Keep operations running and suppliers secure. Reduce downtime, secure your supply chain, and satisfy customer due-diligence with ISO 22301 continuity + ISO 28000 supply-chain security, with 18788 and 31000 where needed.
This family addresses operational continuity and supply chain security — the foundations of business resilience in an interconnected world.
Key challenges we solve:
Four complementary standards that work together to build comprehensive organizational resilience.
No standards match the selected filters. Reset filters
Common combinations of standards tailored to specific industry requirements and risk profiles.
Operational continuity plus supply chain security for port operations and cargo handling.
Business continuity and supply chain security for logistics providers and freight forwarders.
Business continuity for critical infrastructure. Often combined with ISO 27001 for cyber security.
Comprehensive resilience including business continuity, supply chain security, and private security where applicable.
Detailed comparison to help you choose the right standard or combination for your organization.
| Standard | Scope | Certifiable? | Primary Use Case | Works With | Typical Timeline | Audit Cycle |
|---|---|---|---|---|---|---|
| ISO 22301 | Business Continuity Management Systems | Yes | BCMS, disaster recovery, operational resilience | ISO 27001, ISO 45001 | 8–16 weeks | 3-year cycle with annual surveillance |
| ISO 28000 | Supply Chain Security Management | Yes | Supply-chain security, cargo protection | ISO 22301, ISO 27001 | 10–20 weeks | 3-year cycle with surveillance |
| ISO 18788 | Private Security Operations Management | Yes | Private security operations governance | ISO 22301, ISO 28000 | 12–20 weeks | 3-year cycle with surveillance |
| ISO 31000 | Risk Management Principles & Guidelines | Guidance Only | Enterprise risk management framework | All management systems | 3–8 weeks | Guidance only — no audit |
Complete support from initial assessment to certification and beyond.
Comprehensive BIA to identify critical processes and establish RTO/RPO targets for ISO 22301 compliance.
Supply chain vulnerability assessment and supplier security screening for ISO 28000 implementation.
Incident response procedures, crisis communication plans, and emergency decision-making frameworks.
Tabletop exercises, crisis simulations, and DR testing to validate your continuity capabilities.
Internal audit schedules, checklists, and competency development for ongoing compliance monitoring.
Pre-certification assessment and gap analysis to ensure audit readiness and first-time success.
Build internal competency with our structured training pathway.
Introduction to business continuity concepts and ISO 22301 requirements
Internal audit skills based on ISO 19011 principles for BCMS auditing
Practitioner skills for BCMS development and implementation management
CQI/IRCA certified lead auditor course for certification body auditing
ISO 22301 Internal Auditor + ISO 28000 Practitioner
Save 20% vs individual coursesISO 28000 complete pathway: Foundation to Implementer
Perfect for logistics professionalsISO 31000 + ISO 22301 Foundation combination
Enterprise risk management focusISO 22301 focuses on business continuity while ISO 27001 addresses information security. They complement each other perfectly — many organizations implement both to address operational resilience and cyber security together. Common management system elements can be integrated.
ISO 28000 requires risk-based supplier evaluation, not necessarily auditing all suppliers. Focus on critical suppliers, high-risk locations, and suppliers handling sensitive cargo. Document your risk assessment criteria and audit frequency based on risk levels.
ISO 22301 requires regular testing but doesn’t specify frequency. Best practice is quarterly tabletop exercises and annual full-scale tests. Document all exercises, lessons learned, and improvement actions.
Yes, multi-site sampling is common for ISO 22301 and ISO 28000. The certification body will audit a representative sample of sites based on your risk assessment. All sites must be included in the management system scope and documentation.
Crisis communications is about stakeholder messaging during incidents, while business continuity focuses on maintaining or recovering critical operations. ISO 22301 covers both aspects — internal coordination for recovery and external communications.
Key metrics include: Mean Time to Recovery (MTTR), RTO achievement, RPO compliance, exercise completion rates, supplier performance during incidents, and stakeholder communication timeliness.
Our experts will help you assess your risks, design appropriate systems, and achieve certification. Start with a free consultation.