ISO 22301 certification, explained
ISO 22301 is the standard for business continuity management systems. It helps an organization plan for disruption such as power loss, system failure, supplier failure or loss of a site, so that critical services can continue or recover within an acceptable time. It suits utilities, finance, healthcare, telecoms, logistics and any business whose customers cannot tolerate long outages. Independent certification bodies audit it.
Updated 5 November 2026
Info. Showing a standard does not mean a partner holds scope for it. How matching works.
Who it may be relevant for
- Utilities, telecoms, banks and healthcare providers where downtime has serious consequences
- IT, data centre and managed service providers with customer availability commitments
- Logistics and manufacturing operators with single points of failure in sites or suppliers
- Organizations asked by regulators or customers to show tested recovery arrangements
What it covers
- A business impact analysis showing which activities matter most and how quickly they must recover
- Risk assessment focused on disruption to people, sites, technology and suppliers
- Continuity strategies and plans for response and recovery
- Exercising and testing plans, and learning from the results
- Monitoring, internal audit, management review and improvement of the system
What it can help with
- Clarity about the critical activities and the maximum disruption the organization can accept
- Plans that people have actually practised, with owners and contact arrangements
- A better understanding of dependency on key suppliers and single sites
- Evidence for customers or regulators who ask how continuity is managed
What the pathway means
ISO 22301 is a certifiable management-system standard. An independent certification body audits your business continuity management system, with a Stage 1 review, a Stage 2 audit, a decision, surveillance audits and recertification. Certification does not guarantee an organization will survive any given disruption, only that a system is in place, exercised and reviewed. MIYAAR CONNECT does not audit or certify. We connect your inquiry with independent certification bodies.
Edition. ISO 22301:2019 is the current edition, with Amendment 1:2024 on climate-change considerations. ISO lists a revision as under development. Ask the certification body what that could mean for your audit. We do not state transition dates.
The typical process
Steps and timing vary by body and scope. This is the usual shape, not a promise.
- You and us
Your inquiry
You describe your needs and share the basics.
- Certification body
Application and contract review
The body reviews your scope, sites and size, then quotes.
- Certification body
Stage 1 audit
A readiness review of your management system documentation.
- Certification body
Stage 2 audit
An evaluation of how the system works in practice.
- This part is theirs
Certification decision
Made by the certification body, never by MIYAAR CONNECT.
- Certification body
Surveillance and recertification
Periodic surveillance audits, then recertification at the end of the cycle.
Where it is typically used
- A payment or telecom service documenting recovery times and failover testing for critical systems
- A manufacturer planning for loss of a single production site or a key supplier
- A hospital group or utility testing communication and emergency arrangements across sites
What affects cost
- Number of employees
- Number of sites
- Complexity of what you do and its risks
- Number of critical activities, sites and technology environments in the scope
- The depth of the business impact analysis and the range of scenarios you plan for
- Dependence on outsourced services or third-party sites that must be assessed
- Whether the scope sits inside a regulated sector that needs auditors with sector knowledge
What affects timing
- Time to complete business impact analysis and agree recovery objectives with management
- Scheduling and recording exercises, since auditors expect evidence that plans were tested
- Coordinating across departments and sites that own different parts of the plan
- A revision of the standard being under development, which may affect how audits are planned
What to have ready
- A list of critical services or processes you want in scope
- A summary of key sites, systems and suppliers those services depend on
- Any existing continuity, disaster recovery or crisis plans, described not uploaded
- Customer, regulator or tender requirements that mention business continuity
- A note on when exercises were last held, in general terms
Accreditation and recognition
Certificates have value according to the certification body and the scope that was audited. Accreditation bodies assess certification bodies against requirements for management system certification. Ask for the certificate number and scope, then confirm the body's accreditation with its accreditation body or through the Global Accreditation Cooperation Incorporated (Global ACI) arrangement, which took over from the IAF and ILAC on 1 January 2026. A scope that covers only part of the business gives assurance only for that part.
Common questions
Is business continuity the same as disaster recovery?
Do we need to test plans before an audit?
Does ISO 22301 cover cyber attacks?
Can we limit certification to one service?
Related standards
Relevant industries
Useful reading
Sources
- ISO: ISO 22301:2019 business continuity management systems (checked 5 November 2026)
Ask about availability for ISO 22301
We review availability for each inquiry. If no verified certification body fits your request, we will tell you plainly.