ISO 22301:2019 Certification

ISO 22301:2019 is the international standard for a Business Continuity Management System (BCMS) — a framework to protect your business from disruption (extreme weather, fire, flood, IT outage, staff illness, supply-chain failure) by identifying critical functions in advance and planning to keep them running. Company Certification International (CCI) certifies BCMS implementations, with every certificate verifiable online.

Who needs ISO 22301 certification?

• Organizations whose customers or regulators require evidence of operational resilience
• Financial services, healthcare, logistics and infrastructure operators where downtime carries high impact
• Data centres, cloud and IT-service providers whose customers depend on continuous availability
• Any organization that has experienced a disruption and wants a structured way to prevent recurrence

Business benefits

• A tested plan for keeping critical functions running through a disruption, rather than reacting from scratch
• Independently verified evidence of operational resilience for customers, insurers and regulators
• Faster recovery and less financial/reputational damage when an incident does occur
• A common framework for demonstrating resilience across a supply chain

Certification requirements

Building a BCMS that meets ISO 22301:2019 requires a business impact analysis and risk assessment to identify critical activities and their recovery priorities, documented business continuity plans and procedures, and a testing and exercise programme. Your organization — or a consultant of your choosing — designs and operates the BCMS; CCI's role is the independent assessment.

How certification works

Stage 1 audit

A documentation and readiness review of your BCMS, business impact analysis and continuity plans.

Stage 2 audit

An audit of the BCMS in operation, including evidence of testing and exercising your continuity plans.

Certification decision

A decision maker independent of the audit team decides whether to certify, in line with ISO/IEC 17021-1.

Annual surveillance and the three-year cycle

Certificates are valid three years, with annual surveillance audits and a full recertification audit at the end of the cycle.

Remote and on-site audits

Stage 1, Stage 2 and surveillance audits can be delivered remotely, on-site, or blended, per IAF MD 4 guidance — we'll agree the right mix for your sites and scope.

What affects your quotation

Audit duration and fees depend on your employee count, number of sites, and the complexity of the critical activities in scope — see certification cost and audit duration or request a quote using the form on this page.

Accreditation route

See our accreditation and recognition page for CCI's current scheme-specific accreditation status for ISO 22301, and for how our IAR and MRA-recognized (partner) certification routes compare.

Why certify with Company Certification International

CCI's role is independent certification: application review, Stage 1 and Stage 2 audits, an independent certification decision, and ongoing surveillance. CCI does not provide management-system consultancy, documentation drafting or implementation support. Engaging ISOXPERT Management & IT Consultants — an independent consulting and technology firm under common ownership with CCI — any other consultant, or no consultant has no bearing on any certification decision.

Frequently asked questions

How long does ISO 22301 certification take? Typically 6–8 weeks from application to certification decision, subject to readiness.

How much does it cost? See certification cost and audit duration or request a fixed quote using the form on this page.

Can we certify ISO 22301 alongside ISO 27001? Yes — business continuity and information security controls often overlap; see integrated management system certification.

Can we transfer an existing ISO 22301 certificate to CCI? Yes — see transfer of ISO certification.