ISO 22301 certification is the attestation, issued by an independent certification body, that an organisation's business continuity management system (BCMS) meets the requirements of ISO 22301:2019 within a defined scope. It is granted after a two-stage audit, is valid for three years and is maintained through annual surveillance audits.
Building the BCMS itself is covered in ISO 22301 in 10 steps. This guide focuses on the certification journey: what the auditor checks, the evidence you need, a realistic timeline, what drives the cost, and the findings that trip up organisations that looked ready on paper.
The 30-second version
- What gets certified is an organisation's management system within a scope, never a product or a piece of software. ISO itself issues no certificates.
- Certification is voluntary. It carries weight in tenders and supports your NIS2 or DORA evidence, but it is not regulatory compliance.
- The cycle: stage 1 (readiness), stage 2 (implementation), a 3-year certificate, annual surveillance, then recertification.
- The auditor wants a system that is already running: an approved BIA, a documented exercise, an internal audit, a management review, tracked corrective actions.
- Cost is driven mainly by audit days (headcount, sites, complexity) and internal time.
What exactly does ISO 22301 certify?
An ISO 22301 certificate attests that a BCMS (the policies, processes, roles and evidence that govern continuity) conforms to the standard within a given scope: specific services, entities and sites. It does not certify a single plan, a software product or a person.
Three parties are involved:
- ISO writes the standard but, as it states itself, is not involved in certification and does not issue certificates.
- The certification body performs the audits and takes the certification decision, under ISO/IEC 17021-1, the standard governing bodies that certify management systems.
- The accreditation body checks certification bodies' competence and impartiality. In the EU, each member state appoints a single national accreditation body (Regulation (EC) No 765/2008), such as Cofrac in France or DAkkS in Germany. In the UK, UKAS runs a dedicated accreditation scheme for ISO 22301 certification, backed by ISO/IEC TS 17021-6 (competence requirements for BCMS auditors).
Why scope matters. It is printed on the certificate, and an informed customer reads it first. A scope limited to head office says nothing about the service that customer buys from you; an overly broad scope multiplies audit days and the risk of findings. Start with the services your customers and regulators consider critical, justify every exclusion (clause 4.3), then extend the scope over later cycles.
Is ISO 22301 certification mandatory?
No. No EU or national law requires ISO 22301 certification. Organisations pursue it for four reasons:
- Tenders and supplier questionnaires, where a certificate replaces dozens of continuity questions.
- Regulated customers, who must demonstrate the resilience of their critical providers.
- Discipline: an external review every year keeps the programme from going stale.
- Regulatory evidence. Article 21(2)(c) of the NIS2 Directive lists "business continuity, such as backup management and disaster recovery, and crisis management", and Article 25 asks member states to encourage the use of European and international standards. DORA (Article 11) requires an ICT business continuity policy and plans tested at least once a year.
Certification is not compliance. A certificate attests that a BCMS meets the standard, within a scope, at a point in time. Neither NIS2 nor DORA treats it as a presumption of conformity, and it demonstrates neither your incident notification timelines nor your ICT third-party risk management. It is a strong evidence base, nothing more. See NIS2: essential vs important entities and our DORA guide 2026.
What do you need in place before the certification audit?
The classic mistake is booking the audit as soon as the documents are written. Auditors do not certify intentions; they check that a system operates and produces evidence. Before stage 1, you should be able to show:
- an approved scope, policy and objectives;
- an approved, dated BIA and risk assessment (see our BIA guide in 7 steps);
- strategies selected and justified, and plans issued;
- at least one exercise carried out, with a report and actions;
- an internal audit covering the whole BCMS and the whole scope;
- a management review held, with decisions recorded;
- corrective actions being tracked, some already closed.
This is not arbitrary: ISO/IEC 17021-1 lists among the objectives of stage 1 checking that internal audits and management reviews are planned and performed. ISO 22301 sets no minimum operating period, but producing a first full cycle of evidence rarely takes less than three months.
Another surprise: the certification body is not allowed to advise you on implementing the system (an impartiality rule in ISO/IEC 17021-1). For an outside view, arrange a mock audit by your internal auditor or a consultant.
How does the certification cycle work?
1. Application and quote
Based on your scope, headcount, sites and outsourced activities, the certification body calculates the audit days and usually quotes for the full three-year cycle.
2. Stage 1: documentation and readiness review
The auditor reviews your documentation, scope, BIA, internal audit and management review, then concludes on your readiness for stage 2.
3. Stage 2: implementation audit
The auditor checks that the system is applied and effective: interviews, sampled plans, exercise reports, corrective actions, indicators. Findings are graded as major or minor nonconformities, or opportunities for improvement.
4. Decision and certificate
Each nonconformity requires a root-cause analysis and an action plan. Major nonconformities must be corrected, and the correction verified, before the decision; if verification cannot happen within six months of the last day of stage 2, stage 2 has to be repeated. For minor ones, an accepted action plan is enough. The decision is taken by someone who did not take part in the audit.
5. Surveillance and recertification
| Audit | When | What is examined |
|---|---|---|
| Stage 1 | A few weeks before stage 2 | Documentation, scope, readiness |
| Stage 2 | Once stage 1 concerns are addressed | Implementation and effectiveness of the whole system |
| Surveillance 1 | No later than 12 months after the certification decision | A sample of clauses, plus at every visit: internal audit, management review, follow-up of findings, changes |
| Surveillance 2 | The following year (at least one audit per calendar year) | Same, on a different sample |
| Recertification | Year 3, before expiry | The whole system, for a new 3-year cycle |
What documented evidence will the auditor ask for?
ISO 22301:2019 follows the common structure of management system standards (clauses 4 to 10). Some evidence is explicitly required as "documented information" (scope, policy, objectives, plans, internal audit, management review, corrective actions); the rest is simply the most direct way to demonstrate the requirement.
| Clause | Requirement | Evidence expected in practice |
|---|---|---|
| 4.1 / 4.2 | Context, interested parties, legal requirements | Context analysis (including climate), register of legal, regulatory and contractual requirements |
| 4.3 | BCMS scope | Services, sites, entities, justified exclusions |
| 5.2 | Policy | Approved, communicated policy |
| 6.2 | Business continuity objectives | Measurable objectives, plan to achieve them, monitoring |
| 7.2 | Competence | Training and competence records for key people |
| 8.2 | BIA and risk assessment | Approved BIA, risk assessment, reviews at planned intervals and after significant change |
| 8.3 | Strategies and solutions | Options considered, selection criteria (costs, benefits, risk), approved decision |
| 8.4 | Plans and procedures | Response structure with alternates, warning and communication procedure, plans available where needed |
| 8.5 | Exercise programme | Programme, scenarios, post-exercise reports, actions |
| 8.6 | Evaluation of documentation and capabilities | Evaluations after exercises or incidents, assessment of critical suppliers |
| 9.1 | Monitoring and measurement | Indicators and analysis |
| 9.2 | Internal audit | Programme, reports, competent and impartial auditors |
| 9.3 | Management review | Minutes with inputs and decisions |
| 10.1 | Nonconformity and corrective action | Register, root-cause analyses, effectiveness checks |
The 2024 climate amendment and the ongoing revision
Published in February 2024, Amendment 1 (ISO 22301:2019/Amd 1:2024) adds to clause 4.1 a requirement to determine whether climate change is a relevant issue, and a note in 4.2 that interested parties can have climate-related requirements. ISO and the IAF treated it as a clarification, with no transition and no new certificates, but auditors raise a finding if you cannot show the question was considered. For a BCMS it is rarely out of scope: floods and heatwaves hit premises, people and suppliers.
A revision of the standard is also under way at ISO. Until it is published, certification is against ISO 22301:2019 and its amendment; a transition period will be set afterwards.
How long does ISO 22301 certification take, and what does it cost?
Timeline: orders of magnitude
Your starting point matters more than the audit itself. As an indication:
| Starting point | Set-up | Operation before audit | Audits and decision | Indicative total |
|---|---|---|---|---|
| Single-site SME, BCP already exercised, 2 or 3 services in scope | 2 to 4 months | 2 to 3 months | 1 to 3 months | 5 to 9 months |
| SME or mid-size company starting from scratch | 4 to 8 months | About 3 months | 2 to 3 months | 9 to 14 months |
| Multi-site group, several entities | 6 to 12 months | 3 to 6 months | 3 to 4 months | 12 to 24 months |
What slows it down: business teams' availability for the BIA, the first exercise to organise, an internal audit run too late. What speeds it up: a tight scope, a BCP that has already been tested, an existing ISO 27001 or ISO 9001 system.
Cost: understand the components before comparing quotes
We do not publish price ranges: day rates vary between certification bodies and countries. Here is where the cost comes from.
| Component | What it covers | What makes it vary |
|---|---|---|
| Initial audit (stages 1 and 2) | Auditor days, report, decision, certificate | Headcount in scope, sites, complexity, outsourcing |
| Surveillance and recertification | Two surveillance audits, recertification in year 3 | Same factors, plus changes and previous results |
| Travel | Auditors' travel and accommodation | Site spread, share of remote auditing |
| Internal time | BCMS manager, business teams, internal auditors, management | Starting maturity, size of scope |
| Support and tooling (optional) | Consulting, mock audit, software | In-house skills, number of plans |
Audit days are not picked out of thin air: ISO/IEC 17021-1 requires a documented procedure that considers, among other things, complexity, regulatory context, outsourcing, the size and number of sites, and whether the audit is combined or integrated. The justification is recorded: ask for it.
For quality, environmental and health-and-safety systems, IAF MD 5 sets each surveillance audit at roughly one third of the initial audit and recertification at roughly two thirds; many certification bodies reason the same way for ISO 22301. A purely illustrative example: 6 initial audit days give about 2 days per surveillance and 4 for recertification, so 14 auditor days over the cycle, multiplied by the body's day rate.
In practice, the biggest cost is almost never the certification body: it is internal time, and above all the continuity measures themselves (recovery site, redundancy, dual sourcing), which belong to your strategies, not to certification.
The most common nonconformities
This is not a statistic, but what practitioners see from one audit to the next:
| Finding | What the auditor sees | Fix |
|---|---|---|
| Outdated BIA | A BIA that ignores a new application or supplier (8.2) | Annual review, plus a review at each significant change |
| Undocumented exercises | Exercise held with no report, findings or actions (8.5) | A formal report every time, linked to actions |
| Unmeasured objectives | "Improve resilience", with no indicator (6.2, 9.1) | Quantified objectives, tracked in management review |
| Incomplete management review | Required inputs missing, decisions not recorded (9.3) | An agenda mirroring clause 9.3 |
| Corrective actions left open | Open for months, no root-cause analysis (10.1) | An owner, a deadline, an effectiveness check |
| Inconsistent scope | A site in scope that appears in no BIA (4.3) | Reconcile scope, BIA and plans before stage 1 |
| Suppliers not assessed | No evaluation of their continuity capability (8.6) | Questionnaires, contract clauses, joint exercises |
What they have in common: they are traceability gaps more than substantive ones. The work has often been done, but nothing shows it in a dated, approved form.
How do you choose a certification body?
- Check accreditation for ISO 22301 specifically on the accreditation body's website (UKAS, DAkkS, Cofrac and so on), not in the sales brochure. A body may be accredited for ISO 22301 by another country's accreditation body; that is fine as long as the scope covers the standard.
- Ask about auditor competence in business continuity and in your sector, and about how the audit days were calculated.
- Plan for an integrated audit if you also target ISO 27001 or ISO 9001: the body must be accredited for each standard.
- Check impartiality: a body linked to the firm that advised you raises an issue that ISO/IEC 17021-1 regulates strictly.
Combining with ISO 27001: the integrated audit
ISO 22301 and ISO 27001 share the clause 4 to 10 structure: policy, document control, internal audit, management review and corrective action can be shared, and ISO/IEC 27001:2022 Annex A already contains two continuity controls (5.29 and 5.30). Because ISO/IEC 17021-1 counts integration among the audit-time factors, an integrated audit reduces the total days. But each standard is still audited against all its own requirements: a BIA and an exercise programme cannot be inferred from a Statement of Applicability. See ISO 22301 vs ISO 27001 and multi-framework mapping.
Checklist: are you ready for the audit?
- The scope is consistent with the BIA and plans, and exclusions are justified.
- Policy and objectives are approved, and objectives have tracked indicators.
- The context analysis explicitly addresses climate change.
- The BIA and risk assessment are approved and less than a year old.
- Plans name alternates and remain accessible outside company IT.
- At least one exercise has taken place, with a report and actions.
- Critical suppliers have been assessed.
- An internal audit has covered the whole BCMS, followed by a management review.
- Corrective actions have an owner and a deadline, and some are closed.
For a full self-assessment: ISO 22301 checklist and business continuity plan template.
What ResiPlan does, concretely
- ISO 22301 clauses 4 to 10 linked to the modules (context, BIA, strategies, plans, exercises, audits, corrective actions), with a certification readiness view, not a "compliance score".
- BIA: RTO and MTPD calculation, campaigns sent to process owners, approval workflow and version history.
- Strategies: justified option selection and approval, following the logic of clause 8.3.
- Exercise programme: findings turned into tracked corrective actions.
- Internal audit: programmes aligned with the ISO 19011 guidelines, findings converted into corrective actions.
- Downloadable evidence pack for the auditor, scoped to ISO 22301.
An honest caveat: software is never ISO 22301 certified. Organisations are, by an accredited body, and ResiPlan is not itself certified. It makes no one compliant: it structures, links and dates the evidence your teams produce. Free 7-day trial, no credit card.
FAQ
How much does ISO 22301 certification cost?
For the certification body: audit days (driven by headcount in scope, sites and complexity) multiplied by its day rate, plus travel. Compare quotes over the full three-year cycle. Internal time and the continuity measures themselves usually weigh far more.
How long does ISO 22301 certification take?
As an indication, 5 to 9 months for an SME that already has an exercised business continuity plan, 9 to 14 months when starting from scratch, and longer for a multi-site group. The limiting factor is the time the system needs to produce its first evidence.
Can a SaaS provider be "ISO 22301 certified"?
Software, no. The provider, yes, if the scope of its BCMS covers the service it delivers to you. Read the scope printed on the certificate and check the issuing body's accreditation.
What happens with a major nonconformity?
At initial certification, no certificate is issued until the correction has been verified, and if that cannot happen within six months of stage 2, stage 2 is repeated. During the cycle, an unresolved major nonconformity can lead to suspension.
Is ISO 22301 certification enough for NIS2 or DORA?
No. It provides solid evidence on continuity and crisis management, but neither NIS2 nor DORA treats it as a presumption of conformity. Incident notification or ICT third-party risk management still have to be demonstrated separately.
Further reading
- ISO 22301 in 10 steps: implementing a compliant BCMS
- Business Continuity Plan (BCP): 8-step guide for 2026
- ISO 22301 vs ISO 27001: differences and overlap
- ISO 22301 vs NIST CSF
- 10 crisis exercise scenarios
An ISO 22301 certificate does not reward a well-written binder: every year, it confirms that a continuity system is alive, exercised and correcting itself.