Facebook Linkedin Instagram Youtube Pinterest
Menu
ISO 22301 CERTIFICATION SUPPORT

ISO 22301 business continuity certification

Power cuts, floods, ransomware, a key supplier going bust. Every business gets hit by something eventually. The ones that cope are the ones that decided in advance what to do.

ISO 22301 is the standard for that. We help you build a continuity system that’s practical, tested and ready for certification.

Get a Free Quote

More than an IT recovery plan

People often assume business continuity means backups and a disaster recovery site. That’s one piece. ISO 22301 also looks at premises, staff, suppliers and communication, and it asks you to prove your plans work by actually exercising them.

What the system includes

  • Business impact analysis. Which activities matter most, and how long each can stop
  • Risk assessment of the threats most likely to interrupt them
  • Strategies and solutions for people, premises, technology, data and suppliers
  • Continuity plans that tell response teams exactly what to do
  • Exercises and tests, with written results
  • Review and improvement after every test or real incident

Who needs it

  • Banks, insurers, payment and fintech companies
  • Telecoms, data centres and IT providers
  • Hospitals, labs and pharmaceutical companies
  • Manufacturers with tight delivery promises
  • Logistics, utilities and public service providers

What you get out of it

  • Shorter downtime and quicker recovery
  • Evidence for regulators who expect formal continuity arrangements
  • A stronger case in tenders and supplier audits
  • Clear roles, so people aren't improvising in a crisis

How we take you to certification

  1. Define the scope. Which sites, services and products the system will cover.
  2. Impact analysis workshops. A session with each department to find what can’t stop.
  3. Risk assessment. The disruption scenarios that are realistic for you.
  4. Strategies and plans. Including links to your IT recovery arrangements.
  5. Exercises. Tabletop walkthroughs first, live tests after.
  6. Training. Crisis and recovery teams get the detail they need.
  7. Internal audit, management review, certification audit. With an accredited certification body at the end.

Current edition

The certifiable edition is ISO 22301:2019, with the 2024 climate action amendment. A revision is under way and still at an early draft stage. When the new edition appears, certified companies will get a transition period, so there’s no reason to hold off.

Questions we hear often

The standard requires a planned exercise programme. Most organizations test key plans at least once a year.

Yes, and it often is. Both share a structure, and ISO 27001 already asks for information security continuity.

No. A small firm with one site and a handful of critical services can certify with a smaller, simpler system.

Usually four to six months. Most of the time goes on the impact analysis and the first round of exercises.

How long could your business survive a shutdown?

Book an impact analysis workshop and find out where you’re exposed.

Talk to Our Team