ISO 27031 implementation and requirements, so your systems recover when the business needs them.

What it is

What is ISO 27031 and what is it used for?

ISO/IEC 27031 sets out concepts, principles and a framework of methods and processes for ICT readiness for business continuity, which the standard abbreviates as IRBC. It is written for the point where two disciplines meet: business continuity management decides which activities must resume and by when, and the ICT function has to make that possible with systems, data, networks, facilities and providers that are actually prepared.

In practice it helps an organisation turn business expectations into ICT terms. How long can a customer-facing service be down? How much data can be lost? What minimum level of service is acceptable while recovery is under way? Those answers become recovery time and recovery point objectives, strategies to meet them, an ICT continuity plan, and tests that show the plan holds. It applies to organisations of every size and takes account of external dependencies such as cloud providers.

Current edition. ISO/IEC 27031:2025, the second edition, was published by ISO and IEC on 16 May 2025 and replaced ISO/IEC 27031:2011, which is withdrawn. The document's structure was changed, the scope was clarified and technical content was added. It is guidance: there is no certificate to hold and no transition period to manage, but plans built on the 2011 text are worth reviewing against the new structure.

Who it is for

Who needs ISO 27031?

No certificate means nobody is obliged to hold one, yet the questions this guidance answers arrive from many directions. Organisations usually come to Sterling for ICT readiness from one of four starting points:

• A customer asks how quickly you recover. Due diligence questionnaires now ask for recovery objectives, test dates and results.
• A tender asks for continuity evidence. Bids often require a business continuity plan, a disaster recovery plan or ISO 22301 or ISO/IEC 27001 certification. Aligning ICT readiness with this guidance strengthens whichever evidence the buyer asks for.
• A regulator expects operational resilience. Financial services, healthcare and other regulated sectors increasingly expect tested ICT recovery. The guidance offers an internationally recognised method; the regulator's own rules still set what you must meet.
• A parent or group company sets a standard. Group policies often require each subsidiary to show recovery objectives agreed with the business and plans tested on a schedule.

Requirements

What are the main ISO 27031 requirements?

Strictly, ISO/IEC 27031 recommends rather than requires: it is guidance, so an organisation adopts what fits its context. After the introductory clauses on scope, terms and abbreviations, the 2025 edition is organised into the areas below, with two informative annexes. The summary follows the document's own clause titles; your arrangements are compared with the full guidance during the gap assessment.

• Clause 6 Integration of IRBC into BCM: how ICT readiness fits inside the wider business continuity management of the organisation.
• Clause 7 Business expectations for IRBC: what the business needs from ICT during and after a disruption.
• Clause 8 Defining prerequisites for IRBC: what must be understood and in place before strategies are chosen.
• Clause 9 Determining IRBC strategies: selecting the approaches that will let ICT meet the business's recovery needs.
• Clause 10 Determining the ICT continuity plan: setting out how ICT services are continued and recovered.
• Clause 11 Testing, exercise, and auditing: showing that strategies and plans work and remain adequate.
• Clause 12 Final MBCO: confirming the minimum business continuity objective that ICT will support.
• Clause 13 Top management responsibilities regarding evaluating the IRBC: the role of top management in evaluating ICT readiness.
• Annexes A and B (informative): comparing RTO and RPO to business objectives, and risk reporting for failure mode and effects analysis (FMEA).

Putting it into practice

How do you implement ISO 27031?

With no certification audit at the end, the route follows your recovery needs and whoever will ask for proof. Sterling runs it in five steps, and where ISO 22301 or ISO/IEC 27001 certification is part of the plan, the same work feeds that system.

1. 01
   Agree the scope and the business expectations.Name the products, services and sites in scope and hear from the business how long each can tolerate an ICT outage and how much data loss it can accept.
2. 02
   Gap analysis: compare current ICT readiness with the guidance.Review backups, redundancy, disaster recovery arrangements, provider contracts and test history, then agree actions, owners and dates.
3. 03
   Set objectives and choose strategies.Fix recovery time and recovery point objectives per service, map dependencies including cloud and outsourced providers, and select strategies management will fund.
4. 04
   Write the ICT continuity plan and train the people in it.Roles, invocation, recovery sequences, communications and the return to normal operation, rehearsed with the teams who will carry them out.
5. 05
   Test, audit and report to top management.Run tests and exercises, audit the arrangements, confirm the minimum business continuity objective is met and bring the results to management for evaluation.

Check the route before you sign. A certificate "to ISO/IEC 27031" is not an accredited certificate, because the document is guidance; ask what standard any certificate is issued against and whether your customer or regulator will accept it. For ISO 22301 or ISO/IEC 27001, confirm that the certification body is accredited for that standard by an accreditation body recognised under the Global ACI arrangement, and check the certificate with the body that issued it. The certification buyer's checklist

Cost

How much does ISO 27031 implementation cost?

A single-site firm with one data centre and a few critical applications is a different undertaking from a group running hybrid cloud across several countries. The fee reflects the services in scope and the recovery capability you already have; a Sterling proposal shows every component and states everything that is included.

Timeline

How long does ISO 27031 implementation take?

As an estimate, a readiness programme typically runs three to six months. The pace depends less on writing plans than on getting decisions: business owners agreeing recovery objectives, management approving strategies, providers confirming what they can deliver and a test window opening.

Your engagement

What your ISO 27031 engagement includes

Every engagement runs on Sterling OS™. Sterling does not certify: where a certificate is part of the plan, the accredited certification body audits your ISO 22301 or ISO/IEC 27001 system and makes the decision.

• Design™: guided support

  Your IT and continuity leads write the objectives, strategies and plan; a Sterling consultant provides the method, interprets the guidance and reviews every draft.

• Drive™: managed support

  An alternative to Design™ when your team lacks capacity: Sterling runs the workshops, drafts the plan with your owners and leads the programme through testing and review.

• Sustain™: after go-live or certification

  Scheduled tests, reviews after incidents and changes, internal audits and preparation for customer audits or surveillance.

• Automate™: Effivity

  Objectives, dependencies, plans, tests, incidents and actions tracked in Effivity, included with the engagement at no additional cost.

• Training for your people

  Internal auditor training, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

Certification decisions remain with the independent certification body.

Often combined with

Standards organisations pair with ISO/IEC 27031

• ADHICS (Abu Dhabi)ADHICS compliance consulting for DoH-regulated healthcare entities in Abu Dhabi: patient information, systems and devices protected, with audit-ready evidence.
• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• CIS ControlsCIS Controls implementation and requirements: the 18 Controls and 153 Safeguards of v8.1, Implementation Groups, assessment with no certificate, cost and time.
• CMMC 2.0CMMC 2.0 certification consulting for defence contractors handling FCI and CUI: controls, SPRS score and evidence ready for self or C3PAO assessment.
• COSO ERMCOSO ERM implementation and requirements: the five components and 20 principles of the 2017 framework, why no certificate exists, route, cost and timeline.
• COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.