ISO 22301 Certification — Business Continuity Management System
ISO 22301 is the international standard for keeping critical activities running through disruption — from ransomware and supplier failure to power loss and pandemics. The 2025 Jaguar Land Rover shutdown showed how a single cyber incident becomes a business-continuity crisis across a supply chain.
Mutex Systems runs business impact analysis, builds continuity and recovery plans that reflect real cyber scenarios, and tests them so recovery times are proven rather than assumed.
- Category
- Compliance Framework
- Jurisdiction
- International
- Issuing Body
- ISO
- Current Version
- ISO 22301:2019 (amended 2024)
- Who It's For
- Manufacturers, retailers, financial services, healthcare and any organisation whose customers or regulators expect proven resilience — including firms meeting DORA, NIS2 or FCA operational-resilience rules.
Core Domains
A Practical Compliance Path
- 01
Business impact analysis
Identify critical activities, dependencies and maximum tolerable downtime.
- 02
Strategy & plans
Define recovery strategies and write plans for realistic scenarios, including ransomware.
- 03
Exercise
Run tabletop and technical recovery tests and fix what fails.
- 04
Certification
Internal audit, management review and certification audit.
Continuity plans tested against cyber reality
We build continuity around the incidents organisations actually face today — ransomware, supplier compromise and OT disruption — and test recovery technically, not just on paper.
- Ransomware recovery exercises
- Supplier dependency mapping
- Integration with incident response and SOC
Continuity evidence kept current
grComply tracks the BIA, plans, test results and actions under ISO 22301 and maps them to DORA, NIS2 and ISO 27001 continuity controls.
- BIA and RTO/RPO register
- Exercise results and corrective actions
- Cross-mapping to DORA and NIS2
- Plan review reminders
grComply is Mutex Systems' own multi-tenant GRC automation platform — the framework library, hybrid scanning, risk and audit workflow, and AI-assisted compliance behind every point above are live in production today.
See How grComply WorksCommon Questions About ISO 22301
What is ISO 22301?
The international standard for a business continuity management system (BCMS). It specifies how to identify critical activities, plan for disruption, and test and improve recovery.
What is a business impact analysis?
An assessment of which activities are critical, what they depend on and how quickly they must be restored. It sets recovery time objectives (RTO) and recovery point objectives (RPO).
Does ISO 22301 cover cyber attacks?
Yes. It covers any disruption, and cyber incidents such as ransomware are now among the most likely scenarios. A good BCMS integrates with your incident response and backup strategy.
Ready to Start Your ISO 22301 Programme?
Send us your current posture and timeline. Within two working days you will receive a written response and a proposed scoping call.