ISO 22301:2019
ISO 22301 certification for business continuity management
Independent certification that your organisation can keep prioritised activities running, or restore them in time, after a disruption.
- Valid for
- 3 years
- Surveillance
- Years 1 and 2
- Verification
- Public register
Accredited and empanelled
What is ISO 22301?
ISO 22301 sets requirements for a business continuity management system (BCMS): how an organisation prepares for, responds to and recovers from disruptive incidents. At its centre are the business impact analysis, which sets priorities and recovery timeframes, and the assessment of risks of disruption to prioritised activities.
ISO 22301:2019 is the current edition, amended in 2024 for climate change. Compared with the 2012 edition it is shorter and less prescriptive, brings business continuity strategies and solutions into one clause and puts more emphasis on exercising and evaluating capabilities.
Banks, payment providers, cloud services and critical suppliers face growing regulator and customer expectations on operational resilience. Certification gives external, audited evidence that continuity arrangements exist and have been exercised, which a policy document alone cannot provide.
Who it is for
- Banks, payment companies and insurers
- Cloud, hosting and data centre providers
- Outsourcing providers with contractual recovery commitments
- Utilities, telecoms and transport operators
- Public bodies delivering essential services
What sets audit time and cost
Application to certification decision usually takes ten to sixteen weeks, as auditors expect evidence of exercising and its review before Stage 2 can be concluded.
- Number of people within the BCMS scope
- Number of sites and alternate recovery locations
- Number of prioritised activities and products
- Dependence on critical suppliers and outsourced services
- Combined audits with ISO 27001 or ISO/IEC 20000-1
Why it matters
What ISO 22301 gives you
- 01
Recovery priorities agreed
The business impact analysis gives leadership an agreed order of recovery and timeframes, instead of deciding during a crisis.
- 02
Plans that have been tested
An exercise programme shows whether plans work, and findings feed back into improvements.
- 03
Evidence for regulators and clients
Operational resilience reviews and outsourcing due diligence can rely on a certified, audited system.
- 04
Supplier dependencies understood
Critical suppliers and their own continuity arrangements are identified before they fail.
The audit
What our auditors examine
- 01
Business impact analysis
How prioritised activities, their recovery timeframes and the resources they depend on were identified.
- 02
Risk assessment
Risks of disruption to prioritised activities, and the treatment selected for each.
- 03
Strategies and solutions
The options chosen to protect, stabilise, continue and recover activities, and the resources committed to them.
- 04
Plans and response structure
Incident response structure, warning and communication, and business continuity and recovery plans.
- 05
Exercise programme
Exercises at planned intervals and after significant change, with post-exercise reports and actions.
- 06
Evaluation of capabilities
Periodic evaluation of continuity documentation and capabilities, including those of key suppliers.
How certification works
Every accredited certificate follows the same three-year cycle, with each step recorded and the result published in our register.
01
Application and quote
Tell us your scope, sites and headcount. We calculate audit time under the accreditation rules and send a fixed quote and audit plan.
02
Stage 1 audit
We review your documented management system, scope and readiness, and agree the Stage 2 plan. Any gaps are reported so you can close them first.
03
Stage 2 audit
Auditors check that the system works in practice: interviews, records and observation across the scope. Nonconformities are raised in writing.
04
Certification decision
Once corrective actions are accepted, a reviewer who did not take part in the audit makes the decision. Your certificate is issued and listed in the public register.
05
Surveillance audits
Shorter audits in the first and second years after certification confirm the system is maintained and improving. The register shows your current status throughout.
06
Recertification
Before the three-year certificate expires, a recertification audit reviews the whole system and renews the certificate for another cycle.
Related standards and audits
Often certified or audited alongside this one, sometimes in a single combined audit.
ISO certification
ISO 27001
Independent certification of your information security management system against ISO/IEC 27001:2022.
ISO certification
ISO 20000-1
Independent certification that your services are planned, delivered and improved under a managed service management system.
ISO certification
ISO 28000
Independent certification of how your organisation assesses and controls security risks to its operations and supply chain.
Security audits
IT security audit
An information security audit to CERT-In guidelines covering the systems you name, closed with a dated audit certificate.
Industries we audit for
Banking and fintech
Audits and certifications that support the security evidence regulators, partner banks and payment networks ask for.
SaaS and cloud
Independent evidence that answers enterprise security reviews and keeps sales moving.
Government and public sector
CERT-In empanelled audits and accredited certification for departments, public sector undertakings and their suppliers.
ISO 22301 questions
We audit; we do not consult.
To keep certification independent, we never design, build or fix the systems we audit, and decisions are made by people who did not take part in the audit. Read our impartiality policy.
Plan your ISO 22301 certification
Tell us your scope, sites and timeline. We reply with an audit plan and a fixed quote.