ISO 22301 · Business continuityISO certification

ISO 22301: when something stops, the company doesn’t.

ISO 22301 prepares the organisation to continue its activities during and after a disruption: a failure, a cyberattack, a supplier that stops. NIS2 and DORA require continuity measures, and 22301 is a recognised way to organise them.

Join the list for ISO 22301 All standards

What it is

Knowing in advance what to do when something stops.

The standard requires a management system that prepares the organisation to continue its activities during and after a disruption: you work out which activities matter most and how long they can stay down, choose the strategies, write the plans and test them. It is under revision, with no release date.

Who needs it

Providers of services with guaranteed service levels
Companies that are a critical link in their clients’ supply chain
Entities in scope of NIS2 or, in the financial sector, of DORA
Companies that already have ISO/IEC 27001 and want to cover continuity too

What it brings you

NIS2 requires business continuity measures — backups, disaster recovery, crisis management — and encourages international standards without imposing one.
Direttiva (UE) 2022/2555, art. 21(2)(c) and art. 25
Since 17/01/2025, DORA has required financial entities to have a comprehensive ICT business continuity policy.
Reg. (UE) 2022/2554, art. 11
In Italian tenders that provide for it, the guarantee is reduced by up to 20%: UNI EN ISO 22301 is among the certifications in Annex II.13.
D.Lgs. 36/2023, art. 106 c. 8 and allegato II.13

The path

From analysis to certificate, in four steps.

1
Impact analysis
Which activities matter most, how long they can stay down, who and what they depend on.
2
Strategies and plans
How you restart, with which resources, who decides during the crisis. All written down before it is needed.
3
Tests and internal audit
The plans are actually tested; then the internal audit and the management review show whether they hold up.
4
Certification audit
The accredited body carries it out in two stages, the second at the company’s premises. The certificate lasts three years, with a surveillance audit every year.

10ISO

How 10ISO will help you

The agents will do the work that repeats itself; decisions stay with you and whoever supports you. 10ISO is coming soon: this is what we’re building.

Impact analysis and plans updated when a process or a supplier changesComing soon
Plan tests scheduled, with the results and the actions that come out of themComing soon
Evidence shared with ISO/IEC 27001 and with the NIS measuresComing soon
The review deadlines of every plan, in one listComing soon

Read alongside

Questions

The first questions people ask about ISO 22301.

Do NIS2 or DORA require ISO 22301?

No. Both require business continuity measures, and NIS2 encourages international standards without imposing one. 22301 is a recognised way to organise and demonstrate them.

Is it worth waiting for the new edition?

The revision is still at an early stage and ISO has not set a date. Today, certification is to the 2019 edition with the 2024 amendment.

Does 22301 integrate with ISO/IEC 27001?

Yes: the two standards share the common structure of ISO management systems, so policy, internal audits, management review and corrective actions are done once for both.

Sources

Every reference on this fact sheet comes from one of these sources, checked on 28/09/2026. If a law or a standard changes, the fact sheet is updated.

Waiting list

We’ll write to you when 10ISO opens.

One minute: who you are, your email and the standard you’re interested in. It’s not a subscription and we don’t ask for a card.