ISO 22301 vs. DORA: What Are the Differences?

January 17, 2025 marked the effective date of DORA in the European Union. For the institutions concerned, the question is therefore no longer whether to strengthen digital resilience, but how to demonstrate effective control. The debate over ISO 22301 versus DORA is sometimes framed as a choice between a business continuity standard and a European regulation. This is an incomplete interpretation: while both frameworks serve similar purposes, their nature, scope, and mechanisms for demonstrating compliance differ profoundly.

For CCOs, CISOs, risk managers, and compliance functions, the challenge lies in integrating the two approaches without creating parallel systems. An organization already structured around ISO 22301 often has a useful foundation. However, it must build upon this foundation to meet the specific requirements of DORA, particularly regarding risks related to information and communication technologies, testing, and the management of third-party service providers.

ISO 22301 vs. DORA: Two Frameworks, Two Statuses

ISO 22301 is an international standard that defines the requirements for a business continuity management system, or BCMS. It provides a governance framework for identifying priority activities, analyzing impacts, establishing continuity strategies, formalizing plans, testing procedures, and improving them over time. It applies to any organization, public or private, regardless of size or sector.

DORA, short for the Digital Operational Resilience Act, is a directly applicable European regulation. It applies to financial institutions and certain critical third-party ICT service providers. Its purpose is to ensure that these entities can prevent, withstand, respond to, and recover from ICT-related operational and cyber incidents. This is not an optional best practice: organizations falling within its scope must demonstrate compliance to the relevant authorities.

The primary difference, therefore, is legal. ISO 22301 certification can be a strong indicator of maturity and managerial discipline, but it does not automatically mean compliance with DORA. Conversely, an approach designed strictly to meet DORA requirements may satisfy regulatory requirements without necessarily constituting a comprehensive and sustainable business continuity management system.

The Scope: Overall Continuity or Digital Resilience

ISO 22301 takes a broad approach to business continuity. Disruption scenarios may include a cyberattack, but also site unavailability, a supply chain disruption, the absence of key personnel, a public health incident, or a geopolitical crisis. The business impact analysis (BIA) is a central component: it links critical processes, necessary resources, recovery times, and the consequences of a disruption.

DORA focuses on digital operational resilience. The regulation covers ICT risk governance, the management and reporting of major incidents, digital resilience testing, the exchange of information on cyber threats, and the management of risks associated with ICT service providers. Its scope is therefore more specialized, while being particularly demanding in the financial sector.

This distinction has direct consequences. A Business Continuity Plan (BCP) developed in accordance with ISO 22301 can organize the response to the unavailability of a trading floor or a customer service center. For DORA, it will also be necessary to demonstrate that application dependencies, data flows, detection mechanisms, reporting procedures, and IT fallback solutions are managed and tested in accordance with regulatory requirements.

Useful similarities, but a different level of depth

Both executives share the same conviction: resilience is not merely a plan filed away in a document management system. It is based on clear governance, an understanding of critical activities or services, defined responsibilities, realistic response measures, and regular drills.

ISO 22301 requires senior management to support the management system, define a policy, allocate the necessary resources, and drive continuous improvement. DORA also expects strong involvement from senior management, particularly in setting the digital operational resilience strategy and managing ICT risks.

Discrepancies arise in the level of requirements. ISO 22301 specifies what a BCMS must achieve, while allowing significant flexibility regarding the means to do so. DORA is supplemented by technical standards for regulation and implementation that further clarify these expectations. ICT asset mapping, incident classification, notification deadlines, advanced threat-based penetration testing, and contractual provisions with service providers are among the topics that require greater precision.

Tests: Business Continuity Exercise and Resilience Validation

In an ISO 22301 process, exercises are used to verify that business continuity strategies and plans are effective. They can take the form of procedure reviews,tabletop exercises, crisis simulations, or failover tests. Their value depends less on their sophistication than on their ability to reveal actual shortcomings: decisions that take too long, overlooked dependencies, outdated contact information, or unrealistic recovery objectives.

DORA expects a more structured approach to digital resilience testing that is proportionate to the risk profile. Entities must implement a testing program covering critical ICT tools, systems, and processes. Some organizations will be required to conduct threat-based penetration tests, with strict procedures and follow-up requirements.

The pitfall lies in juxtaposing a business continuity plan (BCP) timeline with a cybersecurity timeline. A more effective approach is to develop joint scenarios. For example, a ransomware exercise can simultaneously assess detection, escalation, crisis management, communication, data recovery, business continuity, and return to normal operations. This does not eliminate the need for DORA-specific technical tests, but it improves the overall consistency of the system.

ICT Service Providers: A Key Area of Concern

Outsourcing is a familiar topic for business continuity managers. ISO 22301 naturally leads to identifying the suppliers that are essential to the delivery of priority products and services, and then incorporating their potential failures into continuity strategies.

DORA goes further regarding ICT dependencies. Financial institutions must manage risks associated with third-party providers, maintain a registry of information, assess concentration risks, and include detailed contractual provisions. They must also develop exit strategies where appropriate to prevent a technological dependency from turning a supplier incident into prolonged downtime.

Business continuity makes a concrete contribution here: it helps translate a supplier risk into business impacts. A contractual clause alone does not protect a critical service. It is essential to understand acceptable downtime thresholds, the alternatives that are actually available, the data required for recovery, and the conditions under which a fallback solution is triggered.

Establishing an Operational Link Between ISO 22301 and DORA

The starting point should be a scope analysis, not the proliferation of documents. An organization subject to DORA must identify the obligations that apply to it based on its category, its departments, and its outsourcing model. It can then align these obligations with its existing continuity, risk management, information security, crisis management, and supplier management frameworks.

A requirements matrix helps distinguish between what is already covered, what needs to be strengthened, and what constitutes a new initiative. The ISO 22301 impact analysis can inform the identification of critical functions as defined by DORA. Business continuity plans can be enhanced with procedures for responding to ICT incidents. Management reviews and SMCA indicators can incorporate the results of digital resilience tests, significant incidents, and supplier concentration risks.

This integration does not mean that all teams must use the same tools or assume the same responsibilities. The CISO, the BCP manager, the IT teams, compliance, procurement, and business units retain their respective roles. However, recovery plans, criticality thresholds, alert chains, and crisis decisions must be consistent. It is precisely at this level that systems either fail or hold up under scrutiny.

Key Takeaways for Managers

Pitting ISO 22301 against DORA leads to a dead end. ISO 22301 establishes a sustainable business continuity framework applicable to all threats that could disrupt critical operations. DORA requires the entities it covers to adhere to a specific digital resilience framework, accompanied by more detailed control and verification requirements.

For a financial institution, the most robust approach is to use business continuity as a framework for organizational coherence and DORA as a precise regulatory framework for IT risks. The competence of the teams is critical: they must know how to transform a requirement into a procedure, a procedure into a tested capability, and then a test result into a measurable improvement. It is this ability to execute—rather than the accumulation of documents—that enables an organization to respond to a real disruption in a methodical and credible manner.

This post is also available in: French