Business Continuity and Disaster Recovery Standards
How to keep critical services running through outages, cyberattacks and disasters, and recover them within agreed times. 4 entries, 1 with a full guide.
Customers who depend on your service want to know what happens when something breaks. Business continuity standards answer that with a business impact analysis, agreed recovery time and recovery point objectives (RTO and RPO), tested plans and lessons learned.
ISO 22301 is the certifiable standard for a business continuity management system. ISO/IEC 27031 covers ICT readiness for business continuity, and NIST SP 800-34 is a practical contingency planning guide. Continuity is also a required part of ISO 27001, SOC 2's availability criteria, DORA and HIPAA's contingency planning standard.
ISO 22301:2019 Security and resilience: Business continuity management systems (BCMS) requirements
Certifiable standardVoluntaryGlobal
ISO 22301 sets requirements for a business continuity management system (BCMS) that helps an organisation keep delivering critical products and services during disruption and recover them within agreed times. It requires a business impact analysis, risk assessment, continuity strategies and solutions, documented plans, regular exercises and testing, and management review. It is voluntary and certifiable, and it is widely requested from IT service providers, data centres and BPOs.
Covers, who needs it and key requirements
What it covers
Context and scope, leadership, business impact analysis (BIA), risk assessment, business continuity strategies and solutions, plans and procedures, warning and communication, exercise programme, evaluation and improvement.
Who needs it
IT and managed service providers, data centres, SaaS platforms, BPOs, banks and any organisation whose clients depend on uninterrupted services.
Why it matters
It proves you can recover critical services within agreed RTOs and RPOs, which clients and regulators increasingly require.
Define scope and the products and services that must continue
Business impact analysis to set recovery time and point objectives (RTO, RPO, MTPD)
Risk assessment of disruptions
Business continuity strategies, resources and documented plans
Exercise and test plans regularly and record results
Evaluate performance, run internal audits and management reviews, and improve
DORA
Digital Operational Resilience Act, Regulation (EU) 2022/2554
LawMandatory if in scopeEU
DORA is the EU regulation on digital operational resilience for the financial sector, applying since 17 January 2025 to banks, insurers, investment firms, payment and crypto-asset providers and others. It requires an ICT risk management framework, classification and reporting of major ICT incidents, resilience testing including threat-led penetration testing for some firms, and strict management of ICT third-party risk with mandatory contract terms. Critical ICT third-party providers are directly overseen by EU supervisors.
Covers, who needs it and key requirements
What it covers
ICT risk management, ICT incident management and reporting, digital operational resilience testing, ICT third-party risk and contracts, information sharing and oversight of critical ICT providers.
Who needs it
EU financial entities, and the IT, cloud and software providers that serve them through contracts (critical providers are overseen directly).
Why it matters
Financial clients must put DORA contract terms, audit rights and exit plans into every ICT service agreement, so their vendors must comply in practice.
ICT risk management framework approved by the management body
Classify and report major ICT-related incidents
Regular resilience testing, with TLPT for significant entities
Register of information on ICT third-party arrangements
Contracts with the mandatory provisions of Article 30, including exit strategies
ISO 27031
ISO/IEC 27031:2025 Guidelines for ICT readiness for business continuity
FrameworkVoluntaryGlobal
ISO/IEC 27031 gives guidance on ICT readiness for business continuity: making sure IT systems, networks and data can support the business through disruption. The 2025 edition updates the 2011 guidance on planning, implementing, testing and improving ICT continuity, including recovery strategies, resilience and dependencies on third parties and cloud services. It is guidance, not a certifiable requirement standard, and is used with ISO 22301 and ISO 27001.
Covers, who needs it and key requirements
What it covers
ICT continuity planning, recovery strategies, resilience, testing and exercising, performance monitoring and improvement.
Who needs it
IT departments, managed service providers, data centres and cloud teams responsible for recovery capabilities.
Why it matters
It turns business continuity requirements into concrete ICT recovery capabilities.
NIST SP 800-34 Rev. 1 Contingency Planning Guide for Federal Information Systems
FrameworkMandatory if in scopeUS / global
NIST SP 800-34 is a practical guide to IT contingency planning. It describes a seven-step process: develop a policy, conduct a business impact analysis, identify preventive controls, create recovery strategies, develop the contingency plan, test and exercise it, and maintain it. Federal systems use it to meet the CP control family of SP 800-53, and many private IT teams use its templates for disaster recovery planning.
Covers, who needs it and key requirements
What it covers
Contingency planning policy, BIA, preventive controls, recovery strategies, plan development, testing, training and exercises, and plan maintenance.
Who needs it
IT teams writing disaster recovery and contingency plans, especially for US federal systems.
Why it matters
It gives a free, step-by-step method and templates for DR planning.
Applies in
United States (federal); used worldwide as guidance
