ISO 22301: The Business Continuity Standard, Explained

Q: What's the difference between ISO 22301 and a disaster recovery plan?

A disaster recovery (DR) plan is a technical playbook — restore this database from that backup within so many hours. ISO 22301 is a management system built on top of DR. It requires a Business Impact Analysis (BIA), a risk assessment, executive-level accountability, defined Recovery Time Objectives per business function, tested response procedures, and continual improvement. A DR plan is one artifact inside an ISO 22301 program.

Q: Do we need ISO 22301 if we have SOC 2?

Not necessarily. If your SOC 2 has the Availability Trust Services Criterion in scope, you already run most of the technical continuity controls ISO 22301 asks for. ISO 22301 becomes relevant when (a) international customers ask for the ISO-family standard specifically, (b) a large enterprise deal requires an internationally-certifiable BCMS, or (c) you want a management-system framework — not a point-in-time attestation — for business continuity.

Q: How long does ISO 22301 certification take?

A first-time certification typically runs 6-9 months for a mid-sized SaaS: 2-3 months to build the BCMS artifacts (BIA, risk assessment, business continuity plan, communication plan), 1-2 months to operate them and produce evidence, 1-2 months for Stage 1 and Stage 2 audits by a certification body. Faster if you already run SOC 2 Availability — the technical controls translate directly.

Q: What size company needs ISO 22301?

The standard is size-agnostic. In practice, ISO 22301 shows up on the shortlist when a company hits Series C / Series D revenue scale, sells to international enterprises, or supports critical infrastructure (financial services, healthcare, energy, government). Below that, SOC 2 Availability usually covers the buyer questions being asked.

Q: Is ISO 22301 required by regulation?

Rarely by direct regulation, often by industry rule. EU DORA (Digital Operational Resilience Act) requires financial-sector firms to have operational resilience programs — ISO 22301 is one accepted way to demonstrate it. Some critical-infrastructure regulators reference ISO 22301 by name. Most SaaS vendors adopt ISO 22301 because a customer contract requires it, not because a regulator does.

Q: What's the ISO 22301 recertification cycle?

The certification cycle is three years, with an annual surveillance audit each of the first two years and a full recertification audit in year three. Same rhythm as ISO 27001 and ISO 9001, which is why organizations that already run an ISO ISMS often integrate the BCMS into the same audit cycle.

ISO 22301 is the international standard for business continuity management systems (BCMS). It answers one question: if the operations that generate your revenue stopped — customer platform down, primary data center offline, a supplier failing — how fast could you get them back, and how do you prove that capability to a buyer?

For SaaS vendors, ISO 22301 is the framework that turns "we have a DR plan" into "we have a certifiable BCMS." This guide walks what ISO 22301 covers, who actually needs it, and how it fits with the SOC 2 and ISO 27001 controls you already run.

What ISO 22301 actually is

ISO/IEC 22301:2019 (the current version) is a management-system standard for business continuity. Published by the International Organization for Standardization, it follows the same Annex-SL "high-level structure" as ISO 27001 and ISO 9001 — the same ten clauses, the same Plan-Do-Check-Act loop, the same expectation that top management is accountable for the program.

What ISO 22301 does not do: prescribe a specific recovery time, name specific technologies, or define what "critical" means for your business. Every organization defines its own scope, its own Business Impact Analysis, its own Recovery Time Objectives. What the standard requires is that you do the analysis, define the targets, build the plans, test them, and improve them.

The scope of a BCMS covers three categories of disruption:

Operational — infrastructure failure, application outage, third-party service loss
Physical — office loss, data center loss, natural disaster
Human — pandemic, workforce unavailability, key-person departure

A certified BCMS demonstrates that you can identify what would hurt if lost, plan a response, execute it under pressure, and improve after every real or simulated incident.

Who buys ISO 22301 — and who doesn't

The audience for ISO 22301 is narrower than SOC 2 or ISO 27001. Three profiles show up most often:

International enterprise buyers. Non-US buyers — European banks, Japanese enterprises, Australian government — prefer ISO-family standards over US-attested SOC 2. If your growth roadmap depends on that buyer set, ISO 22301 gets asked for by name.

Critical-infrastructure clients. Financial services, healthcare payors, energy utilities, telecom operators. Their own regulators require operational resilience programs (DORA in the EU, OCC guidance in the US, APRA CPS 230 in Australia). They audit vendors against that same lens.

Regulated industry deals. A specific contract clause requires ISO 22301 or an equivalent internationally-recognized BC standard. This is the "we have to have it or we lose the deal" driver — the least strategic reason but the most common one.

Who doesn't need ISO 22301: early-stage SaaS selling to US buyers. SOC 2 with Availability in scope answers the same questions for that audience at a fraction of the cost.

The clauses that structure a BCMS

ISO 22301 uses the same 10-clause Annex-SL structure as every other ISO management system. Clauses 4-10 are the operational core:

Clause 4 — Context. Define the scope of the BCMS, understand internal and external issues, identify interested parties (customers, regulators, workforce, suppliers).

Clause 5 — Leadership. Top management commits to the BCMS, sets the business continuity policy, assigns roles and responsibilities.

Clause 6 — Planning. Address risks and opportunities, set business continuity objectives, plan changes to the BCMS.

Clause 7 — Support. Resources, competence, awareness, communication, documented information. This is where training and procedures live.

Clause 8 — Operation. The BCMS in flight. Business Impact Analysis, risk assessment, business continuity strategies, business continuity plans and procedures, exercises and testing. Clause 8 is where most first-time programs spend the most effort.

Clause 9 — Performance evaluation. Monitor and measure the BCMS, run internal audits, conduct management reviews.

Clause 10 — Improvement. Corrective actions for nonconformities, continual improvement.

The ISO 22301 service page walks how ShieldKey builds each clause for a first-time program. The ISO 22301 gap guide uses the same structural approach if you want to self-assess.

How ISO 22301 overlaps with SOC 2 Availability

The SOC 2 Trust Services Criterion for Availability covers many of the same operational-continuity controls as ISO 22301. If you have SOC 2 with Availability in scope, you already run:

Backup and restore procedures
Business Continuity Plan (BCP) documented
Disaster Recovery Plan documented
Availability incident response
Monitoring and alerting for availability issues
Post-incident reviews

What ISO 22301 asks that SOC 2 Availability doesn't require at the same depth:

A formal Business Impact Analysis with Recovery Time Objectives per business function, not just per system
A risk assessment methodology specific to continuity threats
Exercise and testing programs with defined types (tabletop, functional, full-scale)
Internal audit of the BCMS on a defined cadence
Management review at planned intervals

The overlap is meaningful. A SaaS vendor with a strong SOC 2 Availability program can typically build the ISO 22301 additions in 2-3 months rather than 6.

How ISO 22301 overlaps with ISO 27001

If you also run ISO 27001, the overlap deepens. ISO 27001:2022 added Annex A control A.5.30 — ICT readiness for business continuity, which explicitly aligns to ISO 22301's technical continuity requirements. Organizations running both often integrate the BCMS into their ISMS documentation to avoid parallel systems.

The Overlap Explorer surfaces exactly where the two standards share controls versus where each goes further. The short version: ISO 27001 covers ICT-side resilience; ISO 22301 covers the wider business — people, premises, suppliers, communications.

What certification actually costs

For a mid-sized SaaS running an existing SOC 2 + ISO 27001 program:

Program build: 8-16 weeks
Certification-body audit fees: $15k-40k for Stage 1 + Stage 2
Annual surveillance audit: $8k-15k per year
Recertification (year 3): comparable to the initial Stage 2

Add internal effort — 200-400 hours of program manager time in year one, dropping to 60-100 hours per year afterwards.

For a first-time program with no ISO experience: double the program build time and expect 400-700 hours of internal effort.

When to sequence ISO 22301 into your compliance stack

We covered sequencing broadly in The SaaS Compliance Stack. For BC specifically, the sequence question is: does ISO 22301 come before or after ISO 27001?

If you already have SOC 2: add ISO 27001 first — it's the broader ISMS foundation that many international buyers ask for by name, and A.5.30 gives you a partial credit toward ISO 22301. Add 22301 second, when a specific buyer or regulator asks for it.

If you don't have SOC 2 yet: SOC 2 with Availability first, ISO 27001 second, ISO 22301 third. That order stages your investment against buyer demand.

If a specific contract requires ISO 22301 now: do it standalone, then loop back and get ISO 27001 next — the ISO 22301 program will feed most of the ISMS documentation.

Frequently Asked Questions

What's the difference between ISO 22301 and a disaster recovery plan? A DR plan is a technical playbook. ISO 22301 is a management system that requires Business Impact Analysis, executive accountability, defined Recovery Time Objectives, tested procedures, and continual improvement. A DR plan is one artifact inside an ISO 22301 program.

Do we need ISO 22301 if we have SOC 2? Not necessarily. SOC 2 with Availability covers most of the technical controls. ISO 22301 becomes relevant when international enterprise customers ask for it by name or when a regulator requires an internationally-certifiable BC standard.

How long does ISO 22301 certification take? Typically 6-9 months for a first-time SaaS: 2-3 months to build, 1-2 months to operate, 1-2 months to audit. Faster if you already run SOC 2 Availability.

What size company needs ISO 22301? Size-agnostic in theory. In practice, Series C+ SaaS selling to international enterprise or critical-infrastructure clients.

Is ISO 22301 required by regulation? Rarely directly. Often referenced as an accepted way to meet operational-resilience rules like EU DORA. Usually adopted because a customer contract requires it.

What's the ISO 22301 recertification cycle? Three years, with annual surveillance audits and a full recertification audit in year three. Same rhythm as ISO 27001 and ISO 9001.

Building an ISO 22301 program?

ShieldKey builds ISO 22301 BCMS programs for SaaS vendors, financial-services firms, and critical-infrastructure clients — integrated with existing SOC 2 or ISO 27001 programs to avoid parallel documentation. If a customer contract or regulator has ISO 22301 on the shortlist, we can scope the fastest defensible path.

Schedule a scoping call →