The international standard for business continuity management. Increasingly asked for alongside ISO 27001, and largely answerable with evidence you already hold.
What is ISO 22301?
ISO 22301:2019 specifies the requirements for a business continuity management system: identifying what the business must be able to keep doing, understanding what would happen if it could not, and putting tested arrangements in place to recover within an acceptable time.
It shares its structure with ISO 27001 and ISO 9001, which is the practical point. The clauses on context, leadership, planning, support, operation, performance evaluation and improvement are the same shape, so an organisation with a working ISMS already has a large part of the management system, the governance, the internal audit programme and the management review.
The work that is genuinely new is the business impact analysis and the testing. The BIA establishes recovery time and recovery point objectives from business consequence rather than from what IT would prefer, and the exercise programme has to actually run. Certification bodies look hardest at both.
Compliance requirements
The mandatory clauses, in the order an auditor works through them. Clauses 4 to 10 are what is tested.
The products and services in scope, the interested parties, and the legal and regulatory requirements the BCMS has to satisfy.
A business continuity policy, top management commitment, and named accountability rather than a role nobody holds.
Activities prioritised by the consequence of their disruption over time, producing recovery time and recovery point objectives grounded in business harm.
The threats to prioritised activities assessed and treated, using a method consistent with the one your ISMS already uses.
Chosen options for continuity and recovery, resourced and approved, covering people, premises, technology, information and suppliers.
Documented response structure, incident communications and recovery procedures that someone other than the author could follow.
A programme of exercises appropriate to the risk, with results recorded and acted on. The most common gap at certification.
Internal audit, management review, and corrective action that demonstrably closes findings.
Audit process
Netru manages the complete CAF compliance journey, from determining applicability through to competent authority submission and ongoing improvement.
We set the scope and assess your current position against all mandatory clauses, reusing everything an existing ISO 27001 ISMS already satisfies.
We run the BIA and derive recovery objectives from business consequence, not from what the infrastructure happens to allow.
Your compliance manager designs the continuity strategies and writes the response and recovery plans.
We put the arrangements in place across people, premises, technology and suppliers, and evidence them.
We design and run the exercises, document the outcomes, and feed the lessons back into the plans.
We manage the certification body through stage one and stage two, and handle any findings.
How Netru delivers it
Our UK-based team has deep experience in the NCSC CAF and NIS Regulations compliance. We assess your posture against all CAF objectives, implement improvements, complete your self-assessment, and manage the competent authority submission process.
Talk to our teamBefore you talk to anyone