Does ISO 27001/ISO 22301 have to be implemented throughout the entire organisation?

Yes, implementing ISO 27001 and ISO 22301 generally means applying them throughout the entire organization. These standards focus on information security and business continuity, so they need to cover all areas where information systems are used to ensure comprehensive protection and resilience.

That said, the scope of implementation can be tailored to fit the needs of different organizations. For large organizations with operations spread across multiple locations or countries, limiting the implementation to specific parts of the organization might make sense. This allows for a more manageable rollout and ensures that the implementation addresses the particular needs and risks of each area.

On the other hand, smaller organizations operating in a few locations might find implementing the standards organization-wide more practical and beneficial. This ensures a consistent approach to information security and business continuity across all aspects of the business, which can be simpler to manage and enforce.

What should be implemented first: ISO 22301 or ISO 27001?

Deciding whether to implement ISO 22301 or ISO 27001 first depends on what your organization’s priorities are.

If your organization is dealing with a lot of non-IT threats—things that could potentially halt your operations—and IT is more of a support function rather than central to your business, you might want to start with ISO 22301.

This standard focuses on Business Continuity Management, which is all about ensuring your business can keep running smoothly even if things go wrong.

On the flip side, if your business is centered around digital products or IT processes are crucial to your operations, then ISO 27001 should be your first step.

ISO 27001 is all about Information Security Management, which means it’s designed to protect your digital assets and information systems.

If your business revolves around handling sensitive information or relies heavily on IT, implementing ISO 27001 will help secure your data and IT processes, which is essential for your core operations.