ISO 22301 and ISO 27001: running continuity and information security as one management system

Can ISO 22301 and ISO 27001 share one system?

They can, and where you hold client data and promise uninterrupted service, they should. ISO/IEC 27001, often shortened to ISO 27001, asks how you protect the confidentiality, integrity and availability of information. ISO 22301 requires how you keep delivering your products and services, at an agreed level and within agreed times, when something disrupts them. The questions overlap at availability, incidents and suppliers, and the same people answer both.

Run as separate projects, the two produce two policies, two risk registers describing the same ransomware scenario differently and two review meetings attended by the same directors. Run as one, they share a single governance layer around two specialist cores, each certificate resting on its own standard.

This guide starts from continuity; the ISO/IEC 27001 integration guide starts from security and adds privacy.

The clauses both standards share

ISO's management system standards are written to a common skeleton, the harmonised structure set out in Annex SL of the ISO/IEC Directives. ISO 22301:2019 and ISO/IEC 27001:2022 both place their requirements in the same seven clauses with the same titles:

• 4 Context of the organisation, 5 Leadership, 6 Planning and 7 Support: issues, interested parties, scope, policy, roles, objectives, competence, awareness, communication and documented information.
• 8 Operation: where the two standards part company.
• 9 Performance evaluation and 10 Improvement: monitoring, internal audit, management review, nonconformity, corrective action and continual improvement.

Both received the same Amendment 1 in February 2024, so one context analysis can decide once whether climate change is relevant. The sub-clauses of clause 10 run in a different order in the two editions, one more reason to organise procedures by process rather than clause number.

What stays specific to each standard

ISO/IEC 27001: risks to information and the controls that treat them

The security core is risk assessment and treatment in clauses 6 and 8: criteria, risk owners, treatment decisions, a check of the selected controls against the 93 in Annex A, and a Statement of Applicability recording why each is included or excluded. The operating controls follow from it.

ISO 22301: continuity priorities and a proven capability

The continuity core sits in clause 8 of ISO 22301 and has no ISO/IEC 27001 counterpart. The business impact analysis sets which activities come first and how quickly they must resume; a risk assessment looks at what could disrupt them. Strategies and solutions are selected and put in place, a response structure and business continuity plans are written, an exercise programme tests them, and the whole set is evaluated after exercises, incidents and significant change. The guides on the business impact analysis and on business continuity exercises cover these in depth. Integration never merges these cores; it makes them feed each other.

Where continuity and security meet: mapping the shared requirements

The link the auditors of both standards look for runs through Annex A control 5.30, ICT readiness for business continuity, one of the controls added in the 2022 edition. An ISMS that selects it needs recovery requirements for its systems, and the defensible source of those requirements is the ISO 22301 business impact analysis: the recovery time for each prioritised activity, and the point to which its data must be restored. Run apart, IT tends to set backup targets alone, and the continuity plan promises a recovery the technology cannot meet.

One document set, one internal audit, one management review

A lean integrated set holds one context and scope document, one policy framework and single procedures for document control, internal audit and corrective action. Beside them sit the two specialist bodies of evidence: risk register, Statement of Applicability and treatment plan; business impact analysis, strategy selection record, plans and exercise reports. The ISO 22301 documentation guide sets out what the continuity side needs and what it does not.

The internal audit programme covers each process against both sets of criteria in one visit, so the service desk is asked about access requests and its place in the call tree on the same morning, by auditors competent in both standards or working in pairs. One management review then weighs exercise results, security incidents, audit findings and resource gaps and records decisions for both. The ISO 22301 internal audit guide covers the continuity criteria in detail.

The combined certification audit

Certification bodies audit integrated systems under IAF MD 11, the mandatory document on applying ISO/IEC 17021-1 to audits of integrated management systems. Your application states how far documents, elements and responsibilities are integrated; the body starts from each standard's own audit time, reduces it for genuine integration and for people and auditors who can cover both, or increases it for complexity, and records its reasoning. For the ISMS part, audit time and auditor rules also follow ISO/IEC 27006-1; for the BCMS part, auditor competence follows ISO/IEC TS 17021-6.

The audit team as a whole must be competent in both subjects. The report is integrated, but every finding is traced to the standard or standards it concerns. So a nonconformity against a shared requirement, such as an internal audit programme that skipped a process, applies to the whole integrated system, while a finding on the business impact analysis applies to ISO 22301 alone. Stage 1, Stage 2, surveillance and recertification follow the usual ISO 22301 certification process.

Which standard first, or both at once?

Three routes are common. With an ISO/IEC 27001 certificate in place, ISO 22301 is added as an extension: the shared clauses are widened, the business impact analysis and plans are built, at least one exercise is run and acted on, and the certification body audits the addition. With ISO 22301 certified first, the security risk assessment, Statement of Applicability and controls are the new work.

Where neither exists, building both together avoids writing the shared layer twice but carries two specialist workloads at once; it suits providers whose clients ask for both. Where only one is demanded now, doing it first with scope, roles and procedures written to accept the second is often the calmer path.

ISO 22301 and ISO/IEC 27001 together: questions buyers ask