ISO 22301 Requirements: What the Auditor Checks

ISO 22301 sets the requirements for a business continuity management system (BCMS), and every one of them sits in seven clauses, 4 to 10. Six of those clauses are the frame ISO uses for all its management system standards: understand your context and fix a scope, have top management own a policy, set objectives, provide resources and competent people, audit and review the system, and correct what fails. Clause 8 is the business continuity work itself: a business impact analysis that decides how long each activity can be down, a risk assessment of what could take it down, strategies and solutions that meet those times, a response structure and plans, an exercise programme that proves them, and an evaluation that keeps all of it current. A certification auditor tests each clause the same way: ask for the record, then check that the record visibly drove the next step.

Here is what this page gives a business continuity manager, operational resilience lead or CISO facing a certification audit or a regulator's review. Every clause in the order an auditor tests it, with the evidence that closes it. The arithmetic that keeps a business impact analysis standing when it is sampled. An exercise cycle you can lift into next year's plan. The documents the standard actually names. How certification runs, from stage 1 to recertification. And where DORA, NIS2, ISO 27001 and APRA's CPS 230 lean on the same clauses. It is written from the standard's published structure and ISO's own catalogue data and reproduces none of the standard's text, so buy a copy from ISO or your national standards body before you rely on a specific clause.

Which version of ISO 22301 applies in 2026?

Certification today is against ISO 22301:2019, the second edition, which ISO published on 30 October 2019 and which replaced the 2012 first edition. ISO's foreword describes the revision as a clarification: the requirements were restated in ISO's current management system structure, almost all of the business continuity requirements were gathered into Clause 8 and that clause was reorganised, several terms were changed, and no new requirements were added. The changed vocabulary is one reason older terms still circulate in templates, a point we come back to in the section on what other guides get wrong.

Two later changes matter. On 23 February 2024 ISO published Amendment 1, the climate action changes, the same two additions it made that day to a list of management system standards that includes ISO 22301. Clause 4.1 gains a requirement to decide whether climate change is a relevant issue for the organisation, and clause 4.2 gains a note that interested parties can have requirements related to climate change. The International Accreditation Forum treated the change as a clarification of what clauses 4.1 and 4.2 already asked, so there was no transition programme, but a certification body now expects to see the climate question answered, with the reasoning, either way.

The second change is still in progress. ISO's catalogue lists a third edition, ISO/CD 22301, at stage 30.60: the committee draft has been circulated and its comment period has closed. No publication date is set, nobody can be certified against a draft, and the 2019 edition remains the standard until the new one is published. The guidance standard ISO 22313:2020 is also marked for revision, with a new work item approved.

One detail is easy to miss. Clause 2 of ISO 22301 names a single normative reference, the vocabulary ISO 22300, and cites it without a date. An undated reference means the latest edition applies, and since 6 November 2025 that is ISO 22300:2025.

How is ISO 22301 structured, and what can you leave out?

Clauses 1 to 3 carry no requirements: they cover the scope of the standard, its one normative reference and its terms. Clauses 4 to 10 are the requirements, 26 sub-clauses in all, and inside the scope you choose every one of them applies. There is nothing like the Annex A control set of ISO 27001 and no Statement of Applicability; the standard has no annexes at all. What you can limit is the scope. Clause 4.3 lets you draw the boundary around part of the organisation, provided the exclusions are documented and explained, and auditors then test whether the boundary is credible: anything a prioritised activity depends on either sits inside the scope or is managed as a supplier.

The usual reading maps the clauses onto Plan, Do, Check, Act: clauses 4 to 7 plan, clause 8 does, clause 9 checks and clause 10 acts. Because clauses 4 to 7, 9 and 10 share their structure with ISO 27001 and ISO 9001, an organisation that already runs an information security management system can extend its internal audit programme, management review and document control to the BCMS, provided each of them names the BCMS explicitly. Venvera's ISO 22301 library splits the 26 sub-clauses into 45 requirements, one for each part an auditor evidences separately.

What does clause 4 require: context, interested parties and scope?

Clause 4 asks whether the system is about your business. An auditor reads the context analysis and the registers, then looks for the same names (the regulator, the payment processor, the data centre) in the business impact analysis and the plans. If they are missing downstream, the context was written for the file.

A scope test is common. The auditor picks a prioritised activity, lists what it needs, and checks that each dependency is either inside the scope or handled as a supplier with continuity terms and current evidence. The method for that second half is the same as any supplier review; our guide on how to perform a third-party risk assessment walks through it.

What does clause 5 require from top management?

Clause 5 is short, and auditors test it by interview. Clause 5.1 makes top management accountable for the system: it has to fit the strategy, be built into how the business runs and have the money and people it needs. Clause 5.2 is the business continuity policy: it must fit the organisation, give the frame for setting objectives, and commit you both to meeting the requirements that apply and to improving the system, and it must be written down, shared inside the organisation and made available to interested parties when that is appropriate. Clause 5.3 asks for roles, responsibilities and authorities to be assigned, including someone responsible for the system conforming to the standard and someone who reports its performance to top management.

Expect the auditor to ask an executive what their own role is in a disruption, to look for continuity on the executive committee's agenda, and to compare the budget for exercises and standby arrangements with what the strategy says it needs. A policy that is an unedited template, or that nobody above the continuity manager approved, is a finding before the audit reaches clause 8.

What does clause 6 require: BCMS risks, objectives and change?

Clause 6 has two traps. The first is clause 6.1, risks and opportunities. These are risks to the management system itself: the sponsor leaves, one person holds the whole programme, the scope is too narrow to mean anything, the exercise budget is cut. The risks of disruption belong in the risk assessment under clause 8.2.3, and auditors expect the two lists to differ even when one method serves both.

The second trap is clause 6.2, objectives. They have to be consistent with the policy, measurable where practicable, monitored, communicated and kept as documented information, and each one needs a plan: what will be done, with what resources, by whom, by when and how the result will be judged. An objective such as "exercise every prioritised activity at least once within the certification cycle" passes that test; "improve resilience" fails it. Clause 6.3 then asks for changes to the BCMS to be made in a planned way, so that a new site, an outsourcing, a reorganisation or a new product moves the BIA, the strategies and the plans with it. Auditors usually take the most recent change and follow it through.

What does clause 7 require: resources, competence and documents?

Clause 7.1 asks you to determine and provide the resources the system needs, which an auditor checks by comparing what the selected solutions require with what is funded and staffed. Clause 7.2 asks you to define the competence each continuity role needs, make sure the people in those roles have it through education, training or experience, close the gaps, check that the closing worked and keep evidence. The roles that get sampled are the crisis team lead and deputies, plan owners and whoever runs the BCMS. Clause 7.3 asks that everyone working for you knows the policy, their part in it and their role before, during and after a disruption, and auditors test that outside the continuity team, in the post room and the contact centre. Clause 7.4 covers routine communication about the system: what, when, with whom and how. Crisis communication during a disruption is a separate duty under clause 8.4.3.

Clause 7.5 is documented information. The standard names certain documents and adds whatever else you decide the system needs; each has to be identified, approved and controlled. The control requirement has a continuity edge: plans have to be available where and when they are needed, which means the copy a responder can open when the office and the main systems are both down. An auditor will ask where that copy is, and how a superseded version is taken out of circulation.

What does clause 8 require? Six sub-clauses that work as a chain

Clause 8 is where the standard stops being generic. The six sub-clauses only make sense as a chain: the business impact analysis sets time frames, the strategies meet them, the plans carry them out, the exercises prove them, and the evaluation sends what was learned back to the start. An auditor samples one prioritised activity and follows it along the chain; a break anywhere is a finding.

8.1 Operational planning and control

Clause 8.1 asks for criteria for each process, control of planned changes and of the consequences of unplanned ones, and control of outsourced processes. The last one deserves the most attention. If a supplier runs part of a prioritised activity, its contract has to carry continuity terms consistent with your recovery times, and you need current evidence that it can meet them: a certificate, a plan summary, test results or an audit report. ISO's guidance on this is ISO/TS 22318:2021, on supply chain continuity.

8.2 Business impact analysis and risk assessment

Clause 8.2.1 asks for a process that sets the context and the criteria and evaluates the potential impact of a disruption, requires the business impact analysis and the risk assessment to be reviewed at planned intervals and when significant changes occur, and leaves you to decide which of the two comes first. Clause 8.2.2 is the business impact analysis, and its outputs are what an auditor samples: impact criteria you have approved; the activities that deliver your products and services; for each one, a picture of how the damage from stopping it grows over time; two time frames read off that picture, the point at which the damage becomes unacceptable and an earlier target for resuming at a reduced but acceptable level; the prioritised activities that result; and the people, information, technology, sites, suppliers and money each of them needs. Clause 8.2.3 is the risk assessment: what could disrupt those prioritised activities and their resources, how likely and how bad, and which risks need treatment. It can follow ISO 31000, and its treatment decisions feed clause 8.3. Our worked ISO 22301 business impact analysis takes one activity through every step.

8.3 Strategies and solutions

From the business impact analysis and the risk assessment come strategies, each made of one or more solutions. Clause 8.3 asks you to identify options that make a disruption less likely, shorter or less damaging, given your objectives, your appetite for risk and the cost of each option; to choose among them by whether they meet the time frames and capacity in the BIA; to work out the resources the chosen solutions need; and to implement them so they can be activated when needed. The most telling test is arithmetic. Take the shortest recovery time in the BIA and ask when the solution was last shown to meet it. A nightly backup restored onto rebuilt hardware cannot meet a two hour recovery time, however well it is documented.

8.4 Plans and procedures

Clause 8.4.1 sets the expectation for the whole response: a structure that gives timely warning and communication, plus plans and procedures for managing the organisation during a disruption and carrying out the solutions. Procedures have to be specific about the first steps and still flexible enough for a disruption that does not match the scenario. Clause 8.4.2 is the response structure: one or more teams with stated roles, named members and deputies who hold the authority to act, able to judge a disruption against thresholds that justify a formal response, put life safety first, activate solutions and communicate. Clause 8.4.3 covers warning and communication, including how you keep channels working during a disruption, deal with the media and record what was decided, and these procedures have to be exercised. Clause 8.4.4 sets out what the plans contain, and clause 8.4.5 asks for a documented process for moving from temporary measures back to normal operations.

A plan passes the auditor's reading test if someone who did not write it could follow it in the middle of the night. That takes thresholds and the names of people who may declare a disruption, actions by time, contact routes that work when email and the corporate phone system do not, and a stand-down and recovery path that includes reconciling whatever was done by hand.

8.5 Exercise programme and 8.6 evaluation

Clause 8.5 asks for an exercise and testing programme that validates your strategies and solutions over time, and it has its own section below. Clause 8.6 asks you to evaluate whether the business impact analysis, risk assessment, strategies, solutions, plans and procedures are still adequate and effective, using reviews, exercises, tests, post-incident reports and performance evaluation, at planned intervals and after an incident, an activation or a significant change, and to update the documents promptly. The standard also expects a periodic evaluation of your compliance with the legal and regulatory requirements you identified under clause 4.2.2. The evidence an auditor asks for is the evaluation after the last exercise or incident, and the plan changes that followed it.

How do you keep the BIA arithmetic consistent?

Two numbers per prioritised activity carry most of the audit weight. The maximum tolerable period of disruption (MTPD) is the time after which the damage from not resuming the activity becomes unacceptable. The recovery time objective (RTO) is the earlier target for resuming it at a minimum acceptable capacity. The business impact analysis clause describes both time frames and gives the two labels only in notes; neither is a term defined in clause 3 of ISO 22301:2019, which is one reason methodologies drift. Define both in your own BIA methodology.

Two rules then make the analysis hold up. First, every RTO sits inside its MTPD, with room left for detecting the disruption and deciding to invoke the plan. Second, nothing the activity depends on (an ICT service, a supplier, a site, a team) takes longer to recover than the activity's RTO. Auditors test both by sampling, and a failure of either is a finding.

Take card authorisation at a payment institution. The approved impact criteria say the damage becomes unacceptable after four hours, so the MTPD is four hours. Detecting a failure and deciding to invoke the plan took thirty minutes in the last exercise, and recovery to 70% of peak authorisations takes ninety minutes, so the RTO is two hours, with two hours of margin. Now the dependencies:

Data is a separate question. The recovery point objective (RPO), the most data you accept losing for each data set, is not a term ISO 22301 defines, and the business impact analysis clause does not mention it; it comes from ISO's guidance and from regulation. DORA Article 12(6) requires financial entities to set recovery time and recovery point objectives for each function, and APRA's CPS 230 asks for a tolerance for the maximum data loss of each critical operation. It belongs in the BIA record anyway, because information and data is one of the resource types every solution has to cover. The full method, with impact scales, minimum capacity and an RPO for each data set, is in our ISO 22301 business impact analysis worked example.

What does an exercise programme have to cover, and how often?

An auditor looking at clause 8.5 wants four things. A written programme that, over the cycle, validates every strategy and solution and involves every response team. Exercises built on planned scenarios with stated objectives, scenarios that follow the BIA and the risk assessment and that get harder over time. A formal report after each one, with outcomes, recommendations and actions. And evidence that the actions were carried out, because the standard requires you to act on what the exercises show. The programme has to run at planned intervals and when something significant changes, and the warning and communication procedures of clause 8.4.3 have to be part of it.

ISO 22301 sets no interval. A yearly cycle is the practical minimum, because a certification body visits every year and will ask what was exercised since the last visit. Regulators are now more specific than the standard:

ISO's security and resilience vocabulary treats a test as a kind of exercise with a pass or fail outcome; an exercise need not have one. The difference matters for the programme. A tabletop exercise can show that the crisis team knows who decides; only a test shows that a restore finishes inside the RTO. A programme made only of tabletops cannot prove a single technical recovery.

Each exercise produces a report the auditor can sample: date, scenario, objectives, what happened, what failed, and actions with owners and dates. An exercise without a report does not count as validation, and actions that stay open from one exercise to the next tell the auditor the programme is not learning. DORA's separate digital operational resilience testing programme under Articles 24 to 27 looks for security weaknesses, a different question, and is covered in our guide to the DORA operational resilience testing programme.

What does clause 9 require: monitoring, internal audit and management review?

Clause 9.1 asks you to decide what to monitor and measure, how, when and by whom, to keep the results and to evaluate the system's performance. Indicators that measure capability serve better than ones that count activity: the share of prioritised activities exercised in the cycle, recovery achieved against RTO in tests, the age of open exercise actions, plans reviewed on time, and suppliers with current continuity evidence.

Clause 9.2 asks for internal audits at planned intervals against your own requirements and the standard, run through a programme that covers every clause and the whole scope over the cycle, by auditors who do not audit their own work. ISO's guidance on auditing management systems is ISO 19011, whose 2026 edition ISO published on 27 May 2026. For a financial entity there is one more condition: DORA Article 11(3) requires the ICT response and recovery plans to be subject to independent internal audit review, so name them in the audit scope.

Clause 9.3 asks top management to review the system at planned intervals. The review has to look at how the system is performing and what has changed (exercise results, audit findings, real disruptions and near misses, the BIA and risk picture, feedback from interested parties) and has to end in decisions on scope, on updates to the BIA, strategies and plans, on resources and on improvement. An auditor reads the minutes, picks one decision and looks for the action that followed it.

What does clause 10 require: nonconformity and improvement?

Clause 10.1 applies whenever something fails: an audit finding, an exercise that missed its RTO, a real disruption, a plan review that slipped. You correct the failure and deal with its consequences, look for the cause, check whether the same thing exists or could happen elsewhere, remove the cause, check that the action worked and keep a record. Keep correction (fixing this instance) apart from corrective action (removing the cause), and give both an owner and a date. Clause 10.2 asks for continual improvement, which an auditor recognises as changes you can trace to exercise reports, incidents, audits and indicators.

Which documents does ISO 22301 require?

The standard names documented information in specific places and adds whatever else you decide the system needs. The first group below is what the clauses name. The second is what a certification auditor will still ask to see, because there is no other way to show that the process ran.

How does ISO 22301 certification work?

Certification is done by a certification body accredited against ISO/IEC 17021-1, whose auditors meet the competence requirements of ISO/IEC TS 17021-6:2014, the part written for business continuity management systems. Accreditation and certification are different things: a national accreditation body accredits the certification body, and the certification body certifies you. Before you sign, check that the accreditation scope covers ISO 22301.

The cycle under ISO/IEC 17021-1, clause 9, runs like this. Stage 1 checks readiness: the documented information, the scope, the site conditions, and whether internal audits and management reviews are planned and being performed. Stage 2 checks implementation and effectiveness on site, by sampling records, interviewing people and following activities through the chain. A major nonconformity, one that affects the system's ability to achieve its intended results, has to be corrected and the correction verified before a certificate is granted; for a minor one the certification body reviews and accepts your plan for correction and corrective action. The certificate runs for three years, with surveillance audits at least once a calendar year, the first within twelve months of the certification decision, and a recertification audit before the certificate expires. Our guide to what happens in an ISO 27001 audit describes the same mechanics in the room, and they transfer directly.

Go into stage 2 with the system having run once from end to end: an approved BIA, solutions in place, plans, at least one exercise with a report, an internal audit and a management review. If you already hold ISO 27001, the two can be audited together under IAF MD 11:2023, the mandatory document on integrated audits, provided each system is complete in its own right. Certification bodies quote in audit days, driven mainly by headcount in scope, the number of sites and complexity; our guide to ISO 27001 certification cost explains how those quotes are built, and the logic carries over.

How do DORA, NIS2, ISO 27001 and CPS 230 rely on an ISO 22301 BCMS?

None of them names ISO 22301. We searched the Official Journal texts of DORA, its ICT risk management RTS (Delegated Regulation (EU) 2024/1774), NIS2 and the NIS2 Implementing Regulation (EU) 2024/2690: the standard does not appear in any of them. What they do is describe outcomes that a BCMS is built to produce, and the clause that produces each one is usually obvious.

For a financial entity in the EU the consequence is practical: the DORA continuity file is largely a subset of the BCMS file, plus the ICT-specific additions DORA and its RTS spell out. Our comparison of ISO 22301 vs DORA goes article by article. NIS2's Article 21(2)(c) names business continuity, backup management, disaster recovery and crisis management among the minimum measures, and our guide to the NIS2 Article 21 requirements covers the rest of that list. For an information security management system, controls A.5.29 and A.5.30 assume that recovery objectives already exist; they come from a business impact analysis, which ISO 27001 does not ask you to perform. Our guide to the ISO 27001 Annex A controls shows where those two controls sit.

What do the other results get wrong?

We read the ten pages ranking for "ISO 22301 requirements" and "ISO 22301 clauses" in October 2026. Most are short overviews, and several make mistakes that matter if you build from them.

Clause numbers. The page ranking first places the business continuity policy under Clause 6; it is clause 5.2, under leadership. A checklist puts the business impact analysis and the risk assessment in Clause 6, strategies and plans in Clause 7 and training in Clause 8; they are 8.2, 8.3 and 8.4, and competence is 7.2. Another page lists the clauses and skips Clause 5 entirely, and a clause guide says clause 1 sets the boundaries of your BCMS, when clause 1 is the scope of the standard itself and the boundary of your system is clause 4.3. Auditors write findings against clause numbers, so a gap list built on the wrong ones sends evidence to the wrong place.

Templates and annexes. One page says clause 8.6 provides guidance including a template. ISO 22301 is a requirements document: ten clauses and a bibliography, with no annexes and no templates. The guidance lives in ISO 22313 and the technical specifications.

The normative reference. A checklist says clause 2 lists no normative references. It lists one, the vocabulary ISO 22300, cited without a date so that the latest edition applies.

Definitions. Two pages present abbreviations such as MAO, MTPD, RTO, RPO and MBCO as the standard's own terms. Clause 3 of the 2019 edition defines none of them: in ISO's own sample of the standard the term after management system is measurement, and the term after products and services is requirement. MAO and MBCO belong to material written for the 2012 edition. Your BIA methodology has to define these terms itself, or two departments will measure different things.

Audit and exercising. One overview says clause 8 begins with an internal audit that tests the plans. Internal audit is clause 9.2 and checks the management system; validating the plans is exercising and testing under clause 8.5. The same page uses accreditation where it means certification: certification bodies are accredited, organisations are certified.

Renewal. One guide says annual assessments renew the certificate. Yearly surveillance audits keep it in force; renewal is the recertification audit before the three year certificate expires.

The amendment and the next edition. Only one of the ten pages mentions the 2024 climate amendment or the work on a third edition, which matters because the amendment is already part of what you are audited against.

Where do you stand? A fill-in check

Answer these for your own BCMS. A blank row is a gap an auditor will find.

A free compliance check gives you a baseline across the frameworks you run, and the questions above map onto the ISO 22301 gap assessment described next.

How does Venvera help you run ISO 22301?

Venvera keeps the BCMS in one place: every requirement, owner, task, deadline and piece of evidence in one dashboard instead of Outlook, Excel and mail chains. The ISO 22301 module carries 45 requirements across clauses 4 to 10, each with a status, an owner and its evidence. Its 43-question gap assessment in eight areas asks the questions this page raises, among them whether every RTO sits inside its MTPD, whether a recovery point objective is set for each data set and whether minimum capacity is stated in measurable terms. Fourteen recurring obligations sit on the compliance calendar, from the BIA review and the exercise programme to the internal audit, the management review and a quarterly performance report. And ten policy templates cover the documents a BCMS needs, including a business continuity policy, a BIA methodology, an exercise and testing programme and a crisis communication plan.

On the crosswalk, three ISO 22301 requirements connect to other frameworks. The business continuity plans requirement, clause 8.4.4, sits in the business continuity group with DORA, NIS2, ISO 27001, SOC 2, NIST CSF, NIST SP 800-53, HIPAA, GDPR, NDPA, the Saudi ECC and the UAE IA. Competence for continuity roles, clause 7.2, maps to NIST SP 800-53 CP-3. The exercise programme, clause 8.5, maps to NIST SP 800-53 CP-4. Venvera manages the programme and its evidence; it does not certify you, run your exercises or recovery tests, or replace your certification body.

Plans start at EUR 399 per month for two frameworks (Basic) and EUR 899 per month for five (Professional), with Enterprise on request; see pricing. You can start a 14-day Professional trial with no credit card, or book a demo and we will walk through the ISO 22301 workspace with you.

Frequently asked questions

Is ISO 22301 mandatory?

No. It is a voluntary standard. What makes it common is that customers ask for it in contracts, and that rules such as DORA, NIS2 and APRA's CPS 230 require continuity outcomes that a BCMS is built to produce, without naming the standard.

How many requirements does ISO 22301 have?

Its requirements sit in seven clauses, 4 to 10, divided into 26 sub-clauses, and within your scope all of them apply. Venvera splits them into 45 requirements, one for each part an auditor evidences separately.

What is the latest version of ISO 22301?

ISO 22301:2019, with Amendment 1:2024 on climate action. A third edition is in development as ISO/CD 22301; ISO's catalogue shows its committee draft comment period closed (stage 30.60) and no publication date.

Does ISO 22301 have controls like ISO 27001 Annex A?

No. The standard has no annexes, no control list and no Statement of Applicability. You decide the solutions through clause 8.3, from your own business impact analysis and risk assessment.

What is the difference between ISO 22301 and ISO 22313?

ISO 22301 states requirements and can be certified. ISO 22313:2020 is guidance on using it, clause by clause, and is itself being revised. ISO/TS 22317:2021 gives guidance on business impact analysis and ISO/TS 22318:2021 on supply chain continuity.

Are MTPD and RTO defined in ISO 22301?

The business impact analysis clause describes both time frames and gives the labels only in notes; neither is a defined term in clause 3 of the 2019 edition. Define them in your BIA methodology, using your regulators' terms where they have them.

Does ISO 22301 require a recovery point objective?

The standard does not define the term, and its business impact analysis clause does not mention it. Data enters through the resources every solution has to cover, which include information and data. DORA Article 12(6) and APRA CPS 230 paragraph 38 do require a data loss objective or tolerance, so financial entities set one per function or operation.

How often must business continuity plans be tested under ISO 22301?

The standard says at planned intervals and when significant changes occur, without a number. A yearly cycle is the practical minimum. DORA requires the ICT continuity plans to be tested at least yearly, and CPS 230 requires an annual business continuity exercise.

What is the difference between an exercise and a test?

In ISO's security and resilience vocabulary a test is a kind of exercise with a pass or fail outcome. A tabletop exercise can validate decisions and roles; only a test can show that a restore meets its RTO.

Which documents are mandatory for ISO 22301?

The clauses name the legal requirements register, the scope, the policy, the objectives, competence evidence, process records, communication procedures, the plans, the recovery process, post-exercise reports, monitoring results, audit and review results and nonconformity records. Auditors will also expect the BIA, the risk assessment and the strategy decisions.

Does the business impact analysis have to come before the risk assessment?

No. Clause 8.2.1 lets you choose the order. Analysing impact first keeps the priorities independent of whichever threats are in the news.

Can the BCMS cover only part of the organisation?

Yes. Clause 4.3 lets you draw the scope around part of the organisation, with documented and explained exclusions. Anything a prioritised activity depends on must then sit inside the scope or be managed as a supplier.

How long is an ISO 22301 certificate valid?

Three years under ISO/IEC 17021-1, with surveillance audits at least once a calendar year, the first within twelve months of the certification decision, and a recertification audit before expiry.

Can ISO 22301 and ISO 27001 be audited together?

Yes. IAF MD 11:2023 sets the rules for integrated audits against two or more standards. Each system still has to meet its own standard in full, so name the BCMS explicitly in the shared audit programme and management review.

Does the 2024 climate amendment change what we have to do?

It adds a requirement to decide whether climate change is a relevant issue in clause 4.1, and a note in clause 4.2 that interested parties can have climate requirements. IAF treated it as a clarification without a transition period. Record the decision and the reasoning.

Does ISO 22301 certification satisfy DORA?

No. DORA does not name the standard and a certificate does not discharge it, but a BCMS produces much of the Article 11 evidence. Our ISO 22301 vs DORA comparison lists what to add.

Will the third edition affect our certificate?

Not until it is published. Certification continues against the 2019 edition with its amendment. The International Accreditation Forum has set transition periods for past revisions of management system standards, so expect one when the new edition appears.

Does Venvera certify ISO 22301?

No. Certification is done by an accredited certification body. Venvera organises the requirements, the gap assessment, the recurring duties and the evidence you prepare for the audit and keep between audits.

Primary sources

The clause structure, the foreword's description of the 2019 revision and the clause 2 and clause 3 facts are taken from ISO's official sample of ISO 22301:2019. Publication dates and development stages are from ISO's open data catalogue, read on 19 October 2026, and the catalogue pages for ISO 22301:2019, Amendment 1:2024 and ISO/CD 22301. The amendment's content is from the ISO and IAF joint communique of 22 February 2024. Certification mechanics are from ISO/IEC 17021-1:2015, ISO/IEC TS 17021-6:2014 and IAF MD 11:2023. The regulatory provisions are from Regulation (EU) 2022/2554, Commission Delegated Regulation (EU) 2024/1774, Directive (EU) 2022/2555, Commission Implementing Regulation (EU) 2024/2690 and APRA Prudential Standard CPS 230. The descriptions of each clause are our own summaries; read the standard before relying on a specific requirement.