Skip to main content
QHSE Glossary

ISO 22301

ISO 22301 is essential for business continuity.

ISO 22301

ISO 22301 (Business Continuity Management) is a critical concept in quality, health, safety, and environmental management.

What Is ISO 22301?

ISO 22301:2019 is the international standard for business continuity management systems (BCMS). It specifies requirements to plan for, establish, implement, operate, monitor, review, maintain, and continually improve a management system to protect against, reduce the likelihood of, prepare for, respond to, and recover from disruptions. Key elements include: business impact analysis (BIA), risk assessment, business continuity strategies, business continuity plans, exercise and testing, and management review. ISO 22301 applies to all organisations regardless of type, size, or nature — from SMEs to multinational corporations, government agencies, and critical infrastructure operators.

ISO 22301 Requirements Under UK Law

ISO 22301 certification is not legally mandatory in the UK but is increasingly required for: financial services (FCA operational resilience requirements from March 2022), healthcare (NHS England business continuity framework), critical national infrastructure (NIS Regulations 2018), and government supply chains. The Civil Contingencies Act 2004 requires Category 1 and 2 responders to maintain business continuity plans. BS 25999 (the predecessor) was developed by BSI in the UK. The Cabinet Office promotes business continuity planning through its National Resilience Standards.

Key Components of ISO 22301

  • Business Impact Analysis (BIA)
  • Risk assessment
  • Business continuity strategy
  • Business continuity plan (BCP)
  • Incident response plan
  • Crisis communication plan
  • IT disaster recovery plan
  • Exercise and testing programme

ISO 22301 in Practice

A financial services company (400 employees, 3 offices) implements ISO 22301 using Q-Hub. Their BIA identifies 28 critical business processes with maximum tolerable downtime ranging from 1 hour (payment processing) to 72 hours (facilities management). Q-Hub stores all 28 business continuity plans with defined recovery procedures, contact trees, and resource requirements. Exercises are scheduled quarterly — tabletop exercises alternate with live activation tests. During a real incident (building flood in February 2024), the incident response plan in Q-Hub guided activation of the secondary site — 380 employees relocated and operational within 4 hours.

How to Manage ISO 22301 with Q-Hub

Q-Hub provides comprehensive tools for ISO 22301 management. The Automated Workflows module handles the core requirements, integrated with document control, audit scheduling, training management, and KPI dashboards to ensure your ISO 22301 processes are audit-ready at all times.

Related Terms

Want to see how Q-Hub handles ISO 22301 in practice? Book a demo or see pricing.

Related QHSE Terms

  • AS9100 — The aerospace quality management standard, based on ISO 9001 with additional requirements for aviati
  • Audit — A systematic, independent examination of processes, products, or systems to verify compliance with d
  • Bow-Tie Analysis — A visual risk assessment method that maps the causes of an event, the event itself, its consequences
  • CAPA — Corrective and Preventive Action — a systematic approach to investigating root causes of non-conform
  • COSHH — Control of Substances Hazardous to Health — UK regulations requiring employers to control exposure t
ISO 20121 Back to Glossary ISO 27001