What is ISO 22301?
ISO 22301 specifies requirements for a business continuity management system (BCMS), enabling organisations to prepare for, respond to and recover from disruptive incidents.
Benefits of Certification
- ✔Protect operations from disruption
- ✔Reduce downtime and financial impact
- ✔Meet regulatory and client resilience requirements
- ✔Protect reputation and stakeholder confidence
- ✔Improve organisational resilience
Scope
For organisations of any size that need to plan, establish and improve their ability to continue operating during disruptions.
Who it applies to
- ●IT & software / SaaS
- ●BPO & shared services
- ●Financial & professional services
- ●Telecommunications
- ●Healthcare & data processors
- ●E-commerce & cloud providers
What the scope covers
- ▸Information security risk assessment and treatment
- ▸Access control and cryptography
- ▸Asset, supplier and cloud security
- ▸Incident management and business continuity
- ▸Physical and operational security
- ▸Statement of Applicability (Annex A controls)
Key Requirements
- ▸Business impact analysis (BIA)
- ▸Risk assessment and treatment
- ▸Business continuity strategies and plans
- ▸Incident response structure
- ▸Exercising and testing programmes
- ▸Performance evaluation and improvement
Certification Process
- 1
Application & Quotation
Submit your details and receive a tailored, fixed-price quotation based on scope, sites and headcount.
- 2
Gap Analysis (Optional)
An optional pre-audit review identifies gaps between your current practices and the standard.
- 3
Stage 1 Audit
Documentation review to confirm your management system is designed and ready for assessment.
- 4
Stage 2 Audit
On-site (or remote) assessment of the implementation and effectiveness of your system.
- 5
Certification Decision
An independent technical review leads to the certification decision and issue of your certificate.
- 6
Surveillance & Renewal
Annual surveillance audits maintain your certification over the three-year cycle before recertification.
Documents Required
- 📄Company registration / incorporation details
- 📄Organisation chart and list of sites
- 📄Scope statement of activities
- 📄Management system manual / documented information
- 📄Key policies and procedures relevant to the standard
- 📄Records demonstrating implementation (audits, reviews, training)
Frequently Asked Questions
How long does ISO 22301 certification take?
Typical timelines range from 4 to 12 weeks depending on the size of your organisation, the number of sites and how mature your existing management system is.
How long is a ISO 22301 certificate valid?
Certificates are issued for a three-year cycle, subject to successful annual surveillance audits, after which recertification renews the cycle.
Can the audit be conducted remotely?
Yes. Where appropriate, UKCTL can conduct Stage 1 and parts of Stage 2 remotely, combined with on-site verification as required.
Is ISO 22301 certification accredited?
UKCTL issues accredited certificates recognised internationally, giving your customers and stakeholders confidence in the assessment.
Get ISO 22301 certified with UKCTL
Apply Now