ISO 22301:2019 · Business continuity management
ISO 22301:2019 certification
ISO 22301 requires a business impact analysis, defined recovery objectives and tested continuity arrangements. The audit tests whether the plan works, not whether it exists.
Who ISO 22301 suits
- Critical infrastructure, data centre and managed service providers.
- Financial, insurance and healthcare service operators.
- Organizations whose clients or insurers require evidenced resilience.
What the standard requires
Business impact analysis
Critical activities, dependencies and maximum tolerable periods of disruption.
Risk assessment
Threats to prioritized activities and the controls that treat them.
Strategy and solutions
Recovery options chosen to meet the defined recovery time and point objectives.
Plans and procedures
Incident response, continuity and recovery plans with defined roles.
Exercising and testing
A documented exercise programme with findings and improvement actions.
Communication
Internal and external communication arrangements during disruption.
At a glance
Standard
ISO 22301:2019
Category
Business continuity management
Indicative fee
From $7,500 for coordination support. Certification body audit fees are quoted separately.
Certification cycle
Three years, with surveillance audits at approximately 12 and 24 months.
Issued by
An authorized certification body. Northbridge coordinates the programme and maintains the register.
Need this standard?
Send the contract clause or questionnaire item that triggered the requirement. We will confirm fit before you commit.
What we prepare with you
BIA and RTO/RPO
A business impact analysis that produces defensible recovery objectives for each critical activity.
Continuity plans
Plans sized to the operation, with call trees, alternate arrangements and supplier dependencies.
Exercise programme
At least one live exercise with a written report, findings and tracked corrective actions.
Audit sequence
Stage 1 readiness review
The certification body reviews documentation and readiness, and agrees the Stage 2 plan.
Stage 2 audit
On-site or hybrid assessment of implementation and evidence against the standard.
Findings and correction
Nonconformities are closed with root-cause analysis and evidence of correction.
Decision and registration
On a positive decision the certificate is issued and published in our public register.
ISO 22301 questions
How is ISO 22301 different from a disaster recovery plan?
Disaster recovery focuses on technology. ISO 22301 covers the whole organization, including people, premises, suppliers and communications, and requires tested continuity arrangements.
How many exercises are required?
The standard requires an exercise programme, not a fixed number. Most organizations run at least one exercise before Stage 2 and schedule further exercises annually.
Can it be integrated with ISO 27001?
Yes. The risk assessment and incident response elements overlap, and many organizations run an integrated management system.
Does certification guarantee we will recover?
No. It demonstrates that you have identified critical activities, set objectives and tested arrangements. Actual recovery depends on execution.
Scope ISO 22301 for your organization
Tell us your sites, headcount and target date. You will receive a written scope, audit-day estimate and fee within one business day.
Related standards: ISO/IEC 27001:2022 · ISO 9001:2015