ISO 22301 Certification: Business Continuity

ISO 22301 is the international standard for business continuity management. It sets out what an organisation must do to prepare for, respond to and recover from disruption: understand which activities matter most and how fast they must resume, choose strategies to keep them running, write and exercise plans, and improve the whole system over time. The current edition is ISO 22301:2019, amended in 2024 to add climate change considerations. Certification is voluntary and is awarded after an audit by an independent certification body.

Sovereign Secure provides ISO 22301 consultancy from gap analysis to certification audit. We do not issue certificates: the audit is carried out by an independent certification body. ISO 22301 sits within our wider ISO certification service and fits naturally beside ISO 27001.

What is ISO 22301?

ISO 22301 specifies the requirements for a business continuity management system (BCMS): the policies, roles, processes and records that keep an organisation’s continuity arrangements current and tested. It is published by ISO technical committee 292 (security and resilience). ISO 22301 is the requirements standard you are certified against; the related standards in the family give guidance. The ISO 22301:2019 listing shows the current edition. ISO has a revision under development (ISO/CD 22301), but certification today is against the 2019 edition with its 2024 amendment, and any new edition would come with a transition period.

What are the ISO 22301 requirements?

ISO 22301 follows the same clause 4 to 10 structure as ISO 9001 and ISO 27001. Clauses 4 to 7 and 9 to 10 are the familiar management system requirements; clause 8 holds the continuity-specific work.

What does clause 8 require?

Clause 8 is the core of ISO 22301 and where most certification findings arise.

• Business impact analysis (8.2.2). Define impact types and criteria, identify the activities that deliver your products and services, assess how the impact of disrupting them grows over time and when it would become unacceptable, then set prioritised timeframes for resuming each one at a specified minimum acceptable capacity. The standard notes that these timeframes can be called the maximum tolerable period of disruption (MTPD) and the recovery time objective (RTO). Map the resources and dependencies, including partners and suppliers.
• Risk assessment (8.2.3). Identify, analyse and evaluate the risks of disruption to those prioritised activities and decide which need treatment.
• Strategies and solutions (8.3). Choose how each prioritised activity will continue or recover, for example alternative sites, staff cross-training, IT recovery or supplier alternatives, and put the resources in place.
• Plans and procedures (8.4). A response structure with named teams, warning and communication procedures, business continuity plans and recovery procedures.
• Exercise programme (8.5). Exercise and test the plans and procedures at planned intervals and after significant changes, record the results and act on what you learn. A cyber tabletop exercise is a practical first exercise for a ransomware or data breach scenario.
• Evaluation (8.6). Check that the continuity documentation and capabilities stay suitable, adequate and effective.

Is ISO 22301 the same as a business continuity plan?

No. A business continuity plan is one document that ISO 22301 requires. The standard is the management system that decides what the plan must protect, proves it works through exercises and keeps it current as the business changes.

If you only need a plan, our business continuity plan template is a good starting point. For a cyber attack specifically, pair it with an incident response plan: incident response contains and investigates the attack, while continuity plans keep critical services running and recover them.

How do I get ISO 22301 certification?

You get ISO 22301 certification by implementing a BCMS, running it long enough to produce records, then passing a two-stage audit by an independent certification body. ISO 22301 implementation follows ten steps:

1. Agree scope and run a gap analysis. Decide which products, services, sites and teams the certificate must cover, then compare current continuity arrangements with every clause of the standard.
2. Business impact analysis (clause 8.2.2). Set prioritised timeframes for resuming each activity and map the people, premises, technology, information and suppliers it depends on.
3. Risk assessment (8.2.3). Identify, analyse and evaluate the risks of disruption to those prioritised activities and decide which need treatment.
4. Strategies and solutions (8.3). Decide and resource how each prioritised activity continues or recovers.
5. Plans and procedures (8.4). Write response, communication and recovery plans that the people named in them have read.
6. Exercises (8.5). Run at least one exercise before Stage 2 so there are results to show and actions taken on them.
7. Internal audit (9.2). Audit the whole BCMS against the standard and your own procedures, and correct what it finds.
8. Management review (9.3). Top management reviews the BCMS with the inputs the standard lists and records its decisions.
9. Stage 1 audit. The certification body reviews your documentation and readiness for Stage 2.
10. Stage 2 audit. The certification body samples records and interviews staff to confirm the BCMS works, then makes its own certification decision.

The certificate lasts three years, with surveillance audits in years two and three and a recertification audit before expiry.

ISO 22301 gap analysis and checklist

An ISO 22301 gap analysis compares your current continuity arrangements with every clause of the standard, then ranks what is missing so you can plan the work to certification. Most organisations already have some of the pieces, such as an IT disaster recovery plan or an incident procedure, but not the business impact analysis, exercising and review that join them into a management system.

Use this checklist as a first pass before a gap analysis, or download the free ISO 22301 self-assessment checklist (.xlsx), which covers clauses 4 to 10 line by line with a 0 to 3 score, evidence and owner columns and a summary of your score by clause. Tick each line only when the evidence exists:

If most lines are not yet in place, start with the scope and the business impact analysis, because every later step depends on them. Our business continuity plan template helps with the plans themselves.

How does ISO 22301 relate to ISO 27001?

ISO 27001 covers continuity of information security; ISO 22301 covers continuity of the business. ISO 27001:2022 includes two Annex A controls that overlap directly: A.5.29 Information security during disruption and A.5.30 ICT readiness for business continuity. A.5.30 expects ICT readiness to be planned, implemented, maintained and tested against business continuity objectives, which in practice means a business impact analysis and recovery objectives of the kind ISO 22301 requires.

Because both standards share the clause 4 to 10 structure, they can run as one integrated management system with a shared risk process, internal audit programme and management review. If you already hold ISO 27001, much of the management system work is in place and the new effort is mostly clause 8. Our ISO 27001 consultancy covers the information security side.

Does ISO 22301 help with DORA and UK operational resilience?

ISO 22301 is not required by either regime and does not prove compliance on its own, but it gives you structured, audited evidence for the continuity parts of both.

Our guides to DORA regulation and UK operational resilience explain those regimes in full, including where scenario testing and penetration testing evidence fit.

What does ISO 22301 certification cost?

ISO 22301 certification cost has three parts: certification body audit fees across the three-year cycle, any consultancy, and your team’s time. There is no fixed price, because the drivers below set both the auditor days and the consultancy effort.

We give a fixed quote for the consultancy once the scope is clear, so you can set it beside the certification body’s audit fees for the three-year cycle before you commit.

Why Sovereign Secure

• We hold ISO 27001 ourselves, so we understand the audit process from the certified side.
• Continuity and security together. ISO 22301 and ISO 27001 consultancy from one team, plus penetration testing and red team assessments that test the systems your plans depend on.
• Independent certification. We never certify a system we helped build. Certification audits are carried out by an independent certification body that makes its own decisions; our partner certification body is MQA International, which is accredited for ISO 22301 by IAS, the International Accreditation Service.
• A UK company since 2012, headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka.

Get an ISO 22301 quote

Tell us how many people and sites are in scope, which products and services must continue, what continuity plans you already have and which certificates you hold. We will scope the work and send a fixed quote for the consultancy. Request your ISO 22301 quote or call +44 161 523 5276.