Business continuity and disaster recovery standards
Business continuity standards set out how you keep critical services running through an outage, attack or disaster, and how you restore them. ISO 22301 is the certifiable management system standard. ISO/IEC 27031 and NIST SP 800-34 add guidance on IT disaster recovery, and resilience laws such as DORA and NIS2 now require continuity planning for regulated firms.
1 item in this category
4 related from other categories
Oct 30, 2026 statuses last checked
At a glance
Business continuity and disaster recovery compliance compared
How the items in this category differ on the question that matters first: do you have to, or do you choose to?
Name
Type
Mandatory or voluntary
Where it applies
Current version
ISO 22301
Certifiable standard
Voluntary, with independent certification
Global
ISO 22301:2019 with Amendment 1:2024. Related guidance: ISO/IEC 27031 (ICT readiness) and NIST SP 800-34 (contingency planning).
Directory
What each one covers and who needs it
Certifiable standard Global
ISO 22301
Security and resilience: business continuity management systems, requirements
ISO 22301 sets requirements for a business continuity management system (BCMS). You analyze which activities matter most and how long they can be down (business impact analysis), assess risks, choose continuity strategies, write and exercise plans, and review and improve. Certification by an accredited body is voluntary. For IT and SaaS companies it pairs with ISO/IEC 27031 and NIST SP 800-34 for disaster recovery of systems, and supports duties under DORA and NIS2.
What it covers, who needs it and why
What it covers
Business impact analysis, risk assessment, continuity strategies and solutions, plans and procedures, exercising and testing, and evaluation.
Who needs it
SaaS, cloud, data center and managed service providers whose customers depend on uptime, and firms in regulated sectors.
Why it matters
Customers and regulators want evidence that you can keep delivering through disruption, not just a backup policy.
Key objectives
Protect prioritized activities during disruption
Recover within agreed timeframes
Exercise and improve plans
Mandatory or voluntary
Voluntary, with independent certification.
Owner
ISO (TC 292)
Current version
ISO 22301:2019 with Amendment 1:2024. Related guidance: ISO/IEC 27031 (ICT readiness) and NIST SP 800-34 (contingency planning).
Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union
NIS2 is the EU directive that sets cybersecurity risk management and incident reporting duties for medium and large organizations in 18 critical sectors. Digital infrastructure and ICT service management are among them, so cloud providers, data centers, managed service providers and managed security providers are directly in scope. Entities must take risk management measures, report significant incidents (early warning within 24 hours), and their management bodies must approve measures and take training. Fines reach 10 million euros or 2% of turnover for essential entities.
What it covers, who needs it and why
What it covers
Network and information systems of essential and important entities, including supply chain security, incident handling, continuity, encryption and access control.
Who needs it
Medium and large companies in listed sectors in the EU, including cloud, data center, managed service and managed security providers, and some digital providers regardless of size.
Why it matters
It makes executives personally accountable and brings many IT providers under a regulator for the first time.
Key objectives
Raise a common baseline of cybersecurity
Require fast incident reporting
Hold management bodies accountable
Address supply chain risk
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
European Union; enforced by national competent authorities
Current version
Member states had to transpose it by 17 October 2024. Several transposed late, so national laws are still arriving.
ITIL framework for IT and digital service management
ITIL is the most widely used framework of good practice for IT service management. ITIL 4 describes a service value system, guiding principles and 34 management practices, including incident, problem, change enablement and service level management. ITIL Version 5 is rolling out in 2026 with new modules, including AI governance. ITIL certifies people, not organizations; an organization that wants a certificate for its service management uses ISO/IEC 20000-1.
What it covers, who needs it and why
What it covers
How IT services are designed, delivered, supported and improved: service desk, incidents, problems, changes, releases, service levels, assets and continuity.
Who needs it
Managed service providers, internal IT departments, service desks and anyone bidding for IT service contracts.
Why it matters
Buyers often expect ITIL-aligned processes and ITIL-certified staff in managed service tenders.
Key objectives
Deliver value through services
Standardize service management practices
Improve services continually
Mandatory or voluntary
Voluntary framework, no official certificate.
Owner
PeopleCert (which acquired AXELOS)
Current version
ITIL 4 with 34 practices. ITIL Version 5 is being rolled out in phases during 2026, starting with Foundation.
ISO 31000 gives principles, a framework and a process for managing any kind of risk in any organization. The process runs from establishing scope and context to risk identification, analysis and evaluation, treatment, monitoring and reporting. It is guidance, so it cannot be certified, but it shapes how ISO 27001, ISO 22301 and ISO 42001 expect risk to be handled and is a common reference for enterprise risk management programs.
What it covers, who needs it and why
What it covers
Enterprise and operational risk management principles, governance and process, applicable to IT, security, project and business risk.
Who needs it
Risk managers, security and compliance leads, and companies building one risk method across several standards.
Why it matters
A single, consistent risk method avoids running separate and conflicting risk registers for each standard.
Regulation EU financial sector and its ICT providers
DORA
Digital Operational Resilience Act, Regulation (EU) 2022/2554
DORA sets a single set of digital operational resilience rules for EU banks, insurers, investment firms, payment institutions and other financial entities. It requires an ICT risk management framework, classification and reporting of major ICT incidents, resilience testing (including threat-led penetration testing for larger firms), and close management of ICT third-party risk, with mandatory contract terms. ICT providers designated as critical are overseen directly by EU supervisors.
What it covers, who needs it and why
What it covers
ICT risk management, incident reporting, testing, third-party contracts and the register of ICT providers, plus oversight of critical ICT providers.
Who needs it
EU financial entities, and every IT, cloud and SaaS vendor that supports their critical or important functions.
Why it matters
Financial customers must put DORA contract terms, audit rights and exit plans into vendor agreements.
Key objectives
Withstand and recover from ICT disruption
Report major incidents consistently
Control dependence on ICT providers
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
European Union; national financial supervisors and the European Supervisory Authorities
Current version
Applies from 17 January 2025. The first list of critical ICT third-party providers was designated in late 2025.
Train your team on business continuity and disaster recovery requirements
Most of these frameworks expect trained staff and records to prove it. LMS Advisor assigns the right courses by role, sends reminders, renews certificates on schedule and keeps an audit trail you can export.
Due dates, reminders and overdue reports for mandatory courses
Certificates that expire and renew on your retraining cycle
CSV, Excel and PDF exports of who completed what, and when
LMS Advisor is our product. It runs your training and keeps the records. It does not certify you against any standard.
Book a demo before Dec 1, 2026 and your quote comes with 30% off your first year of LMS Advisor: courses, proctored exams, certificates and AI authoring in one platform, in our cloud or on your own server.
Offer ends Dec 1, 2026, 11:59 PM ET
Cloud or self-hosted, proctoring included
The discount is applied in your written quote
We use cookies to see how visitors use this site and to measure our ads. Choose Continue to allow them, or Reject to browse without them. Privacy policy
LMS Advisor AI
AI product consultant
You're chatting with an AI. Answers can be wrong, so please don't type personal data here. Privacy ·
