Who ends up implementing ISO 22301, and what sets the clock running?

Business continuity is often a job nobody owns until the day it matters. Then it belongs to whoever is nearest: the risk manager, the head of IT operations, the facilities lead, or a consultant brought in because a customer, a regulator or a bad week has asked a question nobody could answer. The ISO 22301 Lead Implementer is the person who turns that question into a working business continuity management system. This guide is about who that person tends to be, what they have to build, and what puts a deadline on it.

The facts here come from ISO's pages for ISO 22301, ISO 22313 and ISO/TS 22317, PECB's ISO 22301 Lead Implementer Candidate Handbook, version 1.5, PECB's course page, the Official Journal texts of DORA and NIS2, and the O*NET profile for business continuity planners, all read on 20 October 2026.

What does an ISO 22301 Lead Implementer build?

A business continuity management system, or BCMS. ISO 22301:2019 sets the requirements for one. It is the second edition, published in October 2019 by ISO's technical committee for security and resilience, ISO/TC 292, and it has been amended once, by ISO 22301:2019/Amd 1:2024. On the day we read it, ISO's page listed the standard as due for revision, with a new edition at the committee draft stage. The 2019 text, with its amendment, is the one in force, and it is the one PECB's exam is built on.

A BCMS does not promise that nothing will go wrong. It makes an organization decide, in advance and in writing, which activities matter most, how long each can be down before the damage becomes unacceptable, and what it will do to get them back in time. Then it makes the organization test those decisions, check that they still hold and keep improving them. The standard follows the same clause structure as other ISO management system standards, clauses 4 to 10, which is why anyone who has worked on ISO 27001 or ISO 9001 will recognize the shape.

The heart of the system is in clause 8, operation, and that is where most of an implementer's time goes. In practice they produce a short list of things that everything else hangs from:

• A scope that says which products, services, sites and activities are inside the BCMS.
• A business continuity policy and objectives that top management signs.
• A business impact analysis that ranks activities by the damage their loss would cause over time, and sets how quickly each must be resumed.
• A risk assessment of the threats that could disrupt the activities the impact analysis put first.
• Business continuity strategies and solutions, chosen from those results, with the resources they need.
• Business continuity plans and procedures, including how the organization responds to an incident, communicates and recovers.
• An exercise program that tests the plans, with reports that feed back into them.

Around that core sit the parts every management system shares: competence and awareness, documented information, monitoring, internal audit, management review, and the handling of nonconformities. Two ISO documents help with the detail. ISO 22313:2020 gives guidance on using ISO 22301, and ISO/TS 22317:2021 gives guidelines for the business impact analysis in particular. Neither is required for certification, but implementers who have read them tend to write a better impact analysis.

The business impact analysis deserves its own paragraph, because it is the step most first projects get wrong. It is tempting to start with the threats: fire, flood, cyber attack, a supplier going under. The standard starts with the activities instead. Which ones deliver the products and services that matter? What happens, hour by hour and day by day, if each one stops? How long can it be down before the impact is no longer acceptable? Only once that is settled does the risk assessment ask what could cause the stoppage. Get the order wrong and the plans protect against vivid threats rather than the losses that would actually hurt.

PECB weights its seven competency domains the way the job is weighted:

Planning and implementation together carry 36 of the 80 questions, which matches the job: most of the work is in deciding what the system should be and then making it real. The handbook also splits the paper evenly by level of understanding. Of the 80 questions, 40 test comprehension, application and analysis, and 40 test evaluation, where you judge which option is right for the organization in front of you. Half the exam, in other words, is judgment rather than recall.

Who gets sent on the course?

PECB's audience list for the five-day course is short. It names managers and consultants involved in business continuity, people who want to master the implementation of a BCMS, people responsible for keeping an organization's BCMS conforming to the requirements, and people who carry roles and responsibilities in the BCMS. In the United States, O*NET's profile for business continuity planners describes the core of the job as developing, maintaining or implementing business continuity and disaster recovery strategies, including risk assessment, business impact analysis, strategy selection and documented procedures, then planning and running exercises to test them and coordinating the response after a disruption. O*NET places the occupation in Job Zone Four, where most jobs ask for a bachelor's degree and considerable work experience.

Put job titles on those descriptions and a familiar cast appears.

The common thread is that none of these people can build continuity alone. The impact analysis needs the heads of each business area to say what matters and how fast. The strategies need budget. The plans need the people who will carry them out at three in the morning. The implementer's real skill is running that process across the organization, and the PECB domains reward exactly that: knowing who decides what, in which order, with which record.

When does the work land on your desk?

For most implementers there is a moment when continuity stops being a binder on a shelf and acquires a deadline. These are the usual ones.

A customer asks for proof

Picture a supplier to a large retailer or a bank, in the middle of a contract renewal. The customer's supplier assurance questionnaire asks for the business continuity plan, the date of the last test and evidence that the results were acted on. Some customers ask for an ISO 22301 certificate outright. The supplier has a plan, written three years ago, never tested. Someone is told to fix it before the renewal, and by the end of the week they are reading about the course.

DORA reaches a financial entity

For banks, insurers, investment firms and the other financial entities it covers, the Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied since 17 January 2025, and continuity is one of its pillars. Article 11 requires an ICT business continuity policy as part of the ICT risk management framework, implemented through documented arrangements, plans, procedures and mechanisms that keep critical or important functions running, respond to and resolve ICT-related incidents, contain damage, estimate impacts and losses, and manage communication and crisis. It requires a business impact analysis of exposure to severe business disruptions, using quantitative and qualitative criteria and scenario analysis. It requires the ICT business continuity plans and the ICT response and recovery plans to be tested at least yearly, and after substantive changes to systems supporting critical or important functions. It requires a crisis management function, except in microenterprises, and records of activity before and during disruption. Article 12 adds backup, restoration and recovery procedures. That is a great deal of evidence, and an ISO 22301 BCMS is a natural place to build and keep it.

NIS2 reaches an essential or important entity

The NIS2 Directive, Directive (EU) 2022/2555, applies through national law to essential and important entities in the sectors it lists. Article 21(2)(c) names business continuity, such as backup management and disaster recovery, and crisis management among the minimum cybersecurity risk-management measures, and Article 20 makes the management body approve those measures and oversee them. Where NIS2 applies, the continuity plan stops being an internal choice and becomes something a national authority can ask about.

The board decides to certify

Sometimes the push comes from the top: a board that wants certification as part of a growth plan, a tender requirement or a move into regulated markets. Certification is carried out by a certification body, which audits the BCMS against ISO 22301, usually in two stages. The implementer's job is to have a system that passes both and keeps passing at each surveillance audit.

Something actually goes wrong

The least comfortable trigger is a real disruption: a site lost to a flood, a ransomware attack that takes systems down for days, a key supplier that fails without warning. Afterwards, leadership tends to want more than a lessons-learned memo. It wants a system that would have made the week shorter, and somebody to build it.

What each continuity duty makes you produce

This is the table that saves the most time on a first BCMS project in the financial sector, and it works for NIS2 entities too. It takes each continuity duty in DORA Article 11, DORA Article 12 and NIS2 Article 21(2)(c), names the BCMS record that usually answers it, and shows where that record sits in the PECB exam. The law sets the duty; the BCMS is where you keep the proof.

Two things stand out. First, the same handful of records answers almost every row: the policy, the impact analysis, the plans, the exercise reports and the internal audit. Build those properly once and they serve the customer, the regulator and the certification body alike. Second, the rows cluster in PECB's planning and implementation domains, the two that carry 36 of the 80 exam questions. The exam is weighted toward the work that regulators actually ask to see. We have turned the table into a checklist you can copy below.

Where does the credential apply?

ISO 22301 is an international standard, and certification to it is offered wherever certification bodies audit business continuity management systems. PECB runs the exam worldwide, online through the PECB Exams application with a remote invigilator, or on paper through the partner that ran your course. For online multiple-choice exams, PECB says candidates receive their results instantly. Candidates who sit a Lead exam in a language that is not their own can ask, on the day, for 30 extra minutes.

What changes from country to country is the law around the standard. Inside the EU, DORA and NIS2 give continuity a legal edge for the organizations they cover. In the United States, federal agencies plan contingency for their information systems with NIST SP 800-34 Revision 1, the Contingency Planning Guide for Federal Information Systems, and suppliers to them often meet its vocabulary first. Elsewhere, the pressure usually comes from customers, insurers and tenders rather than from a regulator. In every case the BCMS gives the work one structure, whichever rulebook is asking.

What the credential is not

It is not your organization's certificate. The Lead Implementer is a personal credential. The certificate an organization holds comes from a certification body after an audit, and holding the first does not give your employer the second.

It is not a disaster recovery engineering course. The exam does not ask you to configure backups or fail over a data center. It asks you to decide, document and check, in the order the standard expects, and to make sure the technical recovery serves the priorities the business set.

It is not the auditor's credential. PECB runs a separate ISO 22301 Lead Auditor scheme for people who will audit a BCMS. Our guides to the ISO 22301 Lead Implementer interview questions and which certification suits which role help if you are choosing between the two.

And it is not a substitute for the standard. ISO 22301 is sold rather than published free, and the exam is open book: PECB allows a hard copy of ISO 22301, the training course materials and the notes you took during the course. Our guide to PECB's open-book rules explains what that does and does not let you do.

Which credential level can you claim?

PECB awards four levels on the same exam. You sit one paper; the title you hold depends on the experience and BCMS project hours you can show.

Each level also needs the exam and a signed PECB Code of Ethics. PECB's course page lists the kinds of project work that count: drafting a BCMS implementation plan, initiating the implementation, implementing the BCMS, monitoring and managing the implementation, and continually improving it. If you are early in your career, the Provisional Implementer is a real credential: it shows you passed the same exam, and the hours you log on your first BCMS project move you up. PECB certifications are valid for three years.

How does it compare with the credentials around it?

The two ISO 22301 credentials are mirror images: one builds the system, the other tests it. The pairing with ISO/IEC 27001 is the one that matters most in practice. NIS2 lists business continuity inside its cybersecurity measures, and DORA puts ICT business continuity inside the ICT risk management framework, so in many organizations the continuity lead and the security lead now answer to the same regulator about overlapping evidence. Our ISO 27001 Lead Implementer Exam Guide covers the security side.

What will the exam expect of you?

Eighty multiple-choice questions, three options each, 70% to pass, which is 56 correct answers and no more than 24 wrong. The handbook says the paper mixes stand-alone questions with scenario-based ones, built on a short description of an organization part way through its BCMS project, where every question turns on what the implementer should do next.

The wrong options are the instructive part. They are rarely absurd. They describe sensible things done in the wrong order, by the wrong person, or without the record the standard requires: choosing a recovery strategy before the business impact analysis has set the priorities, letting IT decide which activities matter most, treating a successful system restore as proof that the business can recover, or running an exercise and filing the report without acting on what it found. Our guide to PECB scenario-based questions shows the pattern, and the ISO 22301 Lead Implementer exam guide breaks the paper down domain by domain. If you want a quick check of where you stand, the mind map puts the seven domains on one page and the 10-question quiz takes five minutes.

If you fail, PECB emails a list of the domains where you did poorly, and there is no limit on retakes, though PECB sets minimum gaps between attempts. PECB's course page adds that candidates who took the course and failed can retake the exam once for free within 12 months of the first attempt. Our guide to PECB results and retakes has the detail.

How to prepare

Most candidates sit the exam on day five of a PECB partner course. The course runs over four days of teaching: an introduction to ISO 22301 and the start of a BCMS implementation, the implementation plan, the implementation itself, then performance evaluation, continual improvement and preparing for the certification audit. PECB's course page says the certification and exam fees are included in the course price, that participants receive more than 450 pages of information, practical examples and quizzes, and that completing the course earns an attestation worth 31 CPD credits. Its stated prerequisite is a fundamental understanding of business continuity concepts and principles, and our pre-course reading guide covers what to read first.

The course explains the standard. What it rarely gives you is enough practice at the evaluation questions, where the marks are lost. The ISO 22301 Lead Implementer Exam Guide (Wikidata) has 13 chapters across PECB's seven domains. Each one sets out what the domain asks of you, the confusable pairs that cost marks, the trap in the material, how to answer under exam conditions and five questions to ask yourself. The ISO 22301 Lead Implementer Practice Questions (Wikidata) gives you 212 questions with full rationales, weighted to the published domains, with scenario sets beside the stand-alone questions. If you have a few weeks, our study plan spreads the work out.

So, should it be you?

It probably should if, in the next year, you will own the business impact analysis for your organization, answer a customer or a regulator about continuity with evidence, run the exercise program, or carry a BCMS through a certification audit. It is a particularly good fit if you work in or for a financial entity under DORA, because so much of Article 11 maps straight onto the system the course teaches you to build.

It probably should not, or not yet, if your work is purely technical recovery and someone else will own the system, or if what you need is the auditor's view rather than the builder's. In that case the Lead Auditor, or a technical disaster recovery qualification, may serve you better.

The best implementers share one habit, and it is the habit the exam rewards: they let the business decide what matters, in writing, before anyone buys a solution. If that already describes how you work, the credential is a short step. If it describes how you would like to work, it is a very good one.

Questions people ask about the ISO 22301 Lead Implementer

Who is the ISO 22301 Lead Implementer certification for?

People who build and run a business continuity management system. PECB's course page names managers and consultants involved in business continuity, people who want to master BCMS implementation, people responsible for keeping a BCMS conforming, and people who carry BCMS roles and responsibilities.

Does the Lead Implementer credential make my organization ISO 22301 certified?

No. The Lead Implementer is a personal credential from PECB. An organization is certified to ISO 22301 by a certification body after an audit. The implementer is the person who gets the organization ready for that audit.

What experience do I need for the full ISO 22301 Lead Implementer credential?

PECB asks for five years of work experience, two of them in business continuity management, and 300 hours of BCMS project activities, plus the exam and the PECB Code of Ethics. With the exam alone you can hold the Provisional Implementer credential and move up as your experience grows.

How is the PECB ISO 22301 Lead Implementer exam set?

It is 80 multiple-choice questions with three options each and a 70% pass mark: 56 correct answers. It mixes stand-alone and scenario-based questions, and it is open book. Planning and implementation are the largest domains, with 18 questions each.

Which edition of ISO 22301 does the exam follow?

ISO 22301:2019, the second edition, published in October 2019, with Amendment 1 published in 2024. ISO's page lists the standard as due for revision, with a new edition under development, so check the handbook version and the standard's page before you sit.

Can I bring ISO 22301 into the exam?

Yes. PECB allows a hard copy of ISO 22301, the training course materials and the notes you took during the course. ISO 22301 is sold rather than published, so you need your own copy.

Does ISO 22301 satisfy DORA?

Not on its own. DORA is law, and Articles 11 and 12 set specific duties, such as testing continuity and recovery plans at least yearly and keeping records of activity during a disruption. An ISO 22301 BCMS is a strong place to keep the evidence, because most of those duties have a natural home in it, but each legal duty still has to be mapped and met.

Is business continuity part of NIS2?

Yes. Article 21(2)(c) of NIS2 lists business continuity, such as backup management and disaster recovery, and crisis management among the minimum cybersecurity risk-management measures. The national law that transposes NIS2 decides which organizations it covers.

ISO 22301 Lead Implementer or Lead Auditor: which first?

Pick the side of the table you will sit on. The implementer builds the BCMS and prepares it for audit; the auditor plans and runs audits of it. People who will own the system usually start with Lead Implementer, and people heading for internal audit or a certification body usually start with Lead Auditor.

What happens if I fail the PECB exam?

PECB emails a list of the domains where you did poorly, and there is no limit to the number of retakes, though PECB sets minimum gaps between attempts. PECB's course page says candidates who took the course and failed can retake the exam once for free within 12 months of the first attempt.

Which books prepare you for the ISO 22301 Lead Implementer exam?

ISO 22301 Lead Implementer Exam Guide

A study companion for the PECB Certified ISO 22301 Lead Implementer examination. 13 chapters, 378 pages.

What is insideBuy on Amazon

ISO 22301 Lead Implementer Practice Questions

Practice questions with full rationales, weighted to the published domains. 228 pages.

What is insideBuy on Amazon