Context of the organisation
Understand your organisation, interested parties and legal requirements, and set the scope of the BCMS.
ISO 22301 Business Continuity
ISO 22301 business continuity, built for the day everything stops.
Cyber attacks, cloud outages and supplier failures never arrive at a convenient time. Cybergen helps you build a business continuity management system (BCMS) that keeps your priority activities running, proves it through exercises and prepares you for ISO 22301 certification.
Illustrative scenario, not live data
ISO 22301ISO 22301:2019Impact analysisContinuity plansExercisesInternal auditCertification support
What is ISO 22301?
The international standard for business continuity management
ISO 22301 is the international standard that sets out the requirements for a business continuity management system (BCMS). It helps organisations prepare for, respond to and recover from disruption, so they can keep delivering their most important products and services at an acceptable level when something goes wrong.
A BCMS is more than a plan in a drawer. It identifies what matters most, how quickly it must be recovered and what it depends on, then puts tested strategies, plans and people in place and keeps improving them. ISO 22301 is certifiable, so an accredited certification body can independently confirm your BCMS meets the standard.
- Covers any disruption: cyber attack, cloud or IT outage, supplier failure, loss of a site or key people
- Built on a business impact analysis, so effort goes where it matters
- Proven through exercises and tests, not assumptions
ISO 22301 at a glance
- Full title
- ISO 22301:2019 Security and resilience. Business continuity management systems. Requirements
- Edition
- 2019, with Amendment 1:2024 (climate action changes)
- What's next
- A revision is under way at ISO. We will help you transition when it is published
- Guidance
- ISO 22313 (using ISO 22301) and ISO/TS 22317 (business impact analysis)
- Certificate
- Valid for three years, with annual surveillance audits
- Issued by
- An independent, accredited certification body
Scenario: a Microsoft outage
What if Microsoft stopped working?
It is 09:12 on a Monday. Outlook won't load, Teams is down, staff can't open their files and anything that uses Microsoft sign-in is failing. For most organisations, Microsoft is the biggest single dependency they have never planned for. It has happened before, and it will happen again.
29 OCTOBER 2025A global Azure outage
An inadvertent configuration change to Microsoft's Azure Front Door service disrupted Microsoft 365, Outlook, Teams and Azure-hosted services worldwide for around eight hours. Airlines, airports, banks and retailers reported problems.
19 JULY 2024The faulty CrowdStrike update
A defective security software update crashed an estimated 8.5 million Windows devices, according to Microsoft. Microsoft itself wasn't at fault, which is exactly the point: everything your Windows estate depends on is a dependency too.
What stops when Microsoft stops
The impact goes far beyond email. This is what a typical Microsoft 365 organisation loses.
Critical
EmailOutlook and Exchange OnlineCustomer and supplier email stops, along with password resets and alerts sent by email.
Critical
Calls and meetingsMicrosoft TeamsChat, meetings and Teams Phone go silent, including the channel you would normally use to coordinate a response.
Critical
FilesSharePoint and OneDriveContracts, procedures, price lists and often the continuity plan itself are suddenly out of reach.
Critical
Sign-inMicrosoft Entra IDSingle sign-on to your CRM, finance, HR and other cloud apps can fail too, even though they aren't Microsoft products.
High
DevicesWindows laptops and serversA faulty update or widespread fault can leave devices unable to start, as the world saw in July 2024.
High
Device and security managementIntune and DefenderYou may lose the ability to manage, patch or monitor devices just when attackers look for an opening.
High
Hosted servicesAzure apps and websitesCustomer portals, APIs and websites hosted in Azure can go offline or become unreachable.
Medium
AutomationPower PlatformApproval flows, reports and integrations quietly stop running, and backlogs build up unseen.
Play the scenario
The same outage, two very different days
Switch between an organisation with no business continuity management system and one that has implemented ISO 22301. Select any step to jump to it.
09:12Outage begins
Nobody knows what is happening
Staff assume it is a local problem. IT is swamped with calls it can't answer, because the helpdesk runs on Teams.
Detected and confirmed
Monitoring flags the outage. The on-call manager confirms it on Microsoft's service health page and alerts the incident team by text message.
Business impact
09:30First 20 minutes
Who's in charge?
Managers can't reach each other. There is no agreed backup channel and nobody knows who can make decisions.
Plan invoked
Invocation criteria are met. The incident team meets on its pre-agreed backup channel, using an offline contact list.
Business impact
10:00First hour
Customers start noticing
Emails bounce or go unanswered. The continuity plan, if there is one, is stored in SharePoint and can't be opened.
Customers informed
Pre-approved holding messages go out by text and on the website. Printed and offline copies of the plan are in use.
Business impact
13:00Four hours in
Work grinds to a halt
Sales, finance and service teams sit idle. Someone sets up personal messaging groups and starts sharing customer data on them.
Priority work continues
Manual workarounds from the business impact analysis keep priority activities going. Break-glass accounts give secure admin access.
Business impact
17:00End of the day
Backlog and new risks
Orders, payments and support tickets have piled up. Unapproved workarounds have created data protection risks that now need investigating.
Stable and in control
Priority activities stayed within their recovery time objectives. Every decision and action is logged for review.
Business impact
Day 2Recovery
Counting the cost
Days of catch-up, unhappy customers and awkward questions from the board, insurers and possibly regulators.
Recover and improve
Services resume in priority order. A post-incident review feeds lessons learned back into the BCMS, as ISO 22301 requires.
Business impact
Coordinated responseOver 2 hoursUnder 20 minutes
Priority activitiesStoppedRunning on workarounds
Customer updatesReactive and ad hocPre-approved, within the hour
Illustrative scenario based on real Microsoft 365 and Azure outages
Your Microsoft outage playbook
How ISO 22301 prepares you for it
Every part of the playbook comes straight from the requirements of ISO 22301. We build it with you, then we test it.
01
Know your dependencies
Clause 8.2. A business impact analysis maps which activities rely on Microsoft 365, Entra ID, Azure and Windows, and for how long they can manage without them.
02
Set recovery objectives
Clause 8.2. Agree the maximum tolerable period of disruption and the recovery time objective for each priority activity, so the hard decisions are made in advance.
03
Communicate out of band
Clause 8.4. A backup channel and offline contact tree that don't depend on Microsoft, plus pre-approved messages for staff, customers and suppliers.
04
Keep working and keep access
Clause 8.3. Manual workarounds, offline copies of critical documents, secured break-glass admin accounts and independent backups of Microsoft 365 data.
05
Exercise it
Clause 8.5. Run a Microsoft outage tabletop exercise with leadership and IT, then test the technical recovery steps for real.
06
Learn and improve
Clauses 9 and 10. Review every exercise and real incident, fix what didn't work and report progress to top management.
Rehearse it with your leadership team: Microsoft outage tabletop exercise
Free Microsoft outage resilience check
Could you keep running without Microsoft?
Tick everything that is true for your organisation today. Your score updates as you go, and nothing you tick is sent anywhere.
YOUR SCORE
0%ready
Highly exposed
A Microsoft outage today would likely stop your organisation. ISO 22301 gives you a structured way to close these gaps quickly.
Book a free continuity reviewA quick self-check, not an audit. Our gap analysis gives you the full picture against ISO 22301.
ISO 22301 requirements
What the standard actually requires
Clauses 4 to 10 are mandatory for certification. They follow the Plan-Do-Check-Act cycle and the same high-level structure as ISO 27001 and ISO 9001.
Leadership
Top management commitment, a business continuity policy and clear roles, responsibilities and authorities.
Planning
Address risks and opportunities, set business continuity objectives and plan changes to the BCMS.
Support
Resources, competence, awareness, communication and control of documented information.
Operation
The heart of the standard: impact analysis, risk assessment, strategies, plans, exercises and evaluation.
Performance evaluation
Monitoring and measurement, internal audit and management review.
Improvement
Manage nonconformities, take corrective action and continually improve the BCMS.
The same structure as ISO 27001, so the two standards fit together.
Inside clause 8: how continuity actually works
Clause 8 contains most of the business continuity requirements. This is the cycle we build with you.
Impact analysis and risk assessmentClause 8.2
Strategies and solutionsClause 8.3
Plans and proceduresClause 8.4
Exercise programmeClause 8.5
Evaluation of capabilitiesClause 8.6
Key terms
The numbers that drive your continuity plan
Your business impact analysis produces a small set of numbers for each priority activity. They decide which continuity strategies you need, and how much they should cost.
MTPDMaximum tolerable period of disruption
How long an activity can be disrupted before the impact becomes unacceptable.
RTORecovery time objective
The target time to resume an activity. It must be shorter than the MTPD.
RPORecovery point objective
The point to which data must be restored, which tells you how much data you can afford to lose.
MBCOMinimum business continuity objective
The minimum level of service that is acceptable while you recover.
Illustrative recovery time objectives
How to get ISO 22301 certified
Your path to ISO 22301 certification
Most organisations reach certification in four to nine months, depending on scope. Cybergen prepares and supports you, and an accredited certification body audits you and issues the certificate.
01Scope and gap analysis
- Context and scope
- Benchmark against ISO 22301
- Roadmap and fixed quote
02Business impact analysis
- Priority activities
- MTPD, RTO and RPO
- Dependencies, including cloud and suppliers
03Risk and strategy
- Disruption risk assessment
- Continuity strategies
- Solutions and resources
04Plans and procedures
- Incident response structure
- Continuity and recovery plans
- Communications and warnings
05Exercise and audit
- Tabletop and live exercises
- Internal audit
- Management review
06Certify and improve
- Stage 1 and Stage 2 audits
- Annual surveillance audits
- Continual improvement
Who needs ISO 22301?
Built for organisations that can't afford to stop
ISO 22301 suits any organisation, of any size, that depends on keeping critical services running. It matters most where customers, regulators or contracts demand proof.
Financial services
Operational resilience rules and DORA expect you to stay within impact tolerances during severe disruption.
DORA compliance Essential and digital servicesNIS2 and the UK Cyber Security and Resilience Bill raise expectations on continuity and incident handling.
NIS2 compliance Suppliers to large organisationsTenders and supplier due diligence increasingly ask for evidence of tested continuity arrangements.
Third-party risk Technology, SaaS and managed servicesYour outage is your customers' outage. Certification shows them you are ready.
Technology sector Healthcare, logistics and manufacturingDisruption quickly affects people, goods and safety, so recovery has to be fast and well rehearsed.
Healthcare sector Anyone who runs on Microsoft 365Which today is most organisations. One outage can stop email, files, calls and sign-in at once.
See the scenarioISO 22301 and ISO 27001
Better together: continuity and security
ISO 27001 asks you to keep information secure during disruption and to have ICT ready for business continuity. ISO 22301 goes much further, covering the whole organisation. Because both share the same structure, they run well as one integrated management system, with shared policies, risk assessment, internal audits and management reviews.
ISO 27001
Protect the information
An information security management system that keeps information confidential, accurate and available.
- Annex A 5.29: security during disruption
- Annex A 5.30: ICT readiness for continuity
- Risk-based security controls
ISO 22301
Keep the organisation running
A business continuity management system covering people, premises, suppliers and technology, not just information.
- Business impact analysis
- Continuity strategies and plans
- Exercise and testing programme
Planning both? Explore ISO 27001 certification
How we help
ISO 22301 support at the level you need
A quick health check, a full implementation or someone to run your BCMS for you. Every engagement starts with a fixed quote.
ASSESS
Know where you stand
- Discovery workshop and scope
- Gap analysis against ISO 22301
- Microsoft and cloud dependency review
- Pre-certification readiness review
IMPLEMENT
Get certified with us
- Everything in Assess
- Business impact analysis and risk assessment
- Continuity strategies, plans and playbooks
- Exercises, internal audit and management review
- Support through Stage 1 and Stage 2 audits
MAINTAIN
Stay resilient
- We run your BCMS for you
- Annual exercise programme
- Independent internal audits
- Surveillance and recertification preparation
Part of Cybergen ISO Consultancy
One partner for every ISO standard you need
ISO 22301 is delivered by our ISO Consultancy team, alongside ISO 27001 for information security, ISO 27701 for privacy, ISO 42001 for AI and ISO 9001 for quality. Run several standards as one integrated management system, with shared policies, risk assessments, internal audits and management reviews.
Explore ISO ConsultancyGuides and insights
Learn more about business continuity
What is ISO 22301?
ISO 22301 is the international standard for business continuity management systems (BCMS). It sets out the requirements to plan, establish, implement, operate, monitor, review, maintain and continually improve your ability to keep delivering priority activities during disruption. Organisations can be independently certified against it.
What should we do if Microsoft 365 goes down?
Confirm the outage on Microsoft's service health page, then follow your continuity plan: invoke it if your criteria are met, move the response team to a backup channel that doesn't depend on Microsoft, use offline copies of your plan and contact lists, send pre-approved messages to staff and customers, and switch priority activities to their agreed workarounds. ISO 22301 makes sure all of this is planned and rehearsed before you need it.
Is ISO 22301 certification mandatory?
No. ISO 22301 is voluntary. However, customers, tenders and regulators increasingly expect evidence of tested business continuity, and frameworks such as DORA, NIS2 and operational resilience rules require strong continuity arrangements. ISO 22301 is a recognised way to show them.
How long does ISO 22301 certification take?
Most organisations take between four and nine months. It depends on your scope, how many sites and activities are included and how mature your existing continuity arrangements are. Your BCMS also needs to run long enough to complete exercises, an internal audit and a management review.
What is a business impact analysis?
A business impact analysis (BIA) identifies your priority activities, the impact of disrupting them over time and the resources they depend on. It sets the maximum tolerable period of disruption, recovery time objectives and recovery point objectives that drive your continuity strategies.
What is the difference between ISO 22301 and ISO 22313?
ISO 22301 contains the requirements you can be certified against. ISO 22313 is a guidance standard that explains how to apply those requirements in practice.
What is the difference between business continuity and disaster recovery?
Business continuity keeps priority activities running during disruption, through people, processes, workarounds and communication. Disaster recovery restores the technology, systems and data those activities depend on. ISO 22301 covers both, and they must work together.
How does ISO 22301 relate to ISO 27001?
ISO 27001 requires information security during disruption and ICT readiness for business continuity. ISO 22301 covers continuity across the whole organisation. Both use the same high-level structure, so many organisations run them as one integrated management system.
How often should we exercise our business continuity plans?
ISO 22301 requires an exercise programme at planned intervals and when significant changes occur. Most organisations exercise at least once a year, with more frequent tests for their most critical activities.
Is there a new version of ISO 22301?
The current edition is ISO 22301:2019, with Amendment 1:2024 adding climate change considerations. A revision is under way at ISO. Certification to the current edition remains valid, and we will help you transition when the new edition is published.
Does Cybergen issue the ISO 22301 certificate?
No. We prepare you for certification and support you through the audits. An independent, accredited certification body carries out the Stage 1 and Stage 2 audits and issues the certificate.
Book a free consultation
Get ready for ISO 22301 certification.
Tell us what you need to protect and when. We will recommend the right next step and give you a fixed quote.
Prefer to talk? Call +44 (0) 1865 950 828
Or email [email protected]
Thanks, we've received your enquiry
A member of our team will be in touch shortly.