What ISO 22301 is
ISO 22301 is the international standard for a business continuity management system. It asks an organisation to understand what it must keep running, through a business impact analysis, to set recovery objectives, to plan how to meet them, to test the plans by exercise, and to improve them. It can be certified, and it has the same structure as ISO 27001. Customer questionnaires use its vocabulary even when they never name it.
What customers ask
- Whether you have a business continuity plan and a disaster recovery plan, who owns them and when they were last reviewed.
- Your recovery time and recovery point objectives for the service they buy.
- How backups are taken, how often, where they are kept, whether they are encrypted, and when a restore was last tested.
- Whether the service runs in more than one data centre or availability zone, and what happens if one is lost.
- When the plans were last exercised, what was found, and what was changed afterwards.
- How you would tell the customer about a major outage, and how fast.
- What happens to the service and the customer's data if your company stops trading.
Answering as a vendor
Give numbers and dates. "We have a disaster recovery plan" closes nothing; "RTO 8 hours and RPO 24 hours, daily encrypted backups in a second region, restore tested in March, plan reviewed in June" closes the section. If your hosting provider handles the infrastructure side, cite its certification and describe what you add: your backups, your restore test, your communication plan. Be honest about the objectives. A reviewer who sees a four-hour RTO from a small company will ask how it was tested.
Financial customers under DORA and covered entities under NIS2 ask for more detail on exit and on your own suppliers' continuity. The exit question, how the customer gets its data out and moves to another provider, deserves a written answer of its own.
In Responsemate
The continuity plan, the latest test report and the backup policy sit in the knowledge base as evidence with expiry dates, so an out-of-date test shows up before a customer finds it. Every continuity row is drafted from them with the source shown. Knowledge in Responsemate.
Questions people ask
What is the difference between RTO and RPO?
The recovery time objective is how long the service may be down before it is restored. The recovery point objective is how much data, measured in time, may be lost. "RTO 8 hours, RPO 24 hours" means back within eight hours, with at most a day of changes lost.
Do we need ISO 22301 certification?
Rarely. Customers in finance and critical sectors sometimes ask for it, but most accept a documented continuity plan, a business impact analysis and evidence of a recent test.