ISO 22301 vs ISO 27001: which certificate mid-market firms should buy first

This page is a buying comparison. It is for operations, quality, IT, and compliance leads at mid-market manufacturers and professional services firms. One contract, insurer, or supplier portal names an ISO/IEC 27001 certificate. Another line names ISO 22301, a business continuity management system, or a requirement that products or services keep going after a disruption. Sales conversations will offer to "cover continuity inside the security quote," often by pointing at two controls in the 2022 annex. The useful question is a procurement question: which certificate does this cycle have to produce, and can you show the system behind it.

Those two standards are both management systems, and they are not the same product. ISO 22301 is the business continuity management system (BCMS). ISO/IEC 27001 is the information security management system (ISMS). They share a clause structure. They both use risk. The 2022 information-security annex has two controls that speak to disruption and to ICT readiness. None of that turns one certificate into the other.

Quality versus information security, when that is the fork, is ISO 9001 vs ISO 27001. A NIST CSF 2.0 profile versus an information-security certificate is ISO 27001 vs NIST CSF. The certificate-versus-report fork, when the other artifact is SOC 2, is ISO 27001 vs SOC 2. Stacking quality, environment, and occupational health and safety on one plant programme is the integrated management systems guide. After you pick the certificate, the request still uses one outbound scope pack. You still verify accreditation for the legal entity and the edition. This page does not invent prices, audit-day counts, durations, or a ranking of certification bodies.

The decision here is narrower: 27001 only this cycle, 22301 only this cycle, both certificates together, or neither until the system exists. Then one honest request.

1. What each standard covers

Skip the clause lecture. Buyers do not award work because they memorized an annex.

ISO 22301 is the management-system standard for business continuity. ISO's public page for ISO 22301:2019 is edition 2, published in October 2019 (the lifecycle dates publication to 30 October 2019). The title on that page is the requirements standard for security and resilience, in the form of a business continuity management system. ISO's page describes a documented system to protect against disruptive incidents, reduce their likelihood, and recover from them. The same page gives the status as published, at stage 90.92 (to be revised), and lists a committee draft, ISO/CD 22301, as the project that will replace this edition. A committee draft is not an edition a certification body can print. The edition you can discuss today is the published one, and only when a body's schedule lists it.

The same page records one amendment, ISO 22301:2019/Amd 1:2024, climate action changes, published in February 2024. The IAF/ISO joint communique of 22 February 2024 says the climate amendments add two statements to the shared management-system text: the organization determines whether climate change is a relevant issue, and interested parties can have requirements related to climate change. The communique says the intent is that climate is considered among the other issues that affect the system. It does not turn a continuity audit into an environmental audit. Ask whether the line you will buy includes the amendment. Do not add a separate "climate certificate" to the request.

ISO's management system standards list marks ISO 22301:2019 as Type A and HS. On that page, a Type A standard contains requirements an organization can claim conformance against, and certification is possible only against requirements. HS means the Harmonized Structure. The same list marks ISO 22313:2020 as Type B guidance on the use of ISO 22301. Type B cannot be certified. Leave 22313 off the RFQ.

ISO/IEC 27001 is the management-system standard for information security. ISO's public page for ISO/IEC 27001:2022 is edition 3, published in October 2022 (the lifecycle dates publication to 25 October 2022), at stage 60.60. The title on that page is the requirements standard for information security, cybersecurity and privacy protection, in the form of an information security management system. ISO's page says the standard defines requirements an ISMS must meet, and that conformity means a system to manage risks to the security of data the organization owns or handles. The same page names the three principles: confidentiality (only the right people can access the information), integrity (the information stays reliable and is not erased or damaged), and availability (the organization and its clients can access the information when they need it). Availability on that page is about information. It is not a finding that the plant, the product line, or the outsourced service keeps operating at a predefined capacity.

ISO's 27001 page says certification is a choice, and that a certificate from an accredited body can add confidence. Name the edition, for example certified to ISO/IEC 27001:2022. ISO's management system standards page says ISO does not perform certification. You hire a certification body. The 2013 edition is withdrawn on the 27001 page. If a contract still says 2013, write that down and ask which edition the body can audit. Do not assume a withdrawn edition and the current edition are one line. The 27001 page also lists a 2024 climate action amendment. The same IAF/ISO communique describes that family of amendments. Ask which text the certificate will cite.

Buyers meet the 27001 control decision as a Statement of Applicability: which Annex A controls apply, and why the others do not. The output is a certificate for a defined scope of information, activities, legal entity, and sites.

You can hold both certificates on one legal entity. This page is about which one this request is for.

2. Where they overlap

Three overlaps cause the bad quote. Each one is real. None of them is a substitute.

Shared structure. ISO's page on management system standards says the Harmonized Structure lays management system standards out in the same way, regardless of the subject, and that Annex SL is the place where identical text, terms, and definitions are set so two or more standards can run as one integrated system. The MSS list marks both ISO 22301:2019 and ISO/IEC 27001:2022 as HS. In buying language, that is the shared spine: context, leadership, planning, support, operation, performance evaluation, and improvement. Document control, competence, internal audit, management review, and corrective action can be one set of processes when they already serve both systems. A shared table of contents is not a shared system. If the continuity manual and the security manual disagree about the same incident, you have two systems.

Risk. Both standards expect you to understand what can go wrong and to plan from that. The questions differ. An ISMS risk assessment asks what can harm the confidentiality, integrity, or availability of information in scope, and the treatment of those risks drives the Statement of Applicability. A BCMS asks what disruption would do to the products and services you have promised to keep delivering, and what you will do about that. Teams often keep one method and even one register. The rows are not interchangeable. An information-security risk that says "the file server is unavailable" does not answer "which customer shipments have to resume, and by when." A business impact analysis that never mentions who can still read the drawings does not answer the ISMS.

Annex A controls 5.29 and 5.30. ISO/IEC 27001:2022 Annex A includes two organizational controls that sit next to continuity. Control 5.29, information security during disruption, asks the organization to plan how it will keep information security at an appropriate level while it is disrupted. Control 5.30, ICT readiness for business continuity, asks it to plan, implement, maintain, and test ICT readiness against business continuity objectives and ICT continuity requirements. They belong in the Statement of Applicability when they apply, with evidence, or with a reasoned exclusion when they do not. They are how an ISMS talks about disruption and about ICT continuity. They are not a BCMS, and they are not an ISO 22301 certificate. A disaster-recovery test of a platform can be evidence under 5.30. The same test does not, by itself, show that you have determined which products and services must continue, chosen strategies, written plans, and exercised them as a management system.

ISO 22301 is the standard that makes continuity of defined products and services the purpose of the system: protect against disruption, reduce its likelihood, and recover, which is how ISO's 22301 page describes the management system. The artifacts a buyer can walk are the business impact analysis, the strategies, the plans, and the exercise programme, inside a scope you can point at. ISO/IEC 27001 makes security of information the purpose, and it samples continuity only to the extent those Annex A controls apply and the availability of that information has to be managed.

3. Where they differ

Question	ISO 22301:2019	ISO/IEC 27001:2022
What it is for	Continuity of defined products and services through disruption	Security of information: confidentiality, integrity, and availability
The system	A business continuity management system	An information security management system
What the buyer walks	Business impact analysis, strategies, plans, and exercises for a named scope	A used Statement of Applicability, risk treatment, and the controls you claim
Where continuity appears	It is the subject of the standard	Inside the ISMS: availability of information, plus Annex A 5.29 and 5.30 when they apply
Structure	Harmonized Structure, per ISO's MSS list	Harmonized Structure, per the same list
Status on iso.org	Published October 2019. Stage 90.92, to be revised. Climate amendment, February 2024. A committee draft is in development	Published October 2022. The 2013 edition is withdrawn. Climate amendment listed on the same page
What the certificate does not clear	A field that says ISO/IEC 27001, a SOC 2 report, or a NIST CSF profile	A field that says ISO 22301, or a promise that operations resume at a predefined capacity

Read the exhibit before you pick a row. If one field says ISO/IEC 27001 and another says ISO 22301, you have two requirements. Overlap is how you staff a combined programme. It is not how you delete a line the customer wrote.

4. Who typically needs which, this cycle

Manufacturers. A mid-market plant usually meets ISO/IEC 27001 when a customer, OEM portal, or insurer scores information: drawings, recipes, process data, a connected line, or a supplier-security questionnaire that will not accept a quality certificate in that field. That fork, when the other side is ISO 9001, is ISO 9001 vs ISO 27001. The same plant meets ISO 22301 when a supply agreement, a critical-supplier rule, or an insurer names continuity of products after a disruption: a single-source component, a long replacement lead time, or a contractual recovery expectation that a quality manual does not answer. A fire plan in the EHS binder, and a backup of the ERP, can be evidence inside a BCMS. They are not the certificate.

Put 27001 on this cycle when that certificate is the dated ask and the ISMS exists. Put 22301 on this cycle when continuity is the dated ask and the BCMS exists. Put both on this cycle only when both asks are real and both systems exist. A plant that holds ISO 9001, ISO 14001, and ISO 45001 has an operations stack. That stack is the IMS buying guide. Continuity and information security are not extra marks you add to it so the pack looks complete.

Professional services. A firm that sells advice, a managed process, or a hosted service usually meets ISO/IEC 27001 first. Portals and security questionnaires ask for an accredited ISMS certificate. A SOC 2 report is a different product. Use the SOC 2 comparison when that is the fork. A NIST CSF profile is a different product. Use the NIST comparison. The same firm meets ISO 22301 when the thing the customer bought is the ongoing service, and the contract names a BCMS certificate or ISO 22301: payroll, claims, a hosted operation, a business-process service the customer cannot pause. An uptime sentence in a service-level agreement is a commercial promise. A disaster-recovery test is a piece of evidence. Neither one is an ISO 22301 certificate, and neither one fills a 27001 field.

Neither this cycle is the honest call when the sentence in the contract is real and the system is not. Build the system, then send. An RFQ does not create a business impact analysis or a Statement of Applicability. Readiness still has the first-certificate shape: a scope you can defend, documented information that matches Tuesday, internal audit and management review on this system, and a named owner.

5. Certifying both as one system

Buy both on one programme when a customer has named each certificate on a date you can point at, or two customers have named one each and both are this cycle, and both the BCMS and the ISMS already run. Same legal entity, or two entities written on purpose. Someone can walk the business impact analysis and someone can walk the Statement of Applicability. They can be the same person only if that person actually owns both. Sites match, or the difference is written down. More than one location still follows multi-site certification scope. At least one certification-body legal entity must be accredited for every edition on the page. If no single body covers both, use two bodies and say so. Each still receives the same facts.

The integrated management systems guide is written for ISO 9001, ISO 14001, and ISO 45001 on a plant. The buying rule travels, and the stack does not. Integrate processes you already run once: the Harmonized Structure clauses, internal audit, management review, corrective action. Keep the discipline-specific work visible: continuity strategies, plans, and exercises on one side; information-security risk treatment and Annex A, including 5.29 and 5.30, on the other. You may still receive two certificates. The product you are buying is the designed programme.

Three mismatches should stop the send.

The second system is a paragraph. A 27001 project with a sentence about backups is not a BCMS. A continuity plan that never mentions who may access information during the disruption is not an ISMS. Mark the missing certificate as a later add, with a recheck date, until an owner can walk it.

The boundaries are different companies. A BCMS on the plant subsidiary and an ISMS on the parent that signs the security exhibit are two legal entities. Put the entity the customer contracts with on the page.

The site maps are different, and the pack pretends they are not. Continuity of a factory and security of a cloud estate can be different locations. Say so. A shared campus is a fact. It is not a default scope.

Cost and time, in qualitative terms only: one real system is the smaller buy. A second real system adds audit work. Shared clauses can be sampled once when they already run, which is a method the body has to restate, not a percentage you import. A hollow second system adds findings. Sites, headcount bands, travel, remote versus on-site work, and the rest of the three-year cycle move the proposal in the same way as any other combined request. This page does not publish a fee, a day count, or a duration. Freeze the drivers and compare replies in what drives certification cost. What each line on the proposal should be called is what a quote includes.

6. How the request changes

One narrative, so the facts do not drift. The ISO request uses the scope pack. Naming a second standard changes specific rows. It does not replace the pack with a letter that says "please include continuity."

Fact	If ISO/IEC 27001 is this cycle	If ISO 22301 is this cycle
What you are buying	An accredited ISMS certificate for the edition you will claim	An accredited BCMS certificate for ISO 22301:2019, and whether the 2024 climate amendment is on that line
How it relates to the other standard	Say whether 22301 is a later add, already held, or out of scope	Add to an existing 27001 scope, buy both, or 22301 only
Who may issue it	A certification-body legal entity accredited for that 27001 edition	A legal entity accredited for ISO 22301. A 27001 line is not enough
Boundary	Information, activities, legal entity, sites, and what sits outside	Products and services that must continue, the activities that deliver them, legal entity, and sites
What you can walk	Risk treatment and a used Statement of Applicability, including 5.29 and 5.30 if you claim them	Business impact analysis, strategies, plans, and the exercise programme
Out of scope on purpose	Name it	A product line, a site, or a service the customer is not buying
The other artifact	SOC 2 or a CSF profile only if a separate field names it	The same rule. A BCMS certificate does not produce those artifacts

Headcount is a band per location. Ask the questions in what a quote includes. Leave ISO 22313 off the page. Leave a committee draft off the page. Do not ask the body to certify that you comply with a customer continuity playbook, an insurance wording, or a regulation. You may say which contract sentence prompted the request, so the scope matches the exhibit.

If only one standard is this cycle, one sentence is enough for the other: later add, already held, or out of scope. That sentence stops a body from quoting a system you will not staff.

7. Picking a registrar that can issue both

A published standard is not an accreditation. The method is how to verify accreditation. Use it for this pair with a tighter reading of the line.

Ask, in writing, for the legal entity that will sign, the accreditation body, the standard, and the edition. IAF CertSearch is where you trace accredited certificates and certification-body identities. The accreditation-body directory is where that body's own scope lives. For the mark buyers most often see on a proposal here, start with ANAB's directory of management-system certification bodies. Other IAF MLA accreditation bodies can be legitimate. The test is the mark your customer accepts and the legal entity on that body's current schedule.

This directory tags ISO/IEC 27001. It does not tag ISO 22301. A 27001 tag is not a 22301 line. Annex A control 5.30 is not a 22301 line. A group brochure that says "resilience" is not a 22301 line.

Among the profiles on this site, three record an ISO 22301 scope, and one records the opposite. Read the limits. Then re-check the live schedule in the quarter you would book.

Coalfire. The profile for Coalfire Certification, Inc. records the public ANAB scope, accreditation ID MS-4539, issue date 13 August 2026, as listing ISO/IEC 27001:2022 and ISO 22301:2019 (the 22301 line dated 27 April 2021 on that issue). That is a schedule that covers both certificates this page is about. The same profile limits ISO 9001 on that issue to information technology, so a plant quality certificate is a different question. Confirm the live issue before you award. The profile points at the ANAB certificate for MS-4539.

A-LIGN. The profile records that ANAB's public scope for A-LIGN Compliance and Security, Inc., doing business as A-LIGN, lists ISO/IEC 27001, including the 2022 edition, and ISO 22301. That profile does not print a 22301 edition in the note. Confirm the edition on the live ANAB schedule. The same profile describes a UKAS schedule for ISO/IEC 27001:2022 and ISO/IEC 27701. It does not record an ISO 22301 line under UKAS. If the customer wants a UKAS mark on the continuity certificate, confirm that mark on the live UKAS schedule rather than inferring it from the ANAB line.

NQA. The profile records two legal entities. It says ISO 22301 appears on the ANAB scope for National Quality Assurance, USA, and in the UKAS summary for NQA Certification Ltd as ISO 22301:2019, and that both of those published scopes include ISO/IEC 27001:2022. Ask which legal entity will sign, and which mark will be printed. A UKAS line and an ANAB line are not the same signature.

Insight Assurance. The profile records that public pages name ISO 22301, and that the accreditation scope it reviewed does not list it. A services page is not a schedule. Confirm any 22301 claim against the live scope before you shortlist that body for this certificate.

Every other certification body is in the same place as a body that is not in this directory: open the schedule, or do not award. How to choose a registrar still applies after the schedule matches. Sector experience, the mark the customer will accept, and independence from anyone who wrote the system are the next questions. A body that wrote the BCMS or the ISMS should not audit it. That split is consultant vs certification body.

8. Send one request

Make the call in one sitting. Put one sentence at the top of the request.

1. Write the requirement in their words. If one field says ISO/IEC 27001 and another says ISO 22301, note which deal is blocked this cycle. Mark SOC 2, a CSF profile, and the plant stack (9001, 14001, 45001) as different products unless their own gate is this cycle.
2. Match it to a system you can show. A 27001 request needs an ISMS and a used Statement of Applicability. A 22301 request needs a BCMS an owner can walk: what must continue, the strategies, the plans, and the exercises. If that system does not exist, do not send.
3. Pick one design. 27001 only, 22301 only, or both together. Both together needs both systems and a live accreditation line for each edition.
4. Name the boundary. Information and sites for the ISMS. Products, services, and sites for the BCMS. Say when those maps differ.
5. Check the signer before you invite them. Use how to verify accreditation for the legal entity, the mark, and the edition. A 27001 line does not include ISO 22301.

If the room is still split after step 3, do the work that unblocks the deal and park the other certificate until its evidence and its accreditation line exist.

When a certificate is the artifact, send one registrar RFQ / scope pack. The Get quotes form does not list ISO 22301. In Scope notes, name ISO 22301:2019, say whether you need the 2024 climate amendment on that line, and say whether this cycle is continuity only, information security only, or both. Tick ISO/IEC 27001 only when that certificate is part of the request. Put any certificate you already hold in Existing certificates. Submit once.