ISO 22301 is often cited and rarely read. For an SME manager or a business continuity lead, the point is not to know the standard by heart, but to understand what it asks you to organise and how that translates into the day-to-day running of a business.
This article is an educational overview. It does not reproduce the standard and is not a certification checklist. It draws on official presentations and publicly available information. The examples and questions are practical suggestions, not an exhaustive interpretation of the requirements. The company used as a running example, Atelier Dumont, a 60-employee manufacturer of machined parts, is entirely fictional.
Which edition, and which standard for what?
What ISO publishes (sources at the end of the article):
- The current edition is ISO 22301:2019, second edition, published in October 2019. It specifies requirements to implement, maintain and improve a business continuity management system.
- An amendment, ISO 22301:2019/Amd 1:2024, published in February 2024, adds climate-related provisions: the organisation must determine whether climate change is a relevant issue for it.
- At the time of our review, the ISO website lists the standard as “to be revised”. A new edition is therefore in preparation: check which version applies before starting any certification project.
- ISO 22361:2022 is a different standard. It provides guidelines on crisis management: crisis management capability, leadership, decision-making, communication, training and learning. These are recommendations, not certifiable requirements like those of ISO 22301.
In short: ISO 22301 organises the continuity of your activities over time; ISO 22361 informs the strategic handling of a crisis. The two complement each other without overlapping.
The ten areas to understand
ISO 22301 follows the structure shared by management system standards: context (clause 4), leadership (5), planning (6), support (7), operation (8), performance evaluation (9) and improvement (10). Clause 8 contains the operational core of business continuity.
The ten areas below are our educational grouping of the standard’s main themes, not its official structure: clause 8, in particular, is split across several themes. Titles quoted in inverted commas come from the standard’s table of contents.
1. Context and scope (clause 4)
Objective: understand your environment and interested parties, and decide what the arrangements cover.
Fictional example: Atelier Dumont includes its production site and logistics, but for now excludes its sales office abroad, and documents why.
Useful question: can you explain, in one sentence, what is in scope and why?
2. Leadership and management commitment (clause 5)
Objective: business continuity is owned by top management, with a policy and assigned roles.
Fictional example: the managing director signs a one-page policy and appoints a business continuity lead and a deputy.
Useful question: who, by name, decides to activate your plans on a Sunday evening?
3. Planning and objectives (clause 6)
Objective: set measurable business continuity objectives and plan how to achieve them.
Fictional example: resume shipments to the three main customers within 48 hours of a major incident.
Useful question: are your objectives quantified, dated and monitored?
4. Resources, competence, awareness and documentation (clause 7)
Objective: provide the means, train the people involved and keep the relevant information up to date.
Fictional example: team leaders attend an annual awareness session; the plans also exist on paper.
Useful question: would your plans still be accessible if your IT systems went down?
5. Impact analysis and risk assessment (clause 8)
In the standard: a section titled “business impact analysis and risk assessment”.
Objective: identify priority activities, how long they can be interrupted before the impact becomes unacceptable, and the risks that threaten them.
Fictional example: machining and invoicing come out as priorities; a prolonged failure of the production server is the main risk.
Useful question: have your recovery priorities been approved by top management?
6. Business continuity strategies and solutions (clause 8)
In the standard: a section dedicated to business continuity strategies and solutions.
Objective: decide how each priority activity will be maintained or resumed.
Fictional example: an agreement with a nearby subcontractor to carry out machining during an outage, and safety stock for two critical parts.
Useful question: does each solution have an identified cost and owner?
7. Response, communication, plans and procedures (clause 8)
In the standard: a section dedicated to business continuity plans and procedures.
Objective: know who does what, how you communicate and how you return to normal.
Fictional example: a three-role response structure, a printed crisis contact list and a procedure for returning to normal operations.
Useful question: could a new employee find the right procedure within ten minutes?
8. Exercising and capability evaluation (clause 8)
In the standard: an “exercise programme” and an “evaluation of business continuity documentation and capabilities”.
Objective: assess response capabilities under the conditions tested and identify the improvements needed.
Fictional example: a tabletop exercise every six months and an IT failover test once a year. The frequencies in this example, like that of the audit in the next area, are not a universal schedule imposed by the standard.
Useful question: when were your plans last tested against a simulated situation?
9. Performance, internal audit and management review (clause 9)
Objective: measure how effective the arrangements are, audit them and report to top management.
Fictional example: an annual internal audit and a management review that decides on investments.
Useful question: has top management reviewed the results of the arrangements this year?
10. Corrective action and continual improvement (clause 10)
Objective: address the gaps identified and make the arrangements progress.
Fictional example: after analysis, each improvement retained is given an owner and a deadline, and its effectiveness is then checked.
Useful question: how many actions from your last exercise have actually been closed?
Exercises: the moment of truth
Exercises connect all the areas: they put priorities, solutions, plans and people to the test. What follows is our practical advice, not the text of the standard.
What an exercise helps you assess:
- understanding of roles and decision-making channels;
- information flow and response times;
- whether procedures and fallback solutions actually work;
- coordination with partners and suppliers.
Observations worth keeping:
- a time-stamped log of events, decisions and exchanges;
- gaps between what the plan says and what actually happened;
- what went well, so it can be reinforced;
- difficulties, described without assigning blame.
To act on the lessons learned, analyse the findings, prioritise improvements, and give each action retained an owner and a deadline. Then check that it has worked.
Important: an exercise, however successful, is not a certification. ISO 22301 certification relies on an audit of the whole management system by a certification body. No tool and no exercise can guarantee it on its own.
First-steps checklist
- Define and write down the scope of your arrangements.
- Obtain written commitment from top management and appoint a lead.
- List your priority activities and their maximum acceptable interruption time.
- Identify a continuity solution for each one.
- Write a first short plan that is available without IT.
- Run a first tabletop exercise and keep the observations.
- Schedule a management review to decide on actions.
- Check the applicable version of the standard before any certification project.
How Exerce-Ease can support your training
Exerce-Ease supports organisational preparedness, training and the use of lessons learned. These services do not constitute ISO 22301 certification.
For SMEs with 10 to 200 employees, a resilience assessment identifies risks, dependencies and priority actions before any investment in software.
The Exerce-Ease platform lets you design a scenario, build a timeline delivered by email, SMS, phone calls and media content, run the exercise on-site or remotely, observe decisions and information flow, then prepare the debrief and an improvement plan.
Exerce-Ease Studio is designed for facilitators: preparing exercise events and expected responses, assigning roles, controlling the pace and adding live injects, recording observations, then reports that bring together the timeline, participants, events and exchanges, exportable in JSON format. These records feed directly into the observations worth keeping described above.
A useful action this week: ask your management team the question from area 2. If the answer is hesitant, that is where to start.
To see how to prepare and run an exercise tailored to your context: https://www.exerce-ease.com/en/contact.php