ISO 22301: Business Continuity Management System

Overview

ISO 22301 is the international standard for business continuity management. The ISO 22301 standard for business continuity management specifies requirements for a Business Continuity Management System (BCMS) that helps organisations of all sizes plan for, respond to, and recover from disruptions. Certification proves your organisation can keep critical activities running, and recover within defined time objectives, when disruption hits. Regulators, insurers, and enterprise customers increasingly treat it as a baseline expectation.

We deliver the business impact analysis to identify which activities are critical and what downtime they can tolerate. From that foundation we define recovery time and recovery point objectives, design continuity and recovery strategies, and document the plans and procedures your teams will actually use under pressure. We then run exercises to validate those plans and monitor effectiveness before the certification audit. Implementation of a working BCMS, not a set of theoretical policies, is what certification bodies look for.

The Stage 1 and Stage 2 audits are conducted by our partner certification body, accredited by an IAF MLA signatory. We prepare you for both and support you through corrective actions so the ISO 22301 business continuity management certification process is an outcome of a working system, not a paper exercise. The certification body will look for evidence of a genuine commitment to business continuity from top management through to operational teams.

What’s included

• BCMS scope, context, and continuity policy
• Business impact analysis (BIA) and risk assessment
• Recovery time objectives (RTO) and recovery point objectives (RPO)
• Business continuity and recovery strategies and plans and procedures
• Exercise and testing programme
• Internal audit and management review
• Certification through our partner certification body, accredited by an IAF MLA signatory

How we work

1. 01
   Business impact analysis

   We identify critical activities, map their dependencies, and establish acceptable downtime. RTOs and RPOs are set from evidence, not assumption, so the plans that follow are grounded in what the organisation can actually survive. Stakeholder input at this stage is essential: the people running critical processes know the dependencies that a top-down analysis misses.

2. 02
   Strategy and plans

   We design continuity and recovery strategies and produce the documented plans and procedures your teams need. Plans are written to be usable under stress, not read in a quiet office. The goal is to reduce the likelihood of a disruptive incident becoming a crisis, and to minimize the impact when one does occur.

3. 03
   Exercise and validate

   We design and facilitate tabletop and scenario exercises to test the plans, identify gaps, and capture improvement actions. Exercise reports form part of the evidence base for the certification audit. The ISO 22301 standard requires you to monitor and review the effectiveness of your BCMS, and exercises are the primary mechanism for doing that.

4. 04
   Certification audit

   Our partner certification body, accredited by an IAF MLA signatory, conducts the Stage 1 and Stage 2 audits. We support you throughout and manage any corrective action requests to closure. The lead auditor conducting the certification process will confirm the BCMS meets the 22301 business continuity management system requirements.

What you get

• Business impact analysis and risk assessment
• Continuity policy, recovery strategies, and documented plans and procedures
• Exercise reports and improvement action log
• Internal audit and management review records
• Accredited ISO 22301 certificate (issued by the partner)

Frequently asked questions