety first, heroics never.
• Exercising: you rehearse the plan on purpose, in a calm room, so you find the gaps there instead of at 3am.

The 2024 update you should not miss

Amendment 1 (2024) added climate change to the list of things you must consider in your context. It is a small edit with a big signal: continuity is no longer just about the server room, it is about heatwaves, floods, and the supply chains that wobble when the weather does. Our content is already on the current text, so you are not certifying against last year's version.

How Compliance One makes it manageable

We ship the full clause 4 to 10 library (including the climate-change amendment) turned on by default, with a Statement of Applicability ready to go. The part people love is the Business Impact Analysis: instead of a spreadsheet you dread updating, it lives in a sortable, always-current table that feeds your continuity plans. The exercise scheduler nags you (politely) when a rehearsal is due. The mandatory documents come pre-filled so you are editing, not staring at a blank page. And because it cross-maps to the ISO 27001 controls you may already hold, 22301 becomes an extension of your programme rather than a second job.