ISO 22301 business continuity for multi-site groups: one system, every site

A fire, a flood, a ransomware attack or the loss of one key supplier rarely stays inside one plant. In an industrial group, sites feed each other: one plant makes a component that three others need, one warehouse ships for a whole country, one data centre runs the systems for every site. When that single point goes down, the disruption travels through the group faster than any site plan was written to handle.

ISO 22301 is the international standard for business continuity management systems (BCMS). This guide is for COOs, risk and resilience leads and group EHS directors who need continuity to work across many sites and countries, not only at the head office. It explains where the standard stands in 2026, what its operational clause asks for, and how to build one group system that sites can actually run. It is general information, not legal advice; your certification body applies the details.

Why continuity is a group problem

• Dependencies cross sites. A site can recover its own building and still be unable to ship, because the plant upstream is down.
• Priorities conflict. When capacity is short, someone has to decide which customers and products come first. That decision belongs to the group, not to each site on the day.
• Plans drift apart. Without a group frame, every site writes its plan in its own format, with its own assumptions about recovery times, and nobody can add them up.
• The threats are shared. The Business Continuity Institute's Horizon Scan 2025 (published November 2025) reported that extreme weather was the single largest cause of disruption over the previous 12 months, the first time since 2017. Cyberattacks, extreme weather and IT and telecom outages topped respondents' concerns for the next 12 months. Weather and cyber events hit several sites at once.

ISO 22301 in 2026: where the standard stands

The current edition is ISO 22301:2019, the second edition, published on 31 October 2019. It replaced the 2012 edition, mainly by restructuring the text rather than adding new requirements. Two later developments matter for groups planning certification now:

• Climate action amendment (2024). ISO 22301:2019/Amd 1:2024 was published in February 2024 as part of ISO's climate action changes to management system standards. It adds to clause 4.1 the requirement that the organization shall determine whether climate change is a relevant issue, and a note to clause 4.2 that relevant interested parties can have requirements related to climate change.
• A new edition is in development. ISO lists ISO/CD 22301 as under development at stage 30.60 (committee draft comments closed), and states that it will replace ISO 22301:2019. No publication date is given, so certify against the 2019 edition with its amendment, and plan to treat the new edition as a controlled change when it arrives.

Supporting guidance includes ISO 22313 (guidance on using ISO 22301) and ISO/TS 22317:2021, which gives guidelines for setting up a formal, documented business impact analysis process without prescribing one method.

What clause 8 asks for

Clauses 4 to 7 and 9 to 10 follow the same harmonized structure as ISO 45001 and ISO 14001, so a group with an integrated management system already has most of the frame. The business continuity work sits in clause 8, Operation:

A group business impact analysis

The business impact analysis (BIA) is where most multi-site programmes go wrong. If each site rates impact on its own scale, the results cannot be compared and the group cannot set priorities. A workable group approach:

1. Start from products and services, not buildings. List what the group delivers to customers and which sites and activities contribute to each.
2. Use one impact scale. Define impact categories once for the group (for example safety, customers, legal and regulatory, financial, reputation) with the same levels and time steps for every site.
3. Run the BIA per site against the group list. Each site identifies its activities that support a group product or service, the impact over time if they stop, and the resources they need: people, information and data, buildings and equipment, technology and suppliers.
4. Consolidate at group level. The group decides the prioritized activities and their timeframes, because only the group sees the whole chain.
5. Repeat at planned intervals and after change. A new line, a closed warehouse or a new key supplier changes the answer.

MTPD, RTO, RPO and MBCO

Four terms carry most of the decisions in a BIA:

• Maximum tolerable period of disruption (MTPD): the longest time an activity can be down before the consequences become unacceptable.
• Recovery time objective (RTO): the target time to resume the activity. It must be shorter than, or equal to, the MTPD.
• Recovery point objective (RPO): how much data can be lost, measured back from the moment of disruption.
• Minimum business continuity objective (MBCO): the minimum level of output the organization accepts during the disruption, a temporary service level.

In a group, set these per product or service and then translate them to each contributing site. A site's RTO is only meaningful if the upstream site and the systems it depends on can recover in time too.

Map dependencies between sites

A simple dependency map shows where a single failure stops several sites. For each prioritized activity, record:

• Upstream sites and internal supplies it needs.
• Shared services: IT systems, data centre or cloud, shared warehouses, transport and utilities.
• Key external suppliers, especially single-source suppliers.
• Specialist people or skills that only one site has.

The map turns into risk treatment: second sources, buffer stock, cross-training between sites, an agreed alternate site, or a reciprocal arrangement between plants that run similar processes.

Plans: one group frame, site playbooks

Write plans in two layers. The group frame sets the response structure (who declares an incident, who leads at group, country and site level), escalation rules, communication with customers, authorities and staff, and the priority list from the BIA. Each site playbook follows the same template and covers activation, the first hours, recovery of its prioritized activities and handover back to normal operation. Plans should help people assess the disruption, activate the response and communicate its effects to interested parties.

Keep plans under document control: one numbering scheme, one current version, translations that change with the master. Our guide to ISO document control for multi-site groups shows a three-tier model that works for continuity plans too.

An exercise programme across sites

Clause 8.5 asks for exercises that are consistent with the continuity objectives, based on realistic scenarios, run at planned intervals, and followed by a formal review with improvements. For a group, plan the programme once:

• Tabletop exercises at every site, using group scenarios such as loss of a building, loss of IT, loss of a key supplier, loss of people or a utility failure.
• Cross-site exercises that follow one disruption through the chain, for example an upstream plant going down and the downstream sites switching to stock or an alternate source.
• Group-level exercises for the crisis team, including customer and media communication.
• Technical tests of IT recovery against the RTO and RPO set in the BIA.

Every exercise ends with a debrief, timings against objectives, and actions with owners and due dates, tracked to closure like any other corrective action.

Where continuity meets EHS

ISO 45001 clause 8.2 already requires each site to prepare for and respond to emergencies, and many groups run drills, emergency teams and first-aid checks under it. Emergency response protects people in the first minutes. Business continuity takes over from there: how the site, and the group, keep delivering. Link the two so that the same scenarios, teams and drill records feed both systems. Our guide to emergency preparedness across many plants covers the EHS side. Incidents and near misses are also an input to continuity: an investigation that finds a single point of failure should update the BIA, not only the risk assessment.

Multi-site certification

Groups certifying ISO 22301 for many sites usually follow the multi-site rules in IAF MD 1:2023, applied by accredited certification bodies. As certification bodies summarise them, there must be a defined central function that manages and controls the whole organization, including document control, changes to the system, corrective actions, internal audits, management review and legal monitoring, and internal audits must be completed at all sites, with a management review, before the initial certification audit. The certification body then samples sites under the rules in MD 1. In practice, a single group BCMS with one BIA method, one plan template and one exercise programme is what makes this possible. See also our guide to ISO 45001 multi-site certification, which uses the same rules.

12-point checklist

1. Scope defined: which sites, products and services the BCMS covers.
2. Climate change assessed as an issue under clause 4.1 (Amd 1:2024).
3. One group BIA method and impact scale, with ISO/TS 22317 as a reference.
4. Prioritized activities, MTPD, RTO, RPO and MBCO set per product or service.
5. Dependency map of sites, shared services, suppliers and key skills.
6. Risk assessment of disruption scenarios, reviewed at planned intervals.
7. Group strategies chosen: alternate sites, stock, second sources, cross-training.
8. Group response structure and escalation rules agreed.
9. Site playbooks on one template, under document control.
10. Exercise programme covering every site, cross-site chains and the group team.
11. Every exercise and real event reviewed, with actions tracked to closure.
12. Internal audits at all sites and a management review before certification.

Frequently asked questions

How AccelSafety helps

AccelSafety, our enterprise HSE software, includes certification tools for ISO 22301 alongside ISO 45001, 14001, 9001, 50001 and 22000, more than 50 tools in all, with shared requirements handled once. Every site sits in one organizational hierarchy, from group to region, country, cluster and site, and access is scoped to each user's part of it and enforced on the server. The emergency response module covers teams, drills and first-aid checks; risk assessment, incidents and investigation, audits and inspections and actions and CAPA sit in the same system, so exercise findings and lessons from real events become tracked actions with owners and due dates. Dashboards drill back to the auditable source records with their history, and people can record from a phone with photos.

Accel installs it, migrates your last two years of records within 7 days, and looks after hosting, updates, training and support, with unlimited users. Book a demo to see how your sites and standards would fit.

General information, not legal advice. Check the current text of ISO 22301 and its amendment, IAF MD 1, and your certification body's rules.

Sources

• ISO: ISO 22301:2019/Amd 1:2024, climate action changes
• ISO: ISO/CD 22301, under development (will replace ISO 22301:2019)
• PECB: ISO introduces climate action amendments to management systems standards
• Wikipedia: ISO 22301 (editions and history)
• Schellman: What are the ISO 22301 requirements? (clause 8 summary)
• ISO: ISO/TS 22317:2021, guidelines for business impact analysis
• PECB: Key definitions used in ISO 22301 and ISO 22313
• BCI: Complex and interconnected risk, the BCI Horizon Scan 2025
• GUTcert: Instruction sheet, multi-site certification (IAF MD 1:2023)