{"id":4673,"date":"2013-05-21T21:41:01","date_gmt":"2013-05-21T21:41:01","guid":{"rendered":"https:\/\/multiacademstg.wpengine.com\/27001academy\/blog\/013\/05\/21\/iso-22301-vs-iso-22313\/"},"modified":"2025-07-09T09:30:18","modified_gmt":"2025-07-09T09:30:18","slug":"iso-22301-vs-iso-22313","status":"publish","type":"post","link":"https:\/\/staging.advisera.com\/27001academy\/blog\/2013\/05\/21\/iso-22301-vs-iso-22313\/","title":{"rendered":"ISO 22301 vs. ISO 22313"},"content":{"rendered":"

I was quite skeptical when I started to read ISO 22313, the guidance standard on business continuity management, but I was proved to be wrong. It can be quite useful as a supplement to ISO 22301<\/a> \u2013 here’s what I found:<\/p>\n

Similarities and differences<\/h2>\n

If you are familiar with ISO 27001<\/a> and ISO 27002 (see ISO 27001 vs. ISO 27002<\/a>), a very similar relationship exists between ISO 22301 (published in May 2012) and ISO 22313 (published in December 2012): ISO 22301 is the main standard, which defines the framework for business continuity management, whereas ISO 22313 is an auxiliary standard that helps with the ISO 22301 implementation.<\/p>\n

The main difference is that ISO 22301 specifies requirements \u2013 in other words, you need to comply fully with everything that is written in this standard if you want to get your company certified. This is why this standard uses words like “shall” and “must.” Learn more here: 17 steps for implementing ISO 22301<\/a>.<\/p>\n

As opposed to that, ISO 22313 gives only the guidance, or best practices, on how the requirements from ISO 22301 could be implemented; however, implementation doesn’t have to be done exactly that way. You’ll notice that terminology here is different \u2013 “should” and “may” are used. Consequently, a company can be certified only against ISO 22301, not against ISO 22313.
\n

<\/div>