Why ISO 22301 Business Continuity is a valuable addition to ISO 27001?

The question your organization needs to ask isn't whether it will face a cyber-attack, but when. That's why more and more companies are investing in information security and cyber resilience. That’s where two international standards come in: ISO 27001 for information security and ISO 22301 for business continuity. In this article, Henk-Willem Mutsaers, Lead Auditor at Kiwa, explains how the two standards reinforce each other and why combining them can help you build broader organizational resilience than either one on its own.

What are ISO 27001 and ISO 22301?

ISO 27001 helps organizations systematically manage information security risks, and put measures in place to prevent and detect incidents and limit their impact.

But cyber resilience today goes beyond securing your information and IT systems. Your company must be able to continue its critical activities when a cyber incident or other disruption occurs. In today’s reality, ISO 27001 only takes you so far. What happens if an incident does occur and your critical processes are disrupted? How do you keep your organization functioning, and get critical services back up as quickly as possible? Enter ISO 22301: the international standard for a Business Continuity Management System (BCMS). Where ISO 27001 is concerned with the confidentiality, integrity and availability of your information and systems, ISO 22301 is concerned with the continuity of your business-critical activities as a whole. Together, they cover far more ground than either standard manages alone.

How do ISO 27001 and ISO 22301 work together? 

ISO 27001 does address business continuity, but its focus is information security first. With ISO 22301, business continuity is the core: it identifies which of your activities are essential, what could threaten them, and what you'd need to keep them running or get them back up as fast as possible if something goes wrong.

• ISO 27001 asks: how do we protect our information and information systems?
• ISO 22301 asks: how do we keep our organization running, or get it running again, when something disrupts it? It’s a much wider question than IT alone. It takes in your people, your locations, your suppliers, your processes, your communications, and anything else business-critical.

The two standards aren't competing with each other, they're complementary. ISO 27001 builds your cyber resilience. ISO 22301 builds your resilience more broadly.

From information security to business continuity

By applying ISO 27001, you already have the important elements of management system in place, including risk management, incident management, governance, internal audits and a process of continual improvement. ISO 22301 fits well with this and builds on it. 

By integrating ISO 22301, you examine your critical activities and services, asking questions like:

• Which products, services and processes are business-critical?
• What are the consequences if a critical activity is disrupted?
• How long can a process be interrupted at most?
• Which people, locations, systems, suppliers and other resources are required?
• Which external parties and supply chains does the organization depend on?
• How can the organization continue its activities if its normal way of working is no longer possible?
• How will communication take place during a crisis, and who will make which decisions?
• How and within what timeframe will normal operations be restored?

An important tool here is the Business Impact Analysis (BIA). This enables the organization to determine the consequences of disruptions and what needs to be recovered. Based on this, you can develop continuity strategies and specific continuity and recovery plans.