Standards and frameworks · Governance and coordination

ISO/IEC 27031:2025 Cybersecurity – Information and communication technology readiness for business continuity

PublishedPaid · 16 May 2025

Standards are protected by copyright and almost always sold: here you find metadata, an original summary and a link to the official catalogue page where they can be consulted or bought. The text is not reproduced.

Summary

The standard explains how an organisation’s IT function should prepare to keep the business running when systems, networks or digital services are disrupted by failures, cyber incidents or external events. It describes the concepts and principles of ICT readiness for business continuity (IRBC), the methods for identifying critical services and their dependencies, and how to set and meet recovery objectives: minimum business continuity objective (MBCO), recovery point objective (RPO) and recovery time objective (RTO). It applies to organisations of every type and size and links business continuity planning with information security management.

Reference

ISO/IEC 27031:2025

Official title

Cybersecurity – Information and communication technology readiness for business continuity

Body

ISO / IEC – Technical committee: ISO/IEC JTC 1/SC 27

Type

Standard

Status

Published

Published

16 May 2025

Edition

2.0

Access to the text

Paid

Sectors

• Governance and coordination
• Incident management / CSIRT

Notes

The second edition replaces the 2011 edition, entitled “Guidelines for information and communication technology readiness for business continuity”. It complements ISO 22301, which sets out the business continuity management system for the whole organisation. The standard is published jointly by ISO and IEC; the link leads to the IEC catalogue.

Last verified

2 November 2026 (verified via web)

Metadata and summary: CC BY 4.0 · JSON

Report an error in this record (opens in a new tab)