ISO 22301: mandatory or not, and what certification actually takes

ISO 22301 is the international standard for business continuity management. The question most often asked about it is whether the standard is mandatory. The short answer is no: certification against ISO 22301 is nowhere prescribed by law. The longer answer is that NIS2 and DORA do require organizations to manage continuity demonstrably, and that ISO 22301 is the most widely used way to structure that. This distinction determines whether certification makes sense in your situation.

The full title is ISO 22301:2019, Security and resilience, Business continuity management systems, Requirements. It sets requirements for a management system, not for a recovery plan. That difference is larger than it sounds. A recovery plan is a document; a management system is a cycle with assigned responsibilities, analyses, plans, exercises, internal audits and a management review, run year after year.

The standard is not mandatory, demonstrable continuity often is

NIS2 counts business continuity among the baseline measures that essential and important entities have to take, including backup management, emergency provisions and crisis management. The Dutch implementing act places that duty of care with the designated organizations. No standard appears in the legal text and a certificate grants no exemption, but the duty of care does ask for appropriate measures and for evidence that they work. That evidence has to come from somewhere.

For the financial sector, DORA is more concrete. The regulation calls for an ICT continuity policy, for recovery procedures and for periodic testing of both, and it reaches the ICT service providers of financial entities as well. That points at the third and in practice most common trigger: customers who fall under NIS2 or DORA themselves pass continuity requirements on to their suppliers by contract. Anyone delivering software or hosting to a bank, a hospital or a grid operator gets the question sooner or later, usually through a supplier questionnaire rather than from a regulator.

What the standard actually requires

ISO 22301 follows the High Level Structure that also underpins ISO 27001 and ISO 9001. Clause 4 asks for the context and a substantiated scope, clause 5 for policy and leadership involvement, clause 6 for objectives and the handling of risks, clause 7 for competence, awareness and documentation, clause 9 for monitoring, internal audit and management review, and clause 10 for nonconformities and corrective actions.

The substantive work sits in clause 8. That is where the business impact analysis and risk assessment live, along with the choice of recovery strategies, the continuity plans themselves and the exercise programme. A BCMS that looks complete on paper but leaves clause 8 empty will not pass a certification audit.

The business impact analysis and the figures it produces

The BIA determines which activities take priority and how quickly they have to be back. The standard works with a handful of terms worth keeping apart. The maximum tolerable period of disruption is the point beyond which the damage becomes unacceptable. The RTO sits inside that and is the recovery time you steer on. The minimum acceptable level of service describes what still has to run during the disruption, which is rarely everything. And the RPO expresses in time how much data you may lose.

The BIA almost always surfaces the same discomfort: the recovery time the business names is shorter than what the infrastructure can deliver. That gap is the most valuable outcome of the analysis, because it forces a choice between investing in recovery capability and adjusting the expectation. A second recurring finding is that dependencies outside your own walls are missing. A process that has to be back within four hours but leans on an external supplier with a longer recovery time does not have those four hours.

Testing is where the plans fall apart

The standard asks for an exercise programme at planned intervals, exercises that fit the scope and an evaluation afterwards. It names no frequency. In practice organizations alternate between a tabletop, in which the crisis team walks through a scenario, a technical recovery test in which a system is actually restored, and a broader simulation that also puts communication and decision making to the test.

Paper plans turn out to be incomplete during those exercises almost without exception. Contact details are out of date, a recovery procedure depends on one employee who happens to be on holiday, or the backup exists but has never been restored. An auditor therefore looks not only at whether an exercise took place, but at the evidence around it: the scenario, the participants, the observations, the improvement points and their follow-up. An exercise report without a single improvement point is more a sign that the exercise was too light than that the organization is ready.

ISO 22301 alongside ISO 27001

The two standards complement each other and overlap less than people assume. ISO 27001:2022 contains two Annex A controls on this subject: 5.29 on information security during disruption and 5.30 on ICT readiness for business continuity. They require you to arrange it, not how. ISO 22301 fills in that how.

Because both standards follow the same structure, combining them is straightforward. One risk process, one approach to document control, combined internal audits and a single management review covering both systems. Organizations that already run an ISMS find that most of the work for ISO 22301 sits in clause 8 rather than in the surrounding clauses.

How certification works

The certification audit is carried out by an accredited certification body, in two stages. In stage one the auditor assesses the documentation and readiness: is the scope substantiated, is there a BIA, are there plans. In stage two the auditor tests whether the system actually works. The certificate then runs for three years, with annual surveillance visits and a recertification at the end of the cycle.

The condition is that the cycle has been completed at least once before you enter stage two. So a BIA, approved plans, at least one documented exercise, an internal audit and a management review. The internal audit brings an independence requirement with it: the auditor may not assess their own work, which for smaller teams usually means the internal audit is placed externally.

Whether certification pays off depends in the end on who is asking. If the question comes from customers, a tender or a regulator, a certificate is the shortest answer you can give. Without that question, a solid BIA and a plan that has genuinely been tested deliver nearly all of the substantive value, and the certificate is mostly the paperwork around it.