Specialty — Business continuity
ISO 22301 — Business Continuity
Business Continuity Management System (BCMS) — keep operating under any circumstance.
ISO 22301 is the international standard for business continuity management. It enables you to structure, implement and improve your capacity to anticipate, respond to and recover from major disruptions — cyberattacks, outages, natural disasters, pandemics, supplier failures, geopolitical crises.
Why pursue ISO 22301 certification?
- Demonstrable resilience — Formal proof of your ability to maintain critical activities under degraded conditions. Strong B2B argument, especially for critical infrastructure suppliers.
- Reduced losses — An incident without a continuity plan costs 3-5x more on average than with a structured and tested BCP.
- Contractual requirements — Increasingly required by major customers (banks, governments, integrators) of their critical suppliers.
- Sector regulatory compliance — Essential for finance (DORA in Europe, OSFI in Canada), healthcare, energy, telecoms.
- Complementary to 27001 — 22301 covers operational resilience, 27001 covers information security. Together they address the core of modern enterprise risk.
What the standard requires
- Understanding the organisation — context, stakeholders, critical activities, dependencies
- Business Impact Analysis (BIA) — for each process: what’s the maximum tolerable downtime (RTO)? what’s the acceptable data loss (RPO)?
- Continuity risk assessment — threats, vulnerabilities, treatment
- Continuity strategies — fallback solutions, backup sites, alternative suppliers, crisis teams
- Documented plans — Business Continuity Plan (BCP), Disaster Recovery Plan (DRP), crisis management procedures
- Regular exercises and tests — ISO 22301 requires plans to be tested, not just written
- Continuous improvement — lessons learned from tests and real incidents
Our 6-step approach
- Diagnosis and mapping of critical activities — Which activities are vital? Acceptable loss in hours, revenue, reputation?
- BIA and risk analysis — Defining RTO/RPO objectives, identifying major threats.
- Continuity strategy definition — Fallback sites, backups, redundancy, alternative suppliers, degraded modes.
- BCP, DRP and crisis management procedures — Operational documents, not theoretical.
- Exercise and testing programme — Tabletop exercises, simulations, technical tests. Crisis team training.
- Internal audit, management review and certification support with an accredited body (BSI, PECB, MSECB).
Who is it for?
- Banks, insurers, FinTechs (DORA, OSFI requirements)
- Critical infrastructure operators: energy, telecoms, water, transport
- Healthcare and essential services
- Critical suppliers in industrial and government supply chains
- SaaS and hosting where outages directly impact customers
- Any organisation where an interruption of a few hours would have major financial or operational impact
Timeline and cost
Typical duration: 8 to 14 months for initial certification, including a full cycle of documented exercises.
Pricing: fixed-price for the full engagement. Tailored quote within 48 hours based on scope and organisational maturity.