Standards and guidance for keeping IT services running through disruption and recovering after it: ISO 22301, ISO/IEC 27031, NIST SP 800-34 and disaster recovery planning.
Business continuity is about keeping the most important activities running when something goes wrong; disaster recovery is the IT part of that, getting systems and data back. Customers ask about both in due diligence, and several laws now require them from specific sectors: DORA for EU financial entities, for example, and continuity expectations in Indian banking and securities rules.
The standards
ISO 22301 is a certifiable business continuity management system standard. It asks you to understand your organisation, run a business impact analysis, set recovery objectives, write and test plans, and keep improving. ISO/IEC 27031 gives guidance on making ICT ready to support continuity. NIST SP 800-34 is a contingency planning guide for information systems that many non-federal organisations also use as a template.
What auditors and customers look for
Recovery time objectives (how long a service can be down) and recovery point objectives (how much data you can afford to lose) set for each service from a business impact analysis; backups that are protected from the same threats as production; restore tests with evidence; and plans that name people, contact routes and decisions rather than only systems.
Where it overlaps
ISO/IEC 27001, SOC 2 (availability criteria) and most cybersecurity frameworks include continuity controls. The guides show how one well-tested plan can serve them all.
At a glance
Mandatory or voluntary: business continuity & disaster recovery
European Union. Applies directly to EU financial entities and reaches ICT third-party providers worldwide through contracts and, for critical providers, direct oversight.
European Parliament and Council; supervised by national competent authorities and the European Supervisory Authorities (EBA, EIOPA, ESMA)
ISO/IEC 27031: Cybersecurity, Information and communication technology readiness for business continuity
ISO/IEC 27031 gives guidance on ICT readiness for business continuity (IRBC): making sure the technology that critical business activities depend on can withstand and recover from disruption. It explains how to link ICT continuity with business continuity and security, identify critical ICT services from the business impact analysis, set ICT recovery time and point objectives, choose strategies for people, facilities, technology, data, processes and suppliers, write ICT continuity plans, and test them. The 2025 edition updated the 2011 original.
ISO 22301 Security and resilience: Business continuity management systems: Requirements
ISO 22301 is the international standard for a business continuity management system (BCMS): a managed way to prepare for, respond to and recover from disruptions. It requires organisations to understand their context, analyse the impact of disruption on their activities, set recovery objectives, choose continuity strategies, write plans, exercise them and keep improving. It is voluntary and certifiable, and IT and SaaS companies use it to prove resilience to customers and regulators.
IT disaster recovery planning: how standards and laws expect RTO, RPO, backups and recovery testing
IT disaster recovery planning makes sure the systems and data a business depends on can be restored within agreed times after outages, cyberattacks or disasters. Standards and laws describe it differently but expect the same core elements: a business impact analysis, recovery time and point objectives, protected backups, redundant infrastructure, written recovery procedures, regular tests and improvement. This guide compares what ISO, NIST, SOC 2, HIPAA, DORA, RBI and SEBI expect, and how to build a plan that satisfies them together.
NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems
NIST SP 800-34 is the US government's guide to contingency planning for information systems. It sets out a seven-step process: policy, business impact analysis, preventive controls, recovery strategies, a system contingency plan, testing and training, and maintenance. It explains how plans such as disaster recovery, continuity of operations and incident response fit together, defines terms like maximum tolerable downtime, RTO and RPO, and provides templates for low, moderate and high impact systems.
Digital Operational Resilience Act, Regulation (EU) 2022/2554
DORA is the EU regulation on digital operational resilience for the financial sector. Since January 2025 it has required banks, insurers, investment firms, payment and e-money institutions, crypto-asset providers and other financial entities to manage ICT risk, report major ICT incidents, test resilience and manage ICT third-party providers under strict contract rules. Software, cloud and IT service providers to these firms must accept DORA contract terms, and critical providers are overseen directly by EU supervisors.
ISO 31000 is the international guideline for managing any kind of risk, from strategy and operations to projects, technology and compliance. It defines risk as the effect of uncertainty on objectives and sets out eight principles, a framework for integrating risk management into governance and decision making, and a repeatable process for assessing, treating, monitoring and reporting risk. It is the parent of specialised standards such as ISO/IEC 27005 for information security risk.
What is the difference between business continuity and disaster recovery?
Business continuity covers the whole organisation's ability to keep operating. Disaster recovery is the technical recovery of IT systems and data, which is one part of it.
Is ISO 22301 certification mandatory?
No. It is voluntary. Some sector laws and contracts require continuity planning and testing, and certification is one way to evidence it.
How often should disaster recovery be tested?
Standards ask for regular testing proportionate to risk, and some regulations set specific cycles. The guides list what each source expects.
We build the parts auditors and privacy laws look for: role-based access, audit logs, encryption, consent records, data export and erasure, and secure development practices. Tell us about your product and get a free quote within one business day.
