ISO 22301:2019 · Business continuity management
ISO 22301:2019 Certification
ISO 22301 requires a business impact analysis, defined recovery objectives and tested continuity arrangements. The audit tests whether the plan works, not whether it exists.
Who ISO 22301 Suits
Common commercial triggers and operational scenarios where ISO 22301:2019 delivers direct procurement and compliance value.
- Critical infrastructure, data centre and managed service providers.
- Financial, insurance and healthcare service operators.
- Organizations whose clients or insurers require evidenced resilience.
Core Management System Clauses
The international standard structures compliance across high-level operational clauses audited during Stage 1 and Stage 2 assessments.
Business impact analysis
Critical activities, dependencies and maximum tolerable periods of disruption.
Risk assessment
Threats to prioritized activities and the controls that treat them.
Strategy and solutions
Recovery options chosen to meet the defined recovery time and point objectives.
Plans and procedures
Incident response, continuity and recovery plans with defined roles.
Exercising and testing
A documented exercise programme with findings and improvement actions.
Communication
Internal and external communication arrangements during disruption.
What We Prepare with You
Our dedicated coordination service prepares every document and audit trail before the independent certification body begins assessment.
BIA and RTO/RPO
A business impact analysis that produces defensible recovery objectives for each critical activity.
Continuity plans
Plans sized to the operation, with call trees, alternate arrangements and supplier dependencies.
Exercise programme
At least one live exercise with a written report, findings and tracked corrective actions.
Audit & Certification Roadmap
A transparent four-phase path from gap assessment to published register listing.
Stage 1
Documentation & readiness review.
Stage 2
Implementation & evidence audit.
Decision
Corrective closure & issuance.
Register
Public listing & QR code verification.
Frequently Asked Questions
Key considerations on timelines, documentation, and audits for ISO 22301.
How is ISO 22301 different from a disaster recovery plan?
Disaster recovery focuses on technology. ISO 22301 covers the whole organization, including people, premises, suppliers and communications, and requires tested continuity arrangements.
How many exercises are required?
The standard requires an exercise programme, not a fixed number. Most organizations run at least one exercise before Stage 2 and schedule further exercises annually.
Can it be integrated with ISO 27001?
Yes. The risk assessment and incident response elements overlap, and many organizations run an integrated management system.
Does certification guarantee we will recover?
No. It demonstrates that you have identified critical activities, set objectives and tested arrangements. Actual recovery depends on execution.
GET CERTIFIED
Scope ISO 22301:2019 for Your Organization
Receive a customized written proposal covering audit days, scoping parameters, and transparent fees.