ISO 22301 business continuity certification, from $800

What ISO 22301 certification covers

ISO 22301 sets the requirements for a business continuity management system. Its purpose is simple to state: when something disrupts your organization, whether a fire, a cyber attack, a supplier failure, a pandemic or a power cut, you should be able to keep delivering your most important products and services, or restore them within a time your customers can accept.

The audit follows the logic of the standard. First the business impact analysis, which identifies your prioritized activities and how long each can be interrupted before the impact becomes unacceptable. Then the risk assessment of what could disrupt them. Then the continuity strategies and solutions, the plans and procedures, and the exercises that test whether those plans work.

The current edition is ISO 22301:2019. Like other management system standards, it was amended in 2024 to ask whether climate change is relevant to your organization, and for business continuity it often is, through weather events and supply chain effects.

• Stage 1 review of scope, business impact analysis, risk assessment and plans
• Stage 2 audit of strategies, plans, exercises and management system
• Certification decision and three-year certificate
• Certificate listed on verify.eurotechcertification.com
• Yearly surveillance audits and recertification

Recovery objectives are the numbers that make the system concrete. The maximum tolerable period of disruption sets the outer limit; the recovery time objective sets the target for resuming an activity; for information, the recovery point objective sets how much data loss is acceptable. The auditor checks that these numbers are agreed by management and drive the plans.

Scope choices and audit format

Some organizations certify their whole business; others start with the services customers rely on most, such as a payment platform, a contact centre, a data centre or a production site supplying a key customer. A narrower scope is quicker to certify, as long as it covers what your customers actually depend on.

Much of the ISO 22301 audit is documentary and interview based: impact analysis, risk assessment, plans, exercise reports and management review. That suits online auditing well. Where recovery depends on physical arrangements, such as an alternate site, generators, spare equipment or a second production line, the auditor may want to see them on site.

ISO 22301 sits well alongside ISO 27001, because incident response, backup and recovery and supplier management overlap. It also combines with ISO 9001 or ISO 14001 in an integrated system. An integrated audit avoids checking shared processes twice.

Dependencies deserve their own attention in the scope. A service may depend on an IT platform, a building, a few key people and two or three suppliers; if any one fails, the service fails. Mapping these dependencies is often the most valuable part of the work for our clients.

What decides the price

ISO 22301 certification with EUROTECH starts at $800. Audit time depends on the size and complexity of what is in scope.

• Number of people in the scope of the system
• Number of prioritized activities and their dependencies
• Sites, including recovery and alternate sites
• Critical suppliers your continuity depends on
• Integration with ISO 27001 or other management systems

We confirm audit days and all fees in a written quote. A current business impact analysis and records of at least one exercise make the audit shorter and more useful.

Suppliers who are critical to recovery can increase audit time, because the auditor needs to see how you know they can support you in a disruption, through contracts, their own continuity arrangements or joint exercises.