ISO 22301 in Plain English: Business Continuity That Actually Works When Things Go Wrong

ISO 22301 is the business continuity management standard.

In plain English, it’s about proving your business can keep operating, or recover fast, when something goes wrong — a cyber incident, power outage, supplier failure, staff shortage, site access problem or a major disruption.

For many clients and buyers, ISO 22301 is reassurance: you won’t fall apart under pressure.

What ISO 22301 actually is, no jargon

ISO 22301 is a framework for building a Business Continuity Management System (BCMS). That means you:

• identify what parts of the business are critical
• understand what would stop you delivering
• plan how you respond and recover
• test the plans
• improve continuously

It’s not a plan on a shelf. It’s a working system.

Who ISO 22301 is for

ISO 22301 is relevant for any business, but it’s especially useful if you:

• deliver time-critical services
• operate 24/7 or with on-call response
• have key clients who demand resilience
• rely on suppliers, subcontractors or specific systems

It’s common in security, facilities management, construction supply chains, IT, and any business handling sensitive or high-risk contracts. It pairs naturally with ISO 27001 where the disruption you’re most worried about is a cyber incident.

Why businesses implement ISO 22301

1. Winning tenders and supply chain work. More buyers want evidence you can maintain service during disruption.
2. Reducing downtime. A tested plan reduces chaos and speeds up recovery.
3. Clear roles and decisions under pressure. When something happens, people know who does what.
4. Protecting revenue and reputation. Continuity is often the difference between “we recovered” and “we lost the client”.

What you need to pass ISO 22301

You don’t need a massive binder. You need a system that matches how you operate. Typically you’ll need:

• BCMS scope, policy and objectives
• a Business Impact Analysis (BIA)
• risk assessment and treatment
• continuity strategies — how you keep critical activities going
• response and recovery plans
• a communications plan
• an exercising and testing programme
• internal audits and management review
• corrective actions and continual improvement

What makes ISO 22301 audits fail

• BIA done as a tick-box exercise
• plans that don’t reflect real operations
• no evidence of testing or exercises
• supplier dependencies not considered
• actions identified but not followed through

The fix: keep it practical, test it, and capture evidence.

How long does ISO 22301 take?

At CAW Consultancy, systems can be built within 48 hours and are typically delivered within 72. Certification timing depends on the certification body’s audit schedule, but the system build and preparation doesn’t need to drag on.

Why CAW Consultancy

• 100% pass rate across all standards and certification bodies, including UKAS
• fastest turnaround in the country
• at least 50% cheaper than other UK consultancies
• ISO consultancy packages from £999

Get a continuity system that actually works

If you want ISO 22301 built so it’s practical, auditable and genuinely usable when things go wrong, we’ll tell you exactly what you need — and what you don’t — then get you audit-ready fast.

Need help with this?

CAW Consultancy has helped UK businesses achieve ISO certification and industry accreditation for over 20 years, with a 100% pass rate. See what we do, or send us an enquiry — we’ll tell you what you need, what you don’t, and what it will cost.