ISO 22313 · ISO/TS 22317 · ISO/TS 22318 · Business continuity guidance
ISO 22313, ISO/TS 22317 and ISO/TS 22318 guidance for continuity arrangements that hold up on a bad day.
Three ISO guidance documents sit behind ISO 22301: one explains how to apply its requirements, one sets out how to run a business impact analysis, and one carries continuity out to your suppliers. None of them is certifiable. Sterling's expert and experienced consultants use them to build a business continuity capability your clients can test, with or without an ISO 22301 certificate as the goal. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced business continuity consultants, applying ISO guidance across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; these guidance documents carry no certificate, and ISO 22301 certification is decided by an accredited body
8,100+ client engagements in 60+ countries.
Business continuity client experience
What it is
What are ISO 22313, ISO/TS 22317 and ISO/TS 22318?
ISO 22301 states what a business continuity management system must do. It deliberately says little about how. The three documents on this page fill that space. ISO 22313 walks through the ISO 22301 requirements in the same order and offers recommendations on meeting each one without restating them. ISO/TS 22317 is a technical specification on the business impact analysis: how to plan it, who owns it, how to set time frames and priorities, and how top management approves the results. ISO/TS 22318 extends continuity thinking to the suppliers your prioritised activities depend on, and to the contracts and exercises that make their commitments real.
All three come from ISO technical committee ISO/TC 292, Security and resilience, and all three are guidance. Organisations use them to design a system that works in practice, to settle arguments about method inside the team, and to answer client due diligence with a recognised reference. This page covers the guidance itself; certification belongs to the ISO 22301 certification hub, and the practical method for a BIA is covered in Business impact analysis: how to run one management will act on.
Current editions. ISO 22313:2020, the second edition, published in February 2020; ISO lists it as to be revised, and a third edition was approved as a new project on 28 April 2026, with no publication date announced. ISO/TS 22317:2021, the second edition, published in November 2021, and ISO/TS 22318:2021, the second edition, published in December 2021, replaced their 2015 predecessors; ISO confirmed both in its 2025 systematic review.
Who it is for
Who uses ISO 22313, ISO/TS 22317 and ISO/TS 22318?
Anyone responsible for keeping products and services running through a disruption can use them, whatever the size of the organisation. In practice, four situations bring organisations to this guidance:
- A client's continuity questionnaire asks how you did it. Buyers increasingly ask not only whether you have a plan but how your impact analysis set the recovery times. Pointing to ISO/TS 22317 as your method gives the answer weight.
- A tender asks for ISO 22301, and the team needs a route map. ISO 22313 turns each requirement into practical recommendations, which shortens the debate over what an auditor will expect to see.
- A regulator or supervisor expects third-party continuity. Outsourced services, cloud providers and single-source suppliers are where many disruptions start. ISO/TS 22318 gives a structured way to rank suppliers and agree continuity terms with them.
- A group standard needs one method across companies. Subsidiaries running impact analyses in different ways produce numbers nobody can compare. Adopting the guidance as the group's common method fixes that.
The benefit comes from applying the recommendations to your own operations, not from quoting the document numbers.
What the guidance covers
What do ISO 22313, ISO/TS 22317 and ISO/TS 22318 recommend?
Guidance documents contain recommendations, not requirements; the requirements an auditor tests are in ISO 22301. The list maps the main content of each document at title level.
- ISO 22313, clauses 4 to 7, Context, Leadership, Planning and Support: guidance on scope, interested parties, policy, roles, objectives, resources, competence, communication and documented information for the BCMS.
- ISO 22313, clause 8 Operation: guidance on operational planning, business impact analysis and risk assessment, strategies and solutions, plans and procedures, the exercise programme, and evaluation of documentation and capabilities.
- ISO 22313, clauses 9 and 10, Performance evaluation and Improvement: guidance on monitoring, internal audit, management review and acting on nonconformities.
- ISO/TS 22317, Prerequisites: context and scope, roles for a BIA leader and activity owners, and management commitment.
- ISO/TS 22317, The BIA process: plan the analysis, agree impact types, criteria, time frames and method, set product and service priorities with top management, determine prioritised activities and their recovery time objectives, identify resources and dependencies, consolidate the results and obtain top management approval.
- ISO/TS 22317, Review BIA: review of the process and method, and of the results, with annexes on information collection methods and worked examples.
- ISO/TS 22318, value and prerequisites: the supply chain model, ownership of supply chain continuity, top management commitment, spreading continuity principles through the chain, and continuity requirements and risk assessment.
- ISO/TS 22318, effective supply chain continuity: four strategy options, from reducing dependency to retaining the risk by informed decision, assessing suppliers' continuity, contractual obligations, review, then maintenance, performance evaluation and continual improvement.
What does useful evidence look like when you apply this guidance?
A BIA method agreed before the workshops start, product and service priorities signed off by top management, activity records with recovery time objectives and the resources behind them, a ranked list of priority suppliers with the strategy chosen for each, continuity clauses in their contracts, joint exercise records, and a review of the BIA after each major change. We help you keep only the records the capability needs, and they sit in Effivity from the first workshop.
Applying the guidance
How do you apply ISO 22313, ISO/TS 22317 and ISO/TS 22318?
There is no assessment to pass at the end, so the route is defined by what you need the guidance to achieve. Sterling supports your organisation through each step; if ISO 22301 certification is the aim, an independent certification body makes that decision.
- 01Agree what the guidance must deliver.A first BCMS, a stronger impact analysis, supplier continuity for a client, or readiness for ISO 22301 certification.
- 02Gap analysis: compare current arrangements with ISO 22301 and the guidance.Existing plans, recovery arrangements, supplier terms and exercise history are reviewed; what works is kept and actions, owners and dates are agreed.
- 03Run the business impact analysis on the ISO/TS 22317 model.Priorities agreed with top management first, then activity owners set recovery times and list the resources and dependencies behind them.
- 04Extend continuity to priority suppliers.Rank suppliers by impact, choose a strategy for each, assess their continuity arrangements and write the agreed terms into contracts.
- 05Exercise, audit and review.Exercise the plans, including with key suppliers where it makes sense, then internal audit and management review close the loop.
Check the route before you sign. No accredited certificate exists for ISO 22313, ISO/TS 22317 or ISO/TS 22318; an offer of one is a warning sign. If you need a certificate, it is ISO 22301, issued by a certification body accredited for that standard. Ask for the body's accreditation and verify it with the accreditation body concerned, which should be recognised under the Global ACI arrangement.
Cost
How much does applying ISO 22313, 22317 and 22318 cost?
Cost follows the work, and the work depends on where you start. A business refreshing the impact analysis inside a running BCMS needs far less than a multi-site group building its first system and bringing a long supplier list under control. Every component is shown in the proposal, and nothing is added later.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Current maturity, the products, services and sites in scope, the number of BIA workshops, priority suppliers to assess and how much your team takes on (Design™ or Drive™) |
| Standards | Copies of the ISO documents your team works from, purchased from ISO or your national standards body |
| Continuity solutions | Alternate workspace, data recovery, second sources or stock that management decides on from the analysis |
| Internal resources | Activity-owner time for the BIA, management time for approvals, procurement time for supplier reviews, exercise participation |
| Software and learning | Included in a Sterling engagement: Effivity for the system and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
What moves the price
- Sites, countries and the products and services in scope
- The number of activities analysed and suppliers ranked as priority
- Whether a BCMS and a BIA already exist, and how current they are
- Whether ISO 22301 certification is part of the scope
- The deadline, and how much your team can carry
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Certification-body fees identified separately where ISO 22301 certification is in scope
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables
- One all-inclusive proposal. No surprises, ever
Timeline
How long does applying the guidance take?
Timing rests on how quickly activity owners and top management can give time to the analysis, how many suppliers need review, and whether an exercise is part of the plan. As an estimate, focused work on the impact analysis and supplier continuity inside an existing system typically takes two to five months; building a full BCMS towards ISO 22301 certification takes longer.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to plans, recovery arrangements, supplier contracts and incident history |
| Business impact analysis | Workshop availability of activity owners, and the date top management approves priorities and results |
| Supplier continuity | The number of priority suppliers, their response to questionnaires and contract renewal dates |
| Exercise and review | Scheduling a realistic exercise, acting on its report, internal audit and management review |
Share any client or tender deadline at the start, and we will say plainly what fits before it.
Your engagement
What your ISO 22313, 22317 and 22318 engagement includes
Engagements follow Sterling OS™. You choose the level of support: Design™, where we guide and your team builds, or Drive™, where we manage the build with your people. After the work, Sustain™ keeps the analysis, plans and supplier reviews current, and Automate™ is Effivity, where the system runs. Sterling does not certify, accredit, attest or validate.
Scope, gap analysis and plan
Measured against ISO 22301 and the guidance, with owners and dates agreed before work starts.
Business impact analysis
Method, workshops, consolidation and the pack top management approves, on the ISO/TS 22317 model.
Supply chain continuity
Priority supplier ranking, strategy options, supplier assessment and contract wording, on the ISO/TS 22318 model.
Effivity ISO & GRC software
The continuity system runs in Effivity, included with the engagement at no additional cost.
Training for everyone
Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Exercise, internal audit and review
Facilitated as agreed, with findings closed with evidence, and certification readiness where ISO 22301 is in scope.
No certificate exists for this guidance; any ISO 22301 certification decision remains with the independent certification body.
Often combined with
Standards organisations pair with ISO 22313 · ISO/TS 22317 · ISO/TS 22318
- AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
- COSO ERMCOSO ERM implementation and requirements: the five components and 20 principles of the 2017 framework, why no certificate exists, route, cost and timeline.
- COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
- FCPA and UK Bribery ActFCPA and UK Bribery Act compliance: the requirements, six principles and DOJ expectations, and how Sterling builds a proportionate anti-bribery programme.
- ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
- ISO 22316ISO 22316 implementation for organisational resilience: gap analysis against the principles and attributes, board evaluation, Effivity.
Effivity · ISO and GRC software, included in every engagement
How Effivity helps you apply ISO 22313, ISO/TS 22317 and ISO/TS 22318 in daily work.
Every Sterling continuity engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Its Business Continuity module supports carrying out the BIA, generating continuity plans, training employees on them, running drills, tests and tabletop exercises, and sharing the plans. Your consultant configures it within the agreed scope, so the analysis, plans, exercises, audits and actions live in one place. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Scope and continuity obligations
The products, services and sites in scope, with client, contractual and regulatory continuity obligations recorded and reviewed as the business changes.
Policy, roles and approvals
The continuity policy, the BIA leader and activity owners, and top management sign-off on priorities, held where the people who own them work.
Risks and objectives
Disruption risks with owners and treatments, and continuity objectives with measures and dates, tracked to closure.
Competence and documented information
Training records linked to Sterling Academy, and plans under version control so the current plan is the one people reach for.
BIA, plans and exercises
The impact analysis, the continuity plans and the exercise calendar in the Business Continuity module, each exercise with its report and actions.
Internal audit and management review
Audit programmes, findings and follow-up, and a management review that records exercise results, incidents and decisions.
Nonconformity and corrective action
Lessons from incidents and exercises raised as actions, with root cause and evidence that the fix worked.
Your own forms and reports
Supplier continuity questionnaires, BIA templates and reports adapted to how you work, without code.
What this means when a client checks
A client's continuity reviewer asks for the approved BIA, the recovery times, the priority supplier list and the last exercise report. In Effivity each is a screen with dates, owners and evidence attached. Under Sustain™ the same workspace keeps them current between reviews.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Existing plans, registers and records migrated, not retyped
- Admin and user training for your team
- Modules for QMS, ISMS and more when you integrate other standards
Sterling Academy · e-learning for your people
Make sure people know their part before a disruption tests it.
Sterling Academy provides e-learning with video lessons, practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Awareness for employees on how disruption is handled and their role in it
- Internal auditor training for the people who will audit the system, as applicable to your standard, as part of the engagement
- Learner progress by department, as evidence of competence
- New starters trained as they join, so records stay current
- A Sterling consultant reachable when a learner needs one
Keep exploring
Explore more about ISO 22313 · ISO/TS 22317 · ISO/TS 22318
Business continuity resources
Services for ISO 22313 · ISO/TS 22317 · ISO/TS 22318
Why Sterling
Why choose Sterling for ISO 22313, 22317 and 22318?
Continuity guidance is only useful when it survives contact with a real operation: activity owners who disagree on what is urgent, suppliers who will not answer questionnaires, and managers who must sign off recovery times they will be held to. We run that work with your people, so the result is a capability rather than a document set.
Business continuity in 60+ countries since 2003
Continuity programmes for service providers, manufacturers, financial firms and public bodies, with one engagement team accountable wherever you operate.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with any certification-body fees shown separately.
Analysis management will act on
Recovery times set with the people who own the work and approved by the people who fund the solutions, not copied from a template.
Expert and experienced consultants
Consultants who have built continuity systems across sectors and countries since 2003, and who apply the guidance with judgement rather than by rote.
The Sterling Promise
What the Sterling Promise means for ISO 22313, 22317 and 22318 work
We stay with you until the agreed outcome of your ISO 22313, ISO/TS 22317 and ISO/TS 22318 work is achieved, supporting implementation, preparation and, where ISO 22301 certification is in scope, the resolution of assessment findings. Clear explanations, practical delivery, included software and employee learning turn the investment into lasting capability.
The engagement identifies the standards, scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed arrangements into use. Where ISO 22301 certification is in scope, the independent certification body assesses conformity and retains its certification decision. Our commitment concerns the agreed support, not a promise of every future tender award or uninterrupted operation.
FAQs
Frequently asked questions about ISO 22313, ISO/TS 22317 and ISO/TS 22318
Can you get certified to ISO 22313?
No. ISO 22313 is guidance on applying ISO 22301 and contains no requirements to certify against; the same is true of ISO/TS 22317 and ISO/TS 22318. The certifiable standard is ISO 22301, and the guidance helps you meet it.
What is the difference between ISO 22301 and ISO 22313?
ISO 22301 says what a business continuity management system must do; ISO 22313 explains how you might do it. ISO 22313 follows the same clause sequence and gives recommendations for each requirement, so teams often read the two side by side.
Do we have to use ISO/TS 22317 for our business impact analysis?
No. ISO 22301 requires a business impact analysis but no particular method, and ISO/TS 22317 itself states that it does not prescribe a uniform process. Using it gives you a defensible, recognised structure that clients and auditors understand.
How often should a business impact analysis be reviewed?
ISO/TS 22317 suggests running the BIA periodically, ideally once a year, and whenever significant changes affect the organisation or its context. A new service, site, key supplier or system is a reason to revisit it before the annual cycle comes round.
What does ISO/TS 22318 expect from our suppliers?
It expects you, not your suppliers, to act first. You identify the priority suppliers whose failure would hurt prioritised activities most, choose a strategy for each, assess their continuity arrangements and agree continuity terms in the contract; its annexes include example supplier questions and joint exercises.
Talk to a consultant
Put ISO 22313, ISO/TS 22317 and ISO/TS 22318 to work in your continuity system.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice