ISO 22361 and ISO 22301 both contribute to organizational resilience, but they address different organizational needs.
The simplest way to understand the distinction is:
Business continuity helps the organization continue. Crisis management helps the organization lead.
ISO 22301 focuses on business continuity management, while ISO 22361 focuses on strategic crisis management capability. They are not competing approaches. In many organizations, they need to work together.
What Is ISO 22301?
ISO 22301 is the international standard for Business Continuity Management Systems (BCMS). It specifies requirements for establishing, implementing, maintaining, and continually improving a management system designed to prepare for, respond to, and recover from disruptions.
Its practical focus is the organization’s ability to continue delivering prioritized products and services at an acceptable capacity during disruption.
ISO 22301 is a requirements standard, meaning its requirements can be used to assess conformity of a Business Continuity Management System.
What Is ISO 22361?
ISO 22361 provides guidance for developing and improving an organization’s strategic crisis management capability.
Its focus includes crisis leadership, decision-making, communication, training, validation, and learning. It is particularly relevant to senior management and others responsible for strategic crisis management capability.
Unlike ISO 22301, ISO 22361 is a guidance standard, not a requirements standard. Its purpose is to help organizations develop how they lead and manage crises rather than establish requirements for a certifiable management system.
The Fundamental Difference
A serious disruption does not automatically become a crisis.
An organization may experience an operational disruption while established incident-response and business-continuity arrangements remain effective. Critical activities may continue through alternate locations, workarounds, redundant technology, alternative suppliers, or other continuity solutions.
A crisis presents an additional leadership challenge.
The organization may face significant uncertainty, rapidly changing consequences, competing priorities, heightened stakeholder attention, or decisions that exceed normal operational authority.
Business continuity asks questions such as:
How do we maintain or recover prioritized activities?
Crisis management adds questions such as:
What are our priorities now? Who has authority? What decisions must be made despite uncertainty? What risks are we prepared to accept? What should we communicate to employees, customers, regulators, and other stakeholders?
This is the essential distinction:
Business continuity helps the organization continue. Crisis management helps the organization lead.
ISO 22301 vs ISO 22361: A Practical Comparison
The following is an independent practical comparison developed by Crisis Readiness Pro. It is not an ISO table or official ISO interpretation.
| Area | ISO 22301 | ISO 22361 |
| Primary discipline | Business continuity management | Crisis management |
| Type | Requirements | Guidance |
| Primary focus | Continuity during disruption | Strategic crisis management capability |
| Emphasis | BCMS and continuity arrangements | Leadership, decisions, coordination and communication |
| Key question | How can prioritized activities continue or recover? | How should the organization lead through the crisis? |
| Response orientation | Continuity and recovery | Strategic direction and crisis leadership |
The distinction should not create artificial barriers between the disciplines. Effective organizational resilience depends on their ability to work together.
How Do ISO 22301 and ISO 22361 Work Together?
Consider a major cyberattack.
Technical incident-response teams may investigate and contain the attack. Disaster recovery teams may restore affected technology. Business continuity arrangements may enable critical activities to continue through alternate systems, manual procedures, or other solutions.
At the same time, senior leadership may need to decide which services receive priority, how scarce resources are allocated, what level of risk is acceptable, what customers and regulators should be told, and when the organization can safely return to normal operations.
Those are crisis-management decisions.
Operational response, business continuity, disaster recovery, and crisis management can therefore operate simultaneously at different but interconnected levels.
Does an Organization Need Both?
For many organizations, yes.
A mature business continuity capability does not automatically create a mature crisis management capability. An organization may have detailed continuity plans but still struggle with escalation, strategic decision-making, communication, or cross-functional leadership during a crisis.
The reverse is also true. Strong crisis leadership cannot compensate for the absence of workable continuity arrangements when critical operations are disrupted.
The objective should therefore be integration rather than duplication.
Practical Questions for Organizations
A useful starting point is to examine the interfaces between business continuity and crisis management:
- When should a business disruption be escalated to crisis leadership?
- Who has authority to activate the Crisis Management Team?
- How does information move between operational teams and crisis leadership?
- Who establishes enterprise priorities when several critical activities are affected?
- Are business continuity and crisis management arrangements exercised together?
These questions can reveal gaps that may not be visible when the two disciplines are assessed separately.
Different Purposes, Complementary Capabilities
Business continuity focuses on maintaining organizational delivery during disruption. Crisis management provides the strategic leadership capability required when uncertainty, consequences, stakeholder attention, and decision complexity exceed normal management arrangements.
Business continuity helps the organization continue. Crisis management helps the organization lead.
Together, they can provide complementary elements of organizational resilience.
For professionals seeking a structured learning path, the online crisis management course Mastering Crisis Management with ISO 22361 explores the crisis-management capability in greater depth.
The Professional Crisis Management Toolkit provides editable resources for translating crisis management principles into practical governance, preparedness, response, recovery, exercises, validation, and continual improvement.
Independent Resource Notice: Crisis Readiness Pro resources and the comparison presented in this article are independently developed by Shalom David. They are not ISO publications and are not affiliated with, endorsed by, approved by, or certified by the International Organization for Standardization (ISO). ISO 22301 and ISO 22361 are referenced for educational and professional discussion purposes.