Protected operations
Critical activities identified, with recovery times agreed and planned.
Certification support
ISO 22301 Business Continuity Management
Current edition: ISO 22301:2019
The business continuity standard for organisations that must keep critical activities running through disruption, from IT outages and supplier failure to extreme weather and loss of a site. It turns continuity planning into a managed, tested system.
What the standard covers
Requirements, clause by clause
ISO 22301 sets the management system around continuity. Clause 8 carries the analysis, strategies, plans and exercises.
4
Context
Issues, interested parties, legal requirements, BCMS scope.
5
Leadership
Commitment, business continuity policy, roles.
6
Planning
Risks and opportunities, objectives, planning changes to the BCMS.
7
Support
Resources, competence, awareness, communication, documented information.
8
Operation
Business impact analysis, risk assessment, strategies and solutions, plans and procedures, exercise programme.
9
Performance evaluation
Monitoring, internal audit, management review.
10
Improvement
Nonconformity, corrective action and continual improvement.
Clauses 4 to 10 follow the harmonized structure shared with ISO 9001 and ISO/IEC 27001, so the systems integrate cleanly.
Why organisations implement it
What a working BCMS delivers
Tested plans
Exercises that show plans work before a real disruption.
Customer assurance
A recognised answer to continuity questions in tenders and contracts.
Regulatory support
A framework that supports operational resilience expectations such as DORA and NIS2.
Supplier resilience
Dependencies on key suppliers understood and addressed.
Integrates with security
Shares structure and evidence with ISO/IEC 27001.
How we work
Path to certification
One AEC methodology from first assessment to certificate, delivered by registered lead auditors.
- AssessGap assessment against ISO 22301, scope and roadmap
- DesignProcesses, risk register, policy and documented information
- ImplementProcesses embedded with coaching for process owners
- TrainAwareness for all staff and internal auditor development
- VerifyInternal audit, management review and mock certification audit
- Certify & sustainStage 1 and Stage 2 support, then surveillance readiness
Full implementation
No existing system. We design and implement from the ground up.
Typically 6 to 9 monthsGap remediation
Some documentation in place. We close the gaps and prove effectiveness.
Typically 4 to 6 monthsUpgrade & integration
Integration with ISO/IEC 27001 or ISO 9001, or adding sites to scope.
Typically 3 to 5 months
Who certifies
Independent certification, chosen to fit your market
Your ISO 22301 certificate is issued by an independent certification body accredited by UKAS, DAkkS or an equivalent national accreditation body. AEC prepares you for that audit; the certification decision is theirs.
CB-neutral
We are not tied to one certification body and help you select one that your customers and regulators recognise.
Audit-ready
Exercises, mock audit and closed corrective actions before Stage 1 and Stage 2.
No guarantees
We prepare you thoroughly and never promise an outcome only an independent auditor can decide.
Where it applies
ISO 22301 by industry
Finance · operational resilience and outsourcing
IT services · data centres and managed services
Power & utilities · critical infrastructure
Healthcare · hospitals and clinical services
Government · public services
Transport & logistics · networks and hubs
Related standards
Training Academy
View ISO 22301 courses
ISO 22301 training
Delivered by practising, registered lead auditors. In-house, public, virtual or hybrid.
- Awareness (half day) for staff and managers
- Implementer (2 to 3 days) for continuity coordinators
- Internal Auditor (2 to 3 days) in line with ISO 19011
- Exercise facilitation for crisis and recovery teams
Questions
ISO 22301 FAQ
Does AEC issue the ISO 22301 certificate?
No. Certificates are issued by independent certification bodies accredited by UKAS, DAkkS or an equivalent national accreditation body. AEC prepares your organisation for that audit.
What is a business impact analysis?
It identifies your prioritised activities, the impact of disruption over time and the resources each activity needs. It sets the recovery times your continuity strategies must meet.
Do we have to run exercises before certification?
Yes. ISO 22301 requires an exercise programme, and auditors expect evidence that plans have been tested and lessons applied.
How does ISO 22301 relate to ISO/IEC 27001?
ISO/IEC 27001 protects information; ISO 22301 keeps the business running. Both use the harmonized structure, so many organisations run them together.
Start your ISO 22301 programme
Tell us your critical services, sites and dependencies. We reply with a proposal covering impact analysis, plans, exercises and certification support.
Certification decisions are made by independent, accredited certification bodies. AEC prepares organisations for certification and does not guarantee certification outcomes.