ISO 22301 certification: business continuity guide

Overview

How a business continuity management system prepares an organization for disruption and what certification requires.

What it is

ISO 22301:2019 specifies certifiable requirements for a business continuity management system. It covers organizational context, business impact analysis, risk assessment, continuity strategies, plans, exercises, communications, recovery capability, evaluation, and improvement.

Why it matters

Certification can provide assurance that continuity is governed and tested, support critical supplier reviews, and improve recovery from cyber incidents, outages, disasters, or supply failures. A certificate does not guarantee uninterrupted operation or replace sector-specific resilience law.

How to obtain it or demonstrate compliance

1. Define the legal entity, sites, products, services, and processes inside the certification scope.
2. Buy or lawfully access the current standard and perform a documented gap assessment.
3. Implement objectives, responsibilities, controls, records, competence, and corrective-action processes.
4. Complete internal audits and a management review, then close identified gaps.
5. Select a competent certification body—preferably accredited for the standard and sector—and verify its status.
6. Complete the stage 1 and stage 2 audits, correct nonconformities, and maintain certification through surveillance and recertification.

What to review

1. Confirm the current edition, certification scope, sites, legal entities, exclusions, and certificate validity.
2. Map applicable laws, regulator duties, contracts, customer requirements, and sector-specific controls separately from the voluntary standard.
3. Test whether policies operate in practice and whether records support each material claim before the external audit.
4. Describe the standard, edition, scope, certification body, accreditation, and limitations accurately in procurement and marketing.

What to do next

Treat certification as an operating system, not a document project. Assign accountable owners, measure performance, investigate failures, correct root causes, and keep evidence current between audits.

Official sources and further reading

• ISO 22301:2019 — Business continuity management systems — International Organization for Standardization
• Certification — ISO does not perform certification — International Organization for Standardization