Why this page looks like this. Production's page promised to "Ensure ISO 22301 compliance", said "Legal frameworks guarantee release if vendors fail", promised "uninterrupted service" and "seamless operation", and said our services fit an existing BCMS "without requiring process changes". All of it overclaims. The page follows the ISO 27001 page and tells the five-step story for a business continuity manager:

The exposure: the clauses where continuity gets specific, by number and title.
The shift: a continuity plan that says "restore" versus evidence the restore works.
The model and the proof: an evidence map from each clause to the documents that support it.
The next step: book a demo, or get the sample evidence pack.

ISO text is copyright, so the page names clauses by number and title only. Titles were checked against ISO's own preview of ISO 22301:2019 (table of contents, © ISO 2019, served by the ANSI webstore) and cross-checked with BSI's ISO 22301 mapping guide (October 2019). Where BSI's guide differs ("8 Operations", "8.3 Business continuity strategy and solutions"), the ISO preview wins ("8 Operation", "8.3 Business continuity strategies and solutions"). The standard's title, edition, Amendment 1:2024 and its "to be revised" status come from iso.org/standard/75106.html. The hero mock is an example account; names are fictional. Production claims kept, flagged: "Trusted by 3,500+ teams" (trust row) and "deposits sync daily" (and the "synced" states in the example mocks) are production figures, kept as agreed; each needs an owner's sign-off before launch (to-confirm.md; fact-check, 7 Oct).

ISO 22301:2019

Continuity plans that include your software. Exercised, and on file.

ISO 22301 asks for continuity solutions, written plans and an exercise programme. Codekeeper covers the applications those plans depend on, in-house or from a supplier, and gives you dated evidence that each one can come back.

Book a demo Get the sample evidence pack

Trusted by 3,500+ teams
ISO/IEC 27001:2022 certified
Evidence mapped to clauses 8.2 to 8.6

Business continuity · critical applicationsExample Logistics Group · BCMS scopeEvidence current

Warehouse ControlSupplier · ContinuityLive map current

Route PlannerSaaS supplier · Resilience ProRebuild passed

Order HubSupplier · Escrow ProRebuilding

Customer PortalIn-house · BackupSynced today

Tested Exit ReportRoute Planner · Exit Exercise · 2 Sep 2026Pass

Example account. Names are fictional.

Social proof straight after the promise. These are the logos production already uses, loaded from codekeeper.co. Where an image can't load (for example in the preview), the name shows instead. Use the approved set only.

Trusted by 3,500+ teams, from regulated enterprises to fast-growing software vendors

Step 1, the exposure: the clauses, by number and title. Production's "Key ISO 22301 requirements" paraphrased four activities and cited "continuity clauses (8.3 and 8.4)". This section names the real clauses instead, titles exactly as in ISO's preview of the standard, with our own one-line note on where software comes in. No ISO text is reproduced.

Status cards come from iso.org: published 2019-10, edition 2, ISO/TC 292; ISO 22301:2019/Amd 1:2024 "Climate action changes"; stage 90.92, "to be revised", since 5 Dec 2025, with ISO/CD 22301 under development.
Removed from production's timeline: the 2020–2023 transition period, ISO 22313:2020, and "Annual surveillance and three-year recertification audits are required to maintain compliance". The audit cycle comes from certification-body rules, not the standard, and we didn't verify the rest. The timeline also rendered twice (a carousel duplicate).

What ISO 22301 asks

Clause 8 is where continuity gets specific.

ISO 22301 sets the requirements for a business continuity management system. Clause 8, Operation, moves from policy to practice: what matters, how you'd continue, what the plans say and how you exercise them.

8.2 · Business impact analysis and risk assessment

The activities that matter most, and what they depend on. Supplier software is often on that list.

8.3 · Business continuity strategies and solutions

How each priority activity would continue. For a critical application, someone has to be able to bring it back.

8.4 · Business continuity plans and procedures

The plans people follow, including 8.4.5, Recovery. A plan that relies on a supplier assumes the supplier is still there.

8.5 · Exercise programme

Putting plans and solutions to the test. For software, that means rebuilding it, not just reading the plan.

8.6 · Evaluation of business continuity documentation and capabilities

Checking that plans and capabilities still fit. Software changes with every release.

9.3 · Management review

Top management looks at how the system performs. Dated evidence per application gives that review something concrete.

Clauses are named by number and title only; the full text is in the standard, available from ISO. Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your auditor to decide.

Oct 2019ISO 22301:2019 publishedEdition 2 · ISO/TC 292, Security and resilience

2024Amendment 1: Climate action changesISO 22301:2019/Amd 1:2024

Under revisionISO lists the 2019 edition as to be revised, with a new edition in developmentiso.org, checked 7 Oct 2026

Step 2, the shift, as a before-and-after table by clause area. Production's line "When auditors ask how you'll keep operations running during vendor disruptions, software escrow provides the proof" is the idea, without the absolute. The "with evidence" column uses only confirmed outputs and jobs: the SBOM, the three protections (released to you, recovered by us, kept online while we recover), the Exit workbook, rebuilds without the supplier in hours, and change flags between rebuilds (Agentic Verification monitoring).

Where software fits

A continuity plan assumes the software comes back.

Most continuity plans cover people, premises and data. The applications behind each activity, especially the ones a supplier builds or hosts, often appear as one line that says "restore". The question is whether anyone has tried it without the supplier.

On paper

With evidence

Impact analysis

An application named as a dependency

A protection on it, and an SBOM of what it's built from

Strategy

The supplier restores the service

Released to you, recovered by us, or kept online while we recover

Plan

A recovery step with no detail

An Exit workbook with the recovery steps

Exercise

A walk-through on paper

A rebuild with no help from the supplier, in hours

Evaluation

Reviewed at the annual review

Changes flagged between rebuilds, so you know when to rebuild

Step 4, the proof: the evidence map, by clause. Clause numbers and titles exactly as in ISO's preview; no ISO text. The right-hand column names confirmed documents and the protection they come with. "Supports" is the stance: the auditor decides.

Confirm before launch: whether the live environment map is a document customers receive (open item, as on DORA, NIS2 and ISO 27001), and whether Software Backup carries a Software Resilience Certificate in the new line-up.
Resilience recovery is best effort under the Resilience Arrangement, as the 8.4.5 row says.
Production said our certificates are "formal evidence" and "Certified assurance … proof of tested continuity controls". Those were Validated/Verified/Certified-era claims and are gone.
16 Oct: Continuity Pro added. The SBOM, build steps, deployable copy, Exit workbook, rebuilds and change flags now say "Continuity Pro" or "the Pro levels"; base Continuity no longer includes Agentic Verification.

Evidence map

Evidence for each clause.

Which documents support which clause, and the protection they come with.

ISO 22301:2019	Codekeeper evidence
8.2.2 Business impact analysis	Each critical application in one account, with its protection and a checked record of what's deposited. With Continuity, a map of where the live service runs and the accounts and services it needs. Software Resilience CertificateVault reportLive environment mapEscrow · Resilience · Continuity · live environment map with Continuity
8.2.3 Risk assessment	A software bill of materials for each rebuilt application, so you can see what it depends on. SBOMBuild stepsEscrow Pro · Resilience Pro · Continuity Pro
8.3.2 and 8.3.3 Identification and selection of strategies and solutions	A choice, per application, of who runs the recovery: released to you, recovered by us, or kept online while we recover. Agreed in writing before anything goes wrong. Escrow AgreementResilience ArrangementEscrow · Resilience · Continuity
8.3.4 Resource requirements	What it takes to bring the application back: its components, its build steps and a deployable copy. Build stepsSBOMDeployable copyEscrow Pro · Resilience Pro · Continuity Pro
8.4.4 Business continuity plans and 8.4.5 Recovery	The recovery process step by step. With Resilience, Codekeeper runs the recovery, best effort, under the Resilience Arrangement. With Continuity, the live environment is also kept paid and switched on for an agreed period while we recover. Exit workbookResilience ArrangementExit workbook with the Pro levels · recovery by us with Resilience and Continuity
8.5 Exercise programme	Rebuilds you start, four a year included, each with a run report and a dated certificate. An Exit Exercise tests the business functions you nominate, without the original developers. Recoverability CertificateRun reportTested Exit ReportEscrow Pro · Resilience Pro · Continuity Pro · Exit Exercise as an add-on
8.6 Evaluation of business continuity documentation and capabilities	Deposits sync daily. Between rebuilds, we compare the deposit with the live repositories and flag what changed, so you know when the evidence needs refreshing. Vault reportRun reportEvery protection · change flags with the Pro levels
9.3 Management review	Dated documents per application, ready for the review. CertificatesRun reportsTested Exit ReportEscrow · Resilience · Continuity · Exit Exercise as an add-on

Codekeeper's evidence supports your assessment. Whether it meets a specific requirement is for you and your auditor to decide.

Step 3, the model, as the full line-up. ISO 22301 asks the organisation to choose its own strategies and solutions (8.3), so this page shows the whole ladder rather than one recommendation, framed by the strategy question each protection answers. Prices are the 6 Oct list (software row); the note is the agreed price logic sentence. Backup is named for in-house systems without a price, because of the open $99 vs $89 conflict. The Exit Exercise "from $12,000" is confirmed, but its unit isn't published yet (to-confirm.md). 16 Oct: Continuity Pro added as a sixth card ($1,699, Danny 11 Oct); base Continuity is now everything in Resilience and no longer includes Agentic Verification; the note gains the price logic's closing sentence. Continuity Pro's level line "Full continuity, proven in advance." was confirmed by Danny on 16 Oct. 17 Oct: the recovery models are named, as in the launch film (Danny): Self-Run Recovery for Escrow, Managed Recovery for Resilience and Continuity.

Which protection fits

Match the protection to your continuity strategy.

If your strategy is to take the software and run it yourself, that's Escrow. If you'd rather we ran the recovery, that's Resilience. If the service can't go dark while it's recovered, that's Continuity.

Self-Run Recovery

Escrow

Everything you need to be protected.

Your supplier's code with a neutral party, under clear release terms. Checked and certified.

From $199per application per month

Explore Escrow

Self-Run Recovery

Escrow Pro

Everything you need to recover.

Escrow plus Agentic Verification: proof the deposit builds, and a Recoverability Certificate.

From $449per application per month

Explore Escrow Pro

Managed Recovery

Resilience

We run the recovery.

The deposit comes to Codekeeper. If the application fails, we bring it back for you.

From $399per application per month

Explore Resilience

Managed Recovery

Resilience Pro

Proven before we need it.

Resilience plus Agentic Verification, so recovery starts from a deposit we know builds.

From $649per application per month

Explore Resilience Pro

Stays online

Continuity

Full continuity.

Everything in Resilience, plus we keep the live environment paid and switched on for an agreed period while we recover.

From $1,449per application per month

Explore Continuity

Stays online

Continuity Pro

Full continuity, proven in advance.

Everything in Resilience Pro, plus we keep the live environment paid and switched on for an agreed period while we recover.

From $1,699per application per month

Explore Continuity Pro

Escrow means the deposit is released to you and you run the recovery. Resilience costs more because we do the recovery. Continuity costs more again because we also keep the live environment switched on. At every protection, Pro adds Agentic Verification. Add an Exit Exercise, from $12,000, when your exercise programme needs people to test the business functions. For systems you run yourself, Software Backup attaches the same way. See all prices

The secondary conversion, on every page. Visitors who aren't ready to talk can still leave their email. The sample evidence pack is the same offer on every page, so the site has one lead magnet instead of a different e-book per page. It also carries the launch story: proof, not promises. The button goes to the sample evidence pack page.

Sample evidence pack

See what your auditor would receive.

An anonymised set of outputs from a real Agentic Verification run, so you can judge the evidence before you talk to us.

Recoverability Certificate
Run report
SBOM and Exit workbook excerpts

Get the sample evidence pack

The questions continuity managers and auditors ask. Production's answers that overclaimed are rewritten: "Is ISO 22301 mandatory? … often mandated by regulators" (no source), "evidence that continuity controls are tested, documented, and ISO 22301-aligned" and "integrate seamlessly … without requiring process changes". The ISO 27001 answer uses the control titles already checked for the ISO 27001 page (5.29, 5.30). The Codekeeper answer claims only ISO/IEC 27001:2022, the one confirmed certification; it doesn't claim ISO 22301.

Questions

Before your next continuity audit.

Does ISO 22301 require software escrow?

It doesn't name any product. It asks you to identify and select strategies and solutions for your priority activities, and to exercise them. Escrow, Resilience and Continuity are solutions you can choose for the applications those activities depend on. Whether they're enough is for you and your auditor to decide.

Which clauses does the evidence relate to?

Mainly clause 8, Operation: 8.2 for impact analysis and risk assessment, 8.3 for strategies and solutions, 8.4 for plans and recovery, 8.5 for exercises and 8.6 for evaluation. See the evidence map.

Why don't you quote the clauses?

ISO standards are copyright documents, so we name clauses by number and title only. Your copy of the standard has the full text.

Does a rebuild count as an exercise?

A rebuild is a dated test of one solution: the application rebuilt from its deposit, without the supplier. How it fits your exercise programme is for you and your auditor to decide. An Exit Exercise goes further and tests the business functions you nominate.

We also hold ISO/IEC 27001. Does the same evidence help?

Yes. ISO/IEC 27001 has its own controls for information security during disruption (5.29) and ICT readiness for business continuity (5.30). The same documents support both. See our ISO 27001 page.

Is ISO 22301 changing?

ISO lists ISO 22301:2019 as due to be revised, with a new edition in development. Amendment 1:2024 added climate action changes. Check iso.org for the current status.

Does this cover systems we build ourselves?

Yes. Software Backup keeps daily backups of in-house systems you can restore, and Resilience can put their recovery with us. Escrow and Continuity cover applications from a supplier. All of them sit in one account.

Is Codekeeper itself certified?

Codekeeper is certified to ISO/IEC 27001:2022, audited by BSI. See the Trust Center.

Want the background first? Our ISO 22301 guide is in Resources.

The same close on every page. The ISO 22301 close repeats the page's promise: the software behind the continuity plan is covered and exercised, with the evidence on file. Every page ends on the same two actions in the same order: Book a demo, then the sample evidence pack.

Continuity plans that include your software.

We'll take the applications in your continuity scope and show you the evidence each protection adds to your plans and exercises.

Book a demo Get the sample evidence pack