Business Continuity and Operational Resilience Standards
Business continuity standards like ISO 22301 and NIST are usually voluntary, but they’re how organizations prove a resilience program to regulators, auditors, customers, insurers, and boards, and show they’re doing more than the bare minimum.
Which operational resilience and business continuity standards matter?
A standard is a document agreed by consensus and approved by a recognized body that sets rules, guidelines, or characteristics for common and repeated use. Meeting a standard’s requirements helps organizations demonstrate compliance with regulatory and customer obligations and build trust. There are different types of standards that our customers leverage Fusion for to help their organization adhere to. Nine standards and frameworks account for most of what resilience programs are built on and audited against. Each section names the issuing body, the current edition, what it covers, and who typically uses it.
ISO 22301: Business continuity management systems
Issuing Body
International Organization for Standardization, technical committee ISO/TC 292 (Security and resilience)
Current Status
ISO 22301:2019, with Amendment 1:2024 adding climate-action considerations to context and planning clauses. A third edition is under development as ISO/CD 22301 with no confirmed publication date; the 2019 requirements remain fully in force.
Core Obligations
Requirements to establish, implement, maintain, and continually improve a business continuity management system (BCMS): leadership and policy, business impact analysis and risk assessment, business continuity strategies and solutions, plans and procedures, exercising and testing, performance evaluation, and management review. It follows the ISO harmonized structure, so it integrates with ISO/IEC 27001 and ISO 9001.
Certifiable
Yes. ISO 22301 is the only standard in the 22300 series an organization can be certified against by an accredited certification body.
Applicable To
Any organization that must keep delivering products and services at an acceptable level through a disruption, or any organization that needs documented proof of that ability for regulators, customers, or insurers.
ISO 22313, ISO/TS 22317, ISO/TS 22318: The ISO 22301 guidance grouping
Issuing Body
ISO/TC 292
Current Status
ISO 22313:2020 (guidance on the use of ISO 22301); ISO/TS 22317:2021 (guidelines for business impact analysis); ISO/TS 22318:2021 (guidelines for supply chain continuity). The two TS documents are Technical Specifications, not full International Standards.
Core Obligations
ISO 22313 mirrors the structure of ISO 22301 clause by clause and explains the intent behind each requirement. ISO/TS 22317 sets out how to run a business impact analysis: prioritized activities, resource dependencies, and the recovery objectives that follow. ISO/TS 22318 extends continuity into supplier relationships, covering supplier criticality, single points of failure, and continuity requirements written into contracts.
Applicable To
BCMS owners implementing or maturing a program, and supply chain and procurement teams that need continuity requirements for critical suppliers.
ISO 22316: Organizational resilience
Issuing Body
ISO/TC 292
Current Status
Current Status
Principles and attributes of organizational resilience: shared vision and purpose, understanding of context, effective leadership, a culture that supports resilience, shared information and knowledge, availability of resources, coordinated disciplines, and continual improvement. It describes resilience as an organizational capability rather than a plan or a system.
Applicable To
Executives and risk leaders framing resilience above the level of business continuity. It is the closest ISO text to enterprise resilience as distinct from operational resilience.
ISO/IEC 27031: ICT readiness for business continuity
Issuing Body
ISO and the International Electrotechnical Commission, joint committee ISO/IEC JTC 1/SC 27
Current Status
ISO/IEC 27031:2025, published May 2025. It is the first revision since the original 2011 edition, which is withdrawn.
Core Obligations
How ICT plans and prepares to meet the organization’s business continuity objectives: the minimum business continuity objective (MBCO), recovery point objective (RPO), and recovery time objective (RTO) for ICT services. The 2025 edition reorganizes the framework from governance through monitoring and review, expands incident response and recovery strategy guidance, and explicitly addresses cloud platforms and third-party ICT providers as dependencies to be assessed and integrated into readiness plans.
Applicable To
IT disaster recovery owners, CIOs, and ICT service providers who need to show that IT disaster recovery capability is tied to business recovery objectives rather than managed as a separate technical exercise.
ISO/IEC 27001 and 27000: Information security management
Issuing Body
ISO/IEC JTC 1/SC 27
Current Status
ISO/IEC 27001:2022. The transition from the 2013 edition closed on October 31, 2025, so 2013-based certificates are no longer valid. ISO/IEC 27000:2026 refreshed the family’s vocabulary and principles. ISO/IEC 27005:2022 covers information security risk management and ISO/IEC 27701 adds privacy management as an extension.
Core Obligations
Requirements for an information security management system (ISMS), with Annex A controls that include ICT readiness for business continuity, redundancy of information processing facilities, and information security during disruption. Those controls are where an ISMS and a BCMS overlap in practice.
Applicable To
Organizations demonstrating information security assurance to customers and regulators, and technology service providers whose contracts and due diligence questionnaires require it.
ISO 31000: Risk management
Issuing Body
ISO/TC 262 (Risk management)
Current Status
Core Obligations
Principles, a framework, and a process for managing risk of any type in any organization: establishing context, risk identification, analysis, evaluation, treatment, monitoring, and recording. It supplies the risk assessment method that ISO 22301 clause 8 requires but does not prescribe.
Applicable To
Risk functions building an enterprise or operational risk framework, and BCMS owners who need a defensible risk assessment method behind their risk management software.
NIST: Cybersecurity Framework 2.0 and SP 800-34
Issuing Body
National Institute of Standards and Technology, U.S. Department of Commerce
Current Status
NIST Cybersecurity Framework (CSF) 2.0, released February 26, 2024, replacing version 1.1. NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems, published May 2010 and still current.
Core Obligations
Core Obligations CSF 2.0 organizes cybersecurity outcomes into six functions: Govern (new in 2.0), Identify, Protect, Detect, Respond, and Recover, and extends its scope from critical infrastructure to all organizations. SP 800-34 sets out a seven-step contingency planning process: policy, business impact analysis, preventive controls, contingency strategies, plan development, testing and exercises, and plan maintenance, with recovery objectives defined per system impact level.
Applicable To
U.S. critical infrastructure operators and federal contractors, and any financial institution examined by the FFIEC, which has pointed institutions to CSF 2.0 and CISA’s Cybersecurity Performance Goals since retiring its own Cybersecurity Assessment Tool in August 2025. See critical infrastructure resilience.
Basel Committee on Banking Supervision: Principles for Operational Resilience
Issuing Body
Basel Committee on Banking Supervision (BCBS), hosted by the Bank for International Settlements, with member authorities from 28 jurisdictions
Current Status
Principles for Operational Resilience, published March 31, 2021, alongside revised Principles for the Sound Management of Operational Risk.
Core Obligations
Seven principles: governance; operational risk management; business continuity planning and testing; mapping interconnections and interdependencies; third-party dependency management; incident management; and ICT including cyber security. The principles define operational resilience as the ability to deliver critical operations through disruption, and they frame tolerance for disruption, dependency mapping, and scenario testing as supervisory expectations.
COBIT, PCI DSS, SOC 2: Adjacent security and assurance standards
Issuing Body
ISACA (COBIT); PCI Security Standards Council (PCI DSS); American Institute of CPAs (SOC 2)
Current Status
COBIT 2019. PCI DSS v4.0.1, published June 2024 and the only active version since v4.0 retired on December 31, 2024; all future-dated requirements have been mandatory since March 31, 2025. SOC 2 reports are issued against the AICPA 2017 Trust Services Criteria with 2022 revised points of focus.
Core Obligations
COBIT is a governance and management framework for enterprise IT with defined processes, objectives, and maturity levels. PCI DSS sets 12 requirements for protecting payment account data. SOC 2 is an attestation report on controls over security, availability, processing integrity, confidentiality, and privacy; a Type 1 report describes control design at a point in time and a Type 2 report tests operating effectiveness over a period.
Applicable To
Technology and payment service providers, and any organization answering customer due diligence. Their resilience relevance is the availability criterion in SOC 2 and the continuity and incident response controls each of them expects, which should draw on the same critical service inventory as the BCMS.
How Fusion Supports Conformance with Operational Resilience Standards
True enterprise resilience is a decision problem. Most large organizations cannot answer the following four most important questions that must be answered at decision speed when disruption hits. Here’s how Fusion answers each decision question to fully prepare your organization for disruption:
Each scenario permutation can trace dependencies so that services, processes, and vendor disruptions can be addressed rather than discarded.
Simulating disruptions can expose how an event can spread across dependencies, where recovery will be challenging, as well as which exposures are surfacing regularly.
Business consequences of each vulnerability are made visible by evaluating business services, capabilities, and impact tolerances.
The results of the simulation dictate what scenarios and services future testing should focus on, as well as what needs to be addressed first.
How Fusion Helps Organizations Meet Regulatory Requirements in the U.S.
Fusion is purpose-built to hold the answers to those questions in one place and evidence them to any standard or regulator. The enterprise resilience software and Fusion Intelligence maintain one service-and-dependency model that every framework view can draw from
| REGULATORY REQUIREMENT | HOW FUSION MEETS U.S. REGULATORY REQUIREMENTS |
|---|---|
| Identify prioritized activities and their dependencies(ISO 22301 clause 8.2, ISO/TS 22317, NIST CSF Identify, Basel Principle 3) | Model critical services and trace each one to its full dependency chain, so a single business impact analysis supports the BCMS, the ISMS, and the regulator’s critical operations inventory. Business continuity management runs on the same model as operational resilience for financial services. |
| Set and hold recovery objectives(RTO, RPO, MBCO, MTPD under ISO 22301 and ISO/IEC 27031) | Hold each objective against the service it belongs to and show whether exercises and live events stayed within it, rather than recording objectives in a plan document that is not connected to what actually happened. |
| Manage supplier and ICT dependencies(ISO/TS 22318, ISO/IEC 27031:2025, Basel Principles 4 and 5) | Maintain supplier and technology relationships inside the dependency model rather than a separate register, so supplier criticality, concentration, and fourth-party exposure are visible. Third-party risk management software and supply chain resilience for manufacturing share the same model. |
| Exercise and test against realistic scenarios(ISO 22301 clause 8.5, SP 800-34 step six, Basel Principle 3) | Scenario Testing models disruption against the dependency model and produces evidence of what would be affected and for how long. AI is reshaping resilience exercises in the same direction, toward scenarios that reflect real dependency chains. |
| Sequence recovery to objectives(ISO/IEC 27031, SP 800-34 contingency strategies) | Recovery Optimization sequences recovery against service criticality and dependency order, giving IT disaster recovery a tested basis for the order in which systems come back. |
| Evidence performance and improve(ISO 22301 clauses 9 and 10, SOC 2 availability criterion, certification audit) | Every exercise, incident, and change to the model is logged against the service it affects, producing the audit trail a certification body, a SOC 2 auditor, or a supervisor asks for. Crisis and incident management software records the live response in the same system. |
Organizations in technology services and critical infrastructure typically carry ISO 27001, SOC 2, and NIST obligations on top of a BCMS, and use the same model to meet all of them.
Meet U.S. Operational Resilience Standards with Fusion
With Fusion, one service-and-dependency model, evidenced once, answers a certification auditor, a SOC 2 assessor, and a supervisor at decision speed. See where your program stands against the standards with the Enterprise Resilience Index assessment or request a demo to walk through the platform against the frameworks you are audited on.
FAQs
ISO 22301 is the international standard for business continuity management systems, published by ISO in its current 2019 edition with a 2024 amendment. It specifies requirements to plan, establish, implement, operate, monitor, review, maintain, and continually improve a BCMS. Certification is voluntary; no regulator mandates it. Organizations pursue it because an accredited certificate is accepted evidence of a working continuity program by regulators, customers, and insurers, and because the standard’s structure maps directly onto what supervisors ask for under DORA, CPS 230, and the U.S. Sound Practices.
ISO 22301 states the requirements; ISO 22313 explains them. ISO 22313:2020 mirrors the clause structure of ISO 22301:2019 and provides guidance and recommendations on how to meet each requirement, drawing on international good practice. An organization is certified against ISO 22301. ISO 22313 is a companion for implementers and is not itself certifiable.
A BCMS is the part of an organization’s overall management system that establishes, implements, operates, monitors, reviews, maintains, and improves business continuity. Under ISO 22301 it includes policy and objectives, business impact analysis and risk assessment, continuity strategies and plans, exercising and testing, performance evaluation, and management review. A BCMS is a system of governance and evidence, not a single plan document.
ISO 22316:2017 provides guidance on the principles and attributes that make an organization resilient: shared purpose, understanding of context, effective leadership, a resilience-supporting culture, shared information, available resources, coordinated management disciplines, and continual improvement. It is not certifiable and does not replace a BCMS. It describes the organizational capability that business continuity, IT disaster recovery, risk, and third-party management collectively build, which is the level at which enterprise resilience operates.
ISO/IEC 27031:2025, published May 2025, is the second edition of the standard for ICT readiness for business continuity and replaces the 2011 edition. It reorganizes the framework from governance and planning through monitoring and review, ties ICT readiness explicitly to the organization’s MBCO, RPO, and RTO, expands guidance on incident response and recovery strategies, and addresses cloud platforms and third-party ICT providers as dependencies that must be assessed and built into readiness plans. It remains guidance, complementing ISO/IEC 27001 and supporting ISO 22301.
NIST CSF 2.0, released February 26, 2024, is a voluntary framework of cybersecurity outcomes organized into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Version 2.0 added the Govern function, broadened the framework’s scope from critical infrastructure to all organizations, and expanded supply chain risk management guidance. In the United States it is the reference framework the FFIEC points financial institutions to, and it is widely used for self-assessment and customer reporting.
The Basel Committee on Banking Supervision published its Principles for Operational Resilience on March 31, 2021. The seven principles cover governance, operational risk management, business continuity planning and testing, mapping interconnections and interdependencies, third-party dependency management, incident management, and ICT including cyber security. They are not directly binding; each of the Committee’s member jurisdictions implements them through national rules, which is why the Australian, U.S., and European operational resilience regimes share the same core obligations.
Not on its own, but it covers most of the ground. Regulators do not accept a certificate as compliance, because their rules add jurisdiction-specific obligations such as impact tolerances, notification deadlines, and third-party registers. What a BCMS built to ISO 22301 provides is the critical service inventory, dependency mapping, recovery objectives, and testing evidence that each regime requires. Organizations that run one program to the standard and add the regulator-specific artifacts on top avoid maintaining separate evidence sets for each supervisor.
Get (and stay) ready for anything
See how efficient your organization can become at anticipating and preparing for any adversity.
