Share via

ISO 22301:2012 Business Continuity Management Standard

  • Article

ISO 22301 overview

The International Organization for Standardization (ISO) is an independent nongovernmental organization and the world's largest developer of voluntary international standards. The ISO formed the TC 223 Societal Security technical committee to develop standards for protecting society, including organizations, if catastrophes such as a natural disaster, major terrorist attack, or the shutdown of power grids occur.

Published in 2012 by the technical committee, ISO 22301:2012 is the first international standard for management systems that help ensure business continuity. ISO 22301 is the premium standard for business continuity, and certification demonstrates conformance to rigorous practices to prevent, mitigate, respond to, and recover from disruptive incidents.

Microsoft and ISO 22301

Microsoft is the first hyperscale cloud service provider to receive the ISO 22301 certification for business continuity management. An independent certification body awarded this certification to Microsoft Azure, Microsoft Azure Government, Microsoft Office 365 (including Commercial, Government, and Education offerings), Microsoft Defender for Cloud Apps, Microsoft Intune, and Microsoft Power BI after a stringent audit covering all aspects of their business continuity processes. The audit covered the in-scope services listed below and Azure management features, the Azure Portal, and the systems used to monitor, operate, and update the in-scope services.

Microsoft in-scope cloud platforms & services

  • Azure, Azure Government, and Azure Germany
  • Microsoft Defender for Cloud Apps
  • Dynamics 365, Dynamics 365 Government, and Dynamics 365 Germany
  • Microsoft Defender for Endpoint
  • Microsoft Graph
  • Microsoft Healthcare Bot
  • Intune
  • Microsoft Managed Desktop
  • Power Automate (formerly Microsoft Flow) cloud service either as a standalone service or as included in an Office 365 or Dynamics 365 branded plan or suite
  • Office 365 Commercial, Government, and Education
  • PowerApps cloud service either as a standalone service or as included in an Office 365 or Dynamics 365 branded plan or suite
  • Power BI cloud service either as a standalone service or as included in an Office 365 branded plan or suite
  • Power BI Embedded
  • Windows 365

Azure, Dynamics 365, and ISO 22301

For more information about Azure, Dynamics 365, and other online services compliance, see the Azure ISO 22301:2019 offering.

Audits, reports, and certificates

Frequently asked questions

Why is Microsoft compliance with ISO 22301 important?

ISO 22301 is a certification used by enterprises and governmental organization to show their commitment to serving their customers by achieving the highest available international standard for business continuity management. ISO 22301 is a comprehensive standard that demonstrates the highest level of commitment to business continuity and disaster preparedness.

Where can I get the ISO 22301 audit reports and scope statements for Microsoft services?

The Service Trust Portal provides independently audited compliance reports, so that your auditors can compare Microsoft's cloud services results with your own legal and regulatory requirements.

Can I use ISO 22301 compliance of Microsoft services in my organization's certification?

Yes. If your business requires ISO 22301 certification for implementations deployed on Microsoft services, you can use the Azure and Office 365 certifications in your compliance assessment. You are responsible, however, for engaging an assessor to evaluate the controls, processes, and implementation for ISO 22301 compliance within your own organization and for your own applications.

Use Microsoft Purview Compliance Manager to assess your risk

Microsoft Purview Compliance Manager is a feature in the Microsoft Purview compliance portal to help you understand your organization's compliance posture and take actions to help reduce risks. Compliance Manager offers a premium template for building an assessment for this regulation. Find the template in the assessment templates page in Compliance Manager. Learn how to build assessments in Compliance Manager.

Resources