ISO 22301:2019

ISO 22301 Certification

Business Continuity Management System

Introduction

ISO 22301:2019 is the international standard for Business Continuity Management Systems (BCMS), helping organisations prepare for, respond to, and recover from disruptive incidents.

What is ISO 22301?

ISO 22301 specifies requirements to implement, maintain and improve a documented management system to protect against, reduce the likelihood of, and ensure operations recover from disruptions.

Benefits of ISO 22301 Certification

  • Minimises downtime and the financial impact of business disruptions
  • Strengthens organisational resilience against disasters, cyberattacks, and outages
  • Builds customer and regulator confidence in your continuity capability
  • Improves recovery time through tested response and recovery plans
  • Supports compliance with critical contractual and regulatory requirements

Who Needs ISO 22301 Certification?

  • Financial services and banking institutions
  • Healthcare providers and critical infrastructure
  • IT, SaaS, and data centre providers
  • Logistics and essential supply chain operators
  • Telecommunication companies

ISO 22301 Requirements

  • Context of the organisation and business requirements (Clause 4)
  • Leadership commitment and continuity policy (Clause 5)
  • Conducting Business Impact Analysis (BIA) (Clause 8.2.2)
  • Conducting Risk Assessments (Clause 8.2.3)
  • Developing Business Continuity Strategies and Solutions (Clause 8.3)
  • Establishing Business Continuity Plans (BCPs) (Clause 8.4)
  • Exercising and testing business continuity procedures (Clause 8.5)

ISO 22301 Certification Process

01

Initial Consultation

Discuss scope, objectives and current state.

02

Gap Analysis

Assess current practices against the standard’s requirements.

03

Documentation Development

Build the policies, procedures and records the standard calls for.

04

Implementation & Internal Audit

Roll out the system and test it with an internal audit.

05

Management Review

Leadership reviews performance and readiness for certification.

06

Certification Audit

An accredited certification body audits conformance.

07

Certification Awarded

The certification body issues the accredited certificate.

08

Surveillance Audits

Annual audits maintain certification status.

Documents Required

  • Business Continuity Policy
  • Business Impact Analysis (BIA) report
  • Risk assessment methodology and report
  • Business Continuity Plans (BCPs)
  • Disaster Recovery (DR) procedures
  • Exercise logs and test evaluation reports

ISO 22301 Certification Cost

We don’t publish a fixed price, because cost depends on organisation size, number of locations, scope, process complexity, audit duration, consulting requirements and certification body fees. Request a scoped estimate and we’ll walk you through each factor.

Certification Timeline

Timelines depend on organisational readiness, scope and the complexity of your processes. A well-prepared, single-site organisation typically moves faster than a multi-site or highly regulated one — we’ll give you a realistic timeline after the initial gap analysis.

ISO 22301 vs ISO 27001

ISO 27001 is focused on protecting data security and information assets. ISO 22301 is focused on protecting overall business operations, facilities, and personnel during any disruption (power outage, flood, cyber incident, pandemic).

Frequently Asked Questions

What is ISO 22301?

The international standard for Business Continuity Management Systems, ensuring organisations can continue operating during a crisis.

What is a Business Impact Analysis (BIA)?

A systematic process to determine the potential effects of a disruption on business operations and identify recovery priorities.

What are RTO and RPO?

RTO (Recovery Time Objective) is the target time to restore a system after disruption. RPO (Recovery Point Objective) is the maximum acceptable data loss measured in time.

Ready to start your ISO 22301 certification?

Book a free initial consultation with an OMCS ISO consultant.

Talk to an ISO 22301 Consultant