ISO 22301, without the spreadsheets.
Show customers you can keep running when something breaks.
What is ISO 22301?
ISO 22301 specifies a business continuity management system (BCMS). It asks you to understand which activities matter most, plan how to keep them running through disruption, and exercise those plans so they work when needed.
Who needs it
- Providers of critical services with uptime commitments
- Suppliers to financial entities under DORA
- Organisations that want continuity to be auditable, not assumed
What ISO 22301 looks at
Business impact analysis
Identify prioritised activities and the time within which they must resume.
Continuity strategies and plans
Documented plans to respond to and recover from disruption.
Exercising and testing
Regular exercises that show the plans work.
Evaluation and improvement
Learn from exercises and incidents and update the plans.
How Beviso gets you there
- Continuity controls with backup and monitoring evidence from your infrastructure
- Business continuity policy template
- Shared management-system evidence with ISO 27001
8 ISO 22301 controls, ready on day one
These controls are loaded when you enable ISO 22301, each with the tools that can supply its evidence automatically. You can add your own controls alongside them.
6.1
Business Continuity Risk Assessment
The organization shall establish, implement, and maintain formal risk assessment processes for business continuity.
Evidence from
- PagerDuty
- Datadog
- Grafana
- AWS
8.2
Business Impact Analysis
The organization shall conduct a business impact analysis to understand the impact of disruptions over time.
Evidence from
- Notion
- Jira
- Ironclad
8.3
Business Continuity Strategy
The organization shall select appropriate business continuity strategies to protect prioritized activities.
Evidence from
- PagerDuty
- Datadog
- AWS
8.4
Business Continuity Plans and Procedures
The organization shall document business continuity plans that enable it to recover or continue activities at a pre-determined minimum acceptable level.
Evidence from
- PagerDuty
- ServiceNow
- Jira
- Notion
8.5
Exercise Programme
The organization shall establish, implement, and maintain a formal exercise programme to test business continuity plans.
Evidence from
- PagerDuty
- Jira
- Notion
8.6
Evaluation of Business Continuity Documentation
BCM procedures and plans shall be evaluated and updated regularly to reflect operational changes.
Evidence from
- Notion
- Ironclad
- Jira
9.1
Performance Evaluation and Monitoring
The organization shall monitor, measure, analyse, and evaluate business continuity management performance.
Evidence from
- Datadog
- Grafana
- PagerDuty
- New Relic
10.1
Nonconformity and Corrective Action
When a nonconformity occurs the organization shall take action to control and correct it and deal with the consequences.
Evidence from
- PagerDuty
- ServiceNow
- Jira
ISO 22301 questions
- How does ISO 22301 relate to ISO 27001?
- ISO 27001 includes controls for ICT readiness for business continuity. ISO 22301 covers continuity for the whole organisation in much more depth.
Often run alongside ISO 22301
ISO 27001
Build an information security management system an auditor will certify.
DORA
Prove operational resilience to EU financial regulators — and to the banks you supply.
NIS 2
Meet the EU’s cybersecurity baseline before the regulator asks.
SOC 2
Give US customers the SOC 2 report their procurement team asks for.
Start your ISO 22301 programme today.
Free while Beviso is in beta. No credit card required.
Get started free