Compliance tools · Cybersecurity and data protection

Toolkit for ISO 22301

ISO 22301:2019 · European Union and United Kingdom · Voluntary standard

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your Toolkit for ISO 22301 documentation cited clause by clause. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

Toolkit for ISO 22301 is ISO 22301:2019, a voluntary standard in the European Union and United Kingdom. Business continuity management systems standard. The toolkit runs alongside your own licensed copy of the ISO standard.

The free assessment screens for Toolkit for ISO 22301 when a business operates in a critical or essential sector, or provides financial services or is an obliged financial entity, or makes or supplies products or services with digital elements.

Sectors this instrument reaches: financial services; healthcare; critical infrastructure; logistics and supply chain; public services; IT and hosting.

This is a voluntary standard rather than binding law. Businesses adopt it because customers, insurers or public buyers ask for it.

Screen your business against all 116 agent toolkits, free →

• Your exact position under Toolkit for ISO 22301: what is in place, what is missing, and what to do about each gap.
• Documentation with clause citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the standard requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that Toolkit for ISO 22301 applies to your business, free →

Does Toolkit for ISO 22301 apply to my business?

You apply ISO 22301 yourself if you wish to establish, operate, maintain and continually improve a business continuity management system, per Clause 1. It is a voluntary certification standard, so no law compels you to hold it. Supply chains, critical infrastructure, financial services, healthcare and public services often demand it.

Who does ISO 22301 apply to?

It applies to any organisation, regardless of type, size or sector, that wishes to establish, operate, maintain and continually improve a BCMS, per Clause 1. Private companies, public bodies and not-for-profit entities may all seek conformity or certification. All 33 obligations fall on the organisation or on top management.

Does Toolkit for ISO 22301 apply to a small business?

No minimum size threshold applies, and the standard is explicitly scalable so a small organisation may operate a proportionate BCMS. The instrument states no size exemption or relief. SMEs in supply chains, critical infrastructure, financial services, healthcare or public services often face customer-mandated or regulator-expected continuity capability.

When does ISO 22301 apply from, and what are the deadlines?

ISO 22301 imposes no statutory reporting deadlines. Certification runs as a two-stage initial audit, surveillance audits at approximately annual intervals, and recertification every three years. Internal audits and management reviews occur at planned intervals under Clauses 9.2 and 9.3, and BIA and risk assessments are reviewed at planned intervals under Clause 8.2.

What does ISO 22301 require me to do?

You must build and run a BCMS across Clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and improvement. Clause 8 requires a business impact analysis and risk assessment (8.2), continuity strategies and solutions (8.3), business continuity plans (8.4) and an exercise programme (8.5). Top management must set policy and assign roles under Clauses 5.1 to 5.3.

What records or documents does ISO 22301 require me to keep or produce?

You must maintain documented information across the BCMS under Clause 7, and document and justify in writing any clause exclusions. Clause 8.4 requires business continuity plans with defined content, and Clause 9.3 requires documented management review outputs. Internal audit records are required under Clause 9.2.

What happens if I do not comply with ISO 22301?

ISO is not a regulator and imposes no fines. A minor nonconformity requires corrective action, typically within 90 days, and a major nonconformity may stop the certificate being issued or continued until resolved, typically within six months. Unresolved major nonconformities or a missed surveillance audit can lead to suspension and then withdrawal of the certificate.

Does Toolkit for ISO 22301 apply to a UK business selling into the EU?

The standard is international with no geographic restriction, and it is adopted as a national standard in many countries, published in the United Kingdom as BS EN ISO 22301. The IAF Multilateral Recognition Arrangement means a certificate from a UKAS-accredited body is recognised by accreditation bodies in Germany, the United States, Australia and other signatory countries, so separate certifications for different markets are not needed.

How do I start complying with ISO 22301?

Start with the management system requirements in Clauses 4 to 10, beginning with context of the organisation under Clause 4 and leadership under Clause 5. Top management must then establish and communicate a business continuity policy under Clause 5.2 and assign roles, responsibilities and authorities under Clause 5.3. The operational core follows at Clause 8.

Which ComplianceSME account includes the Toolkit for ISO 22301 toolkit?

The Toolkit for ISO 22301 agent toolkit is included in Compliance Complete.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · CER Directive