You have ISO 27001. Here's how much of ISO 22301 you've already done.

Picture the scene. You spent last year earning ISO 27001, you finally stopped having audit nightmares, and now a big customer casually asks if you are also ISO 22301 certified. Deep breath. This is not starting over. The two standards were designed to hold hands.

What transfers almost for free

Clauses 4 through 10 of 22301 are the same Annex SL management-system text sitting inside 27001: context, leadership, planning, support, performance evaluation, improvement. Your policy structure, your roles, your internal audit programme, your management reviews, your corrective-action process. All of it carries across with light editing. You are re-pointing a machine you already built, not buying a new one.

On the controls side, ISO 27001:2022 already includes A.5.29 (information security during disruption) and A.5.30 (ICT readiness for business continuity). If those are implemented, you have quietly started your recovery capability for IT. 22301 just asks you to widen the lens from 'the systems' to 'the whole business,' including the people, the building, and the suppliers.

22301 is not a second programme. It is your 27001 programme, asked a harder question: not just 'is it secure?' but 'does it keep running?'

What you genuinely need to build

• A real Business Impact Analysis: MTPD, RTO and RPO for every prioritized activity, plus its dependencies and resources. This is the biggest net-new piece, and honestly the most useful.
• Continuity strategies and usable plans that go beyond IT recovery into people, facilities, suppliers and communications.
• An exercise programme that is actually run and written up, not just scheduled and quietly skipped.

The efficient way to do it

Compliance One cross-maps 22301 to your existing 27001 controls automatically, so the shared spine arrives pre-satisfied and the crosswalked continuity controls inherit the evidence you already collected. What is left is the genuinely new work, and the native BIA register and exercise scheduler are built for exactly that. Most teams find 22301 is an extension of a quarter's work, not a fresh quarter of it. Which is a much nicer sentence to say to your customer than the alternative.