1.2 The ISO 22300 Family of Standards & Regulatory Framework

The ISO 22300 Family of Standards & Regulatory Framework

Implementing a Business Continuity Management System requires an in-depth understanding of the International Organization for Standardization (ISO) normative architecture. ISO 22301 does not exist in a vacuum; it is supported by a comprehensive suite of vocabulary standards, guidance documents, and technical specifications collectively referred to as the ISO 22300 Family.

Furthermore, modern organizations operate under increasingly stringent statutory, legal, and regulatory mandates. Regulatory frameworks such as the European Union's Digital Operational Resilience Act (DORA) and NIS2 Directive, the UK FCA/PRA Operational Resilience regime, Australia's APRA CPS 230, and the United States FFIEC IT Examination Handbook demand verifiable continuity capabilities. ISO 22301 provides the global management architecture to unify and fulfill these diverse regulatory requirements.

---

1. Evolution of ISO 22301: 2012 vs. 2019 Edition

ISO 22301 was originally published in 2012 as the successor to the British Standard BS 25999-2. In October 2019, ISO published ISO 22301:2019 (Security and resilience — Business continuity management systems — Requirements), introducing significant refinements to increase pragmatism, reduce unnecessary documentation burdens, and harmonize with the updated Annex SL framework.

---

2. The ISO 22300 Family Architecture

The ISO Technical Committee ISO/TC 292 (Security and resilience) develops and maintains the standards ecosystem supporting business continuity. The Lead Implementer must understand the role, scope, and status of each document in this family.

                                ┌──────────────────────────────────┐
                                │         ISO 22300:2021           │
                                │  (Vocabulary & Definitions)      │
                                └────────────────┬─────────────────┘
                                                 │ Normative Definitions
                                                 ▼
        ┌─────────────────────────────────────────────────────────────────────────────────┐
        │                                 ISO 22301:2019                                  │
        │               (Management System Requirements — CERTIFIABLE)                     │
        └───────┬────────────────────────────────┬────────────────────────────────┬───────┘
                │ General Guidance               │ Specialized Technical Guidance │ Operational Execution
                ▼                                ▼                                ▼
  ┌───────────────────────────┐    ┌───────────────────────────┐    ┌───────────────────────────┐
  │      ISO 22313:2020       │    │     ISO/TS 22317:2021     │    │       ISO 22320:2018      │
  │ (Guidance on ISO 22301)   │    │  (BIA Technical Specs)    │    │   (Incident Management)   │
  └───────────────────────────┘    ├───────────────────────────┤    ├───────────────────────────┤
                                   │     ISO/TS 22318:2021     │    │       ISO 22398:2013      │
                                   │  (Supply Chain Continuity)│    │   (Exercise Guidelines)   │
                                   ├───────────────────────────┤    ├───────────────────────────┤
                                   │     ISO/TS 22330:2018     │    │     ISO/IEC 27031:2011    │
                                   │      (People Aspects)     │    │      (ICT Readiness)      │
                                   ├───────────────────────────┤    └───────────────────────────┘
                                   │     ISO/TS 22331:2018     │
                                   │   (Strategy Guidelines)   │
                                   └───────────────────────────┘

Comprehensive Reference of Standards in the Family

1. ISO 22301:2019 (Requirements):
   • Status: The ONLY certifiable/auditable standard in the family containing mandatory normative requirements ("shall" statements).
   • Role: Establishes the formal benchmark against which an organization's BCMS is audited by accredited third-party certification bodies (per ISO/IEC 17021-1).
2. ISO 22313:2020 (Guidance on the Use of ISO 22301):
   • Status: Non-certifiable guidance containing recommendations ("should" statements).
   • Role: Provides comprehensive explanations, practical interpretations, implementation examples, and commentary for every clause in ISO 22301.
3. ISO/TS 22317:2021 (Guidelines for Business Impact Analysis):
   • Status: Technical Specification (TS) providing in-depth methodology for the BIA process.
   • Role: Guides organizations through scoping, information gathering, impact analysis over time, identifying critical dependencies, establishing MTPD/RTO/RPO, and formalizing BIA reports.
4. ISO/TS 22318:2021 (Guidelines for Supply Chain Continuity Management):
   • Status: Technical Specification for managing third-party and supply chain resilience.
   • Role: Details techniques for supply chain mapping, multi-tier dependency assessments, supplier business continuity evaluation, and single-source risk mitigation.
5. ISO/TS 22330:2018 (Guidelines for People Aspects of Business Continuity):
   • Status: Technical Specification focusing on the human dimension of disruptions.
   • Role: Covers staff welfare, duty of care, emergency communication with families, psychological first aid, critical skill redundancy, and succession planning during crises.
6. ISO/TS 22331:2018 (Guidelines for Business Continuity Strategy):
   • Status: Technical Specification for designing and evaluating continuity strategies.
   • Role: Provides structured models for selecting cost-effective strategies and solutions across facilities, workforce, technology, data, and supplier dimensions.
7. ISO 22320:2018 (Emergency Management — Guidelines for Incident Management):
   • Status: International Standard for incident response command structures.
   • Role: Specifies principles for incident command systems (ICS), multi-agency coordination, operational information management, and emergency public warnings.
8. ISO 22398:2013 (Guidelines for Exercises):
   • Status: International Standard for developing and managing exercise programmes.
   • Role: Defines methods for designing, conducting, controlling, and evaluating BC exercises ranging from orientation walkthroughs and tabletop simulations to unannounced full-scale failovers.
9. ISO/IEC 27031:2011 (Information and Communication Technology Readiness for Business Continuity - IRBC):
   • Status: Joint ISO/IEC standard bridging ISO 22301 and ISO/IEC 27001.
   • Role: Focuses exclusively on ICT infrastructure resilience, telecommunications failover, data replication, system redundancy, and high-availability architecture.

---

3. Global Regulatory Landscape & Operational Resilience Mandates

Worldwide regulators have moved beyond traditional financial capital requirements to mandate operational resilience. Regulators explicitly recognize that technical outages, cyber incidents, and vendor failures can threaten systemic financial and economic stability.

---

4. Worked Scenario: Cross-Border Regulatory and ISO 22301 Alignment

Implementation Context

Veritas Global Bancorp operates retail and investment banking platforms in Frankfurt (regulated under DORA and NIS2), London (regulated under UK PRA/FCA Operational Resilience), and Sydney (regulated under APRA CPS 230). The Chief Risk Officer commissions a unified ISO 22301 Lead Implementer project to establish a single, auditable global BCMS.

                  ┌────────────────────────────────────────────────────────┐
                  │            Global ISO 22301:2019 BCMS                  │
                  │        Universal Management System Framework           │
                  └───────┬────────────────────────┬───────────────┬───────┘
                          │                        │               │
            ┌─────────────┴────────────┐           │ ┌─────────────┴────────────┐
            │      European Union      │           │ │         Australia        │
            │   DORA / NIS2 Directives │           │ │       APRA CPS 230       │
            └──────────────────────────┘           │ └──────────────────────────┘
                                      ┌────────────┴───────────┐
                                      │     United Kingdom     │
                                      │  PRA/FCA Op Resilience │
                                      └────────────────────────┘

Alignment Strategy

1. Harmonizing Scoping & Prioritization: The implementation team maps the UK PRA's Important Business Services (IBS), DORA's Critical or Important Functions, and APRA's Critical Operations directly into ISO 22301 Clause 8.2.2 as Prioritized Activities.
2. Setting Impact Metrics: The UK Impact Tolerance (e.g., maximum allowable downtime of 2 hours for automated payment clearing to prevent consumer harm) is formalized as the MTPD and informs the RTO (set at 45 minutes) and MBCO (set at 100% data integrity with 60% minimum throughput).
3. Managing Third-Party ICT Suppliers: Leveraging ISO/TS 22318, the team establishes rigorous supply chain continuity assessments, contractual audit rights, and multi-cloud exit strategies, satisfying DORA Article 28 and APRA CPS 230 material service provider obligations.
4. Unified Testing Programme: Combining ISO 22398 exercise guidelines with DORA Threat-Led Penetration Testing (TLPT), the bank executes annual severe but plausible multi-region failure simulations, generating audit evidence that satisfies all four regulatory supervisory authorities simultaneously.

---

5. PECB Exam Warning Traps & Implementation Pitfalls

[!CAUTION] Critical Exam Traps for Section 1.2

1. Trap: Confusing ISO 22301 with ISO 22313 for Certification: Only ISO 22301 contains normative requirements ("shall") and can be certified against. ISO 22313 is purely an informative guidance document ("should") and cannot be used as an audit criterion for issuing accredited ISO certificates.
2. Trap: Treating Technical Specifications (ISO/TS) as Mandatory Standards: Documents designated as ISO/TS (e.g., ISO/TS 22317 for BIA, ISO/TS 22318 for Supply Chain) provide best-practice methodologies. An organization does NOT need to strictly implement every recommendation in ISO/TS 22317 to achieve ISO 22301 certification, though auditors expect adherence to the core principles.
3. Trap: Regulatory Impact Tolerance vs. Internal Business Preferences: In frameworks like UK Operational Resilience and DORA, impact tolerances are set based on harm to consumers, market integrity, and financial stability, NOT based on internal executive convenience or short-term operational profitability.