Skip to content
Knowledge Hub/Article
Article

What Is Business Continuity? BCM and ISO 22301

Business continuity keeps critical processes running through a disruption. We cover business impact analysis, MTPD, ISO 22301 and how it differs from DR.

Oğuzhan Gerçek··9 min read
What Is Business Continuity? BCM and ISO 22301

Short answer: Business continuity is an organization's ability to keep its critical business processes running during and after a disruption. Disaster recovery is the part that brings IT systems back; business continuity also covers people, suppliers and communications. Managing it starts with a business impact analysis: you establish the longest each process can be disrupted (MTPD) and set recovery targets below that limit. ISO 22301 provides the international framework; the plan is tested through exercises and continually improved based on what they reveal.

What is business continuity?

The contingency planning guide from the US National Institute of Standards and Technology (NIST), SP 800-34 Rev. 1, describes the focus of a business continuity plan (BCP) as sustaining an organization's business processes during and after a disruption. According to the guide, the plan can also be scoped to cover only priority functions. You will find a short definition in our glossary.

Business continuity management (BCM) turns this from a one-off document into an ongoing discipline. As ISO describes it, ISO 22301 is the international standard for business continuity management systems (BCMS). It provides a framework to plan, establish, implement, operate, monitor, review, maintain and continually improve a documented management system that protects against disruptive incidents, reduces their likelihood and ensures recovery from them.

Business continuity vs disaster recovery

NIST separates the two plans by scope. The disaster recovery plan (DRP) applies to major, usually physical disruptions that deny access to the primary facility for an extended period, and it only addresses information system disruptions that require relocation. The business continuity plan looks at business processes; according to the guide, the business continuity planner must coordinate with information system owners.

AWS sums up the relationship in one sentence: a DR plan should be a subset of the business continuity plan, not a standalone document. The reasoning is straightforward: there is no point in maintaining aggressive DR targets if the business objectives cannot be met because the disaster has hit parts of the business other than the workload. If systems come back within two hours but the call center team has nowhere to work, for example, customer service still stops.

ISO also links the two areas through separate standards. ISO/IEC 27031:2025 covers the readiness of information and communication technology (ICT) for business continuity, and according to ISO it supports ISO 22301 by aligning ICT readiness with broader business continuity objectives. We cover the IT side, meaning RTO, RPO, recovery sites and the DR plan, in our disaster recovery article.

Business impact analysis (BIA)

A business impact analysis (BIA) establishes how a disruption would affect business processes. According to AWS, the analysis should quantify the business impact of a disruption and show the effect on internal and external customers of not being able to use your workloads; it should help determine how quickly a workload needs to be available again and how much data loss can be tolerated.

NIST SP 800-34 describes the process in three steps:

  1. Determine business processes and their recovery criticality
  2. Identify resource requirements
  3. Identify recovery priorities for system resources

The analysis is read together with a risk assessment. According to AWS, a risk assessment of the type of disaster and its geographical impact determines the probability of disruption for each type of disaster; recovery objectives are not set in isolation, and the probability of disruption and the cost of recovery also come into play. ISO's ISO/TS 22317:2021 gives guidance on the BIA process but does not prescribe a uniform one. We explain how to map critical processes' dependencies on suppliers and SaaS services in our dependency mapping article.

Maximum tolerable period of disruption (MTPD)

The MTPD (maximum tolerable period of disruption), as defined in the Scottish Government's business resilience guidance, is the maximum time an organization's key products or services can be unavailable or undeliverable before the impact is deemed unacceptable. NIST calls the same idea MTD (maximum tolerable downtime) and describes it as the amount of time a business process can be disrupted without causing significant harm to the organization's mission.

This figure is the ceiling for recovery targets. According to NIST, because the RTO must ensure the MTD is not exceeded, it must normally be shorter than the MTD. If order taking can stop for at most 8 hours, the RTO for the systems behind it has to be set below 8 hours.

Shortening the target comes at a price. According to NIST, the longer a disruption continues, the more it costs the organization, while the shorter the RTO, the more expensive the recovery solution. The point where the two curves cross, the cost balance point, differs from one organization to the next. We show how to run this calculation in how to calculate RPO and RTO.

Strategy, plans and roles

After the business impact analysis comes the choice of strategy. ISO's ISO/TS 22331 gives guidance on determining and selecting a business continuity strategy, and ISO/TS 22332 on developing and maintaining plans and procedures. The plan goes beyond IT:

  • People: ISO/TS 22330 covers managing the people affected by an incident through preparation, response, recovery and restoration.
  • Suppliers: ISO/TS 22318 sets the objective of supply chain continuity as protecting the organization's business activities from supply chain disruption.
  • Communications: NIST calls for standard procedures for internal and external communications during a disruption to be documented in a crisis communications plan.

Defining roles means answering three questions: who activates the plan, who leads the teams, and who steps in if those people cannot be reached. In NIST's guide, the authority to activate the plan sits with a senior management official such as the CIO; each team has a team leader, with a designated alternate named in advance. According to AWS, the business continuity manager ensures that the DR plan aligns with the results of the business impact analysis. We handle decision authority and risk ownership in our governance, risk and compliance service.

Exercises and testing

A plan only becomes reliable once it has been tested. ISO 22398 recommends good practice for an organization to plan, conduct and improve its exercise projects. NIST's guide distinguishes training from two types of exercise:

  • Training: Teaches staff their role in the plan; according to NIST it should be provided at least annually.
  • Tabletop exercise: Participants meet to discuss their roles and responses in a particular emergency; no equipment is deployed.
  • Functional exercise: Staff validate their operational readiness by performing their duties in a simulated operational environment.

According to NIST, the results of each activity are documented in an after-action report, and the lessons learned are used to update the plan. Scenarios should cover not only the loss of a data center but also a critical supplier being unavailable for a long time; we have collected examples in our SaaS outages article. For the steps of a technical failover test, see our disaster recovery testing guide.

ISO 22301 and continual improvement

The current version of ISO 22301 is the second edition, published in October 2019; the first edition dates from 2012. An amendment with climate action changes (Amd 1:2024) followed in February 2024. In December 2025, ISO decided to revise the standard, and the new version is being prepared as ISO/CD 22301. According to ISO's 2019 announcement, the current version was brought in line with all other ISO management system standards, and the standard's page notes that ISO 22301 can be integrated with them. We explain how a management system certificate is obtained and kept in our ISO 27001 article, and preparing for certification on our ISO standards page.

In practice, continual improvement means regular review. NIST asks for the plan to be reviewed at an organization-defined frequency and whenever a significant change occurs to any element of the plan; such a change also means updating the business impact analysis. NIST's review list also includes the contact details of team members and vendors.

For banks in Türkiye, these concepts also appear in regulation: the information systems regulation of the BDDK, Türkiye's banking regulator, lists the business impact analysis, the information systems continuity plan and the secondary site among its defined terms. We cover continuity requirements for banks in our BDDK article.

Frequently asked questions

What does business continuity mean? An organization's ability to keep its critical business processes running during and after a disruption.

What is business continuity management? Treating business continuity as a management system that runs through a cycle of analysis, strategy, planning, exercises and improvement. Its international standard is ISO 22301.

What is the difference between a business continuity plan and a disaster recovery plan? A business continuity plan describes how business processes will continue during a disruption. A disaster recovery plan focuses on bringing IT systems back and is part of the business continuity plan.

What is a business impact analysis? An analysis of how a disruption would affect business processes. It establishes how quickly each process needs to be back and how much data loss can be tolerated.

What is ISO 22301? The international standard for business continuity management systems. The current version dates from 2019, and ISO is working on a new one.

Sources