ISO 22301 Business Continuity Consulting

ISO 22301 provides requirements for a Business Continuity Management System, or BCMS. It helps an organisation understand disruption risks, prioritise important products and services, plan workable responses and improve resilience through exercises and review.

Certivanta helps teams build and test the management system. We prepare organisations for an independent audit, while the certification body conducts that audit and makes the certification decision.

The standard is relevant to financial services, technology providers, logistics, healthcare, professional services, public entities and any organisation whose customers depend on timely delivery. It can also support supplier assurance and contractual continuity requirements.

• Business continuity scope, governance and responsibilities
• Business impact analysis and disruption-risk assessment
• Continuity strategies, recovery priorities and dependencies
• Incident response and business continuity plans
• Exercise programmes, evaluation, internal audit and management review

A business impact analysis identifies priority activities, resources, dependencies and acceptable recovery needs. Those findings guide continuity strategies and plans. Exercises then test assumptions, decision-making, communication and recovery steps so weaknesses can be corrected before a real disruption.

ISO 22301 can be coordinated with ISO 27001 information security and ISO 20000-1 IT service management. The standards address different objectives, but aligned risk, incident, supplier and testing processes can provide a clearer view of operational resilience.

No. Technology recovery is an important dependency, but business continuity also considers people, facilities, suppliers, communications, manual workarounds and the delivery of priority products and services.

The exercise programme should reflect risk, complexity, change and organisational needs. Exercises should be planned, evaluated and followed by corrective action rather than treated as a once-off event before certification.

No. Certivanta provides consulting and certification-readiness support. An independent certification body carries out the certification audit and decides whether certification is granted.

A financial, technology or professional-services organisation may depend on power, telecommunications, cloud services, specialist staff and outsourced providers. A business impact analysis can identify which customer services must recover first and which dependencies constrain them. The organisation can then plan alternatives, escalation, communications and exercises for realistic disruption scenarios. The goal is not a document for the auditor; it is a tested set of decisions that teams can use when normal arrangements are unavailable.

Effort depends on the number of priority services, sites, dependencies, recovery teams and plans, together with the quality of existing impact analysis and exercise evidence. Complex supply chains and technology recovery interfaces require more workshops and testing. Disaster-recovery engineering, alternate facilities, specialist simulations, travel, the ISO standard and certification-body fees are not included unless agreed. Compare the scope with our consultation package before setting a budget.

• Which products and services are genuinely time-critical?
• What recovery needs have customers or regulators specified?
• Which people, suppliers, facilities, information and technologies are essential?
• Who may invoke plans and communicate during disruption?
• How will exercises test decisions rather than only review documents?

Connect continuity with ISO 27001 and ISO 20000-1, or discuss your resilience priorities.