ISO 22301:2019: A Clearer Standard for Business Continuity
The second edition of ISO 22301 was published in October 2019. The requirements are largely the same, with a clearer structure and less prescriptive wording.
Key points
- ISO 22301:2019 was published in October 2019 and replaces the 2012 edition.
- The changes are mostly in structure and terminology, not in the level of requirement.
- The core remains business impact analysis, risk assessment, strategies, plans and exercises.
What stays the same
A business continuity management system still has to identify the organisation’s prioritised activities, the impact of disruption over time, and the resources needed to resume them within agreed timeframes.
What is clearer
- Clause 8 is reorganised to follow the logical sequence from analysis to plans
- Repetition was removed and terms were simplified
- Requirements for top management are less prescriptive about how commitment is shown
- A new subclause on planning changes to the system
Why it matters now
Customers and regulators increasingly ask suppliers of critical services to prove that they can keep operating. An organisation that already runs ISO 9001 can build business continuity on the same management structure.