ISO 22301 Certification for Business Continuity Management Systems
ISO 22301 certification from a UAF-accredited certification body in Dallas–Fort Worth, Texas. One senior auditor, one fixed-fee proposal, and an audit that tests your business impact analysis, recovery plans, and exercises, not just the documents. Most certification audits take 6–12 weeks.
Page reviewed 29 September 2026 by the Accredify Global certification team.
What Is ISO 22301 Certification?
ISO 22301 certification is independent confirmation, by an accredited certification body, that your business continuity management system (BCMS) meets ISO 22301. It shows customers and regulators that you know which activities matter most, how quickly they must recover, and that your plans have been tested.
A BCMS starts with a business impact analysis, which sets recovery time objectives for critical activities. It then adds a risk assessment, continuity strategies, documented plans, and a program of exercises that proves the plans work. Our audit samples real exercise results and incident records, not just the plan documents.
We certify US organizations from our Dallas–Fort Worth, Texas headquarters and audit sites across 71 countries. Certify ISO 22301 on its own or with ISO 27001 or ISO 9001.
ISO 22301:2019 and the 2024 Climate Amendment: What Your Audit Covers
ISO 22301:2019 is the current edition of the standard. In February 2024, ISO added Amendment 1 on climate action to ISO 22301 and other management system standards. You now consider whether climate change is a relevant issue for your BCMS, and whether interested parties have climate-related requirements.
For continuity planning, that often means assessing extreme weather, flooding, heat, and power disruption in your risk assessment and supplier dependencies. We check both points at Stage 1, and they apply to new certifications, surveillance, and recertification audits.
Source: ISO 22301:2019 (iso.org)
When Do Organizations Need ISO 22301 Certification?
Most ISO 22301 projects start when a customer, regulator, or tender asks for proof that critical services will keep running.
SaaS, data center, and managed service providers with uptime and recovery commitments in contracts.
Firms meeting operational resilience expectations, including DORA in the EU.
Providers and suppliers who must keep patient-facing services running during disruption.
Organizations whose customers map supplier dependencies and ask for continuity evidence.
Contracts that list an accredited ISO 22301 certificate as a qualification.
Groups that need one continuity approach across sites, regions, and shifts.
How to Get ISO 22301 Certified: The Certification Process
Six stages from first call to certificate, with the same senior auditor at every audit stage.
Not sure whether your business impact analysis and exercise records would pass Stage 1? A free scope review tells you before the auditor does.
Book a free audit scope reviewWhat Makes an ISO 22301 Audit at Accredify Global Different
The questions buyers ask most when comparing ISO 22301 certification bodies, answered upfront.
The auditor who scopes your certification leads Stage 1, Stage 2, and surveillance. Findings cite the evidence and the clause behind them.
We sample exercise reports, recovery tests, and real incidents, and check that lessons learned led to changes.
Continuity and information security share risk, incident, and supplier controls, so we audit them as one program.
A transfer audit reviews your certificate and open nonconformities, then aligns your cycle without resetting your history.
ISO 22301 Certification Requirements: What the Audit Evaluates
Auditors follow the continuity lifecycle from analysis to exercise, and check that each step is evidenced.
Context & scope
The products, services, and sites in scope, and the requirements of interested parties.
Business impact analysis
Critical activities, impacts over time, and recovery time objectives set by the business.
Risk assessment
Risks of disruption to critical activities, including supplier and climate-related risks.
Strategies & solutions
How each critical activity will continue or recover, with the resources needed.
Plans & procedures
Incident response, communication, and recovery plans that people can actually use.
Exercises & improvement
A program of exercises and tests, with results, lessons learned, and management review.
Documents the auditor will ask for
- BCMS scope and business continuity policy
- Business impact analysis with recovery time objectives
- Risk assessment and treatment
- Business continuity strategies and resource requirements
- Incident response and business continuity plans
- Exercise program and exercise reports
- Competence and awareness records
- Internal audit, management review, and corrective actions
Key terms the auditor will use
- RTO — recovery time objective: how quickly an activity must resume
- RPO — recovery point objective: how much data loss is acceptable
- MTPD — maximum tolerable period of disruption
- MBCO — minimum business continuity objective: the service level to run at during disruption
ISO 22301 Certification Cost and Timeline
ISO 22301 certification doesn't have a list price. The fee follows the number of audit man-days your scope needs, which depends mostly on headcount, sites, and how many critical activities are in scope. A free scope review gives you one fixed-fee proposal for your real scope.
What sets your audit man-days (and fee)
- Employees within the BCMS scope
- Number of sites, including recovery sites
- Number and complexity of critical activities
- Dependence on suppliers and outsourced services
- Whether ISO 27001 or ISO 9001 is certified at the same time
Typical certification audit timeline
| Mature continuity plans and exercises | 6–8 weeks |
|---|---|
| First formal BCMS | 8–10 weeks |
| Multi-site or mission-critical scope | 10–12 weeks |
Plan at least one exercise before the Stage 2 audit, so the auditor has results to review.
ISO 22301 vs ISO 27001, DORA, NIS2, and SOC 2
How ISO 22301 relates to the frameworks it's most often paired with.
| Framework | What it covers | How it relates to ISO 22301 |
|---|---|---|
| ISO 27001 | Information security management | Includes ICT continuity controls; ISO 22301 covers continuity of the whole business. |
| DORA | EU operational resilience law for financial entities | ISO 22301 supports DORA's continuity, recovery, and testing expectations. |
| NIS2 | EU cybersecurity directive | Business continuity and crisis management are among NIS2's required measures. |
| SOC 2 | CPA attestation, with an optional availability criterion | ISO 22301 gives an international certificate for continuity. |
How to Choose an ISO 22301 Certification Body
The questions worth asking any ISO 22301 certification body before you sign, and how Accredify Global answers them.
| Question to ask | Accredify Global's answer |
|---|---|
| Are you accredited, and can I verify it? | We're UAF-accredited under the IAF MLA framework. Check our scope in the UAF directory, and any certificate we issue on IAF CertSearch. |
| Who actually leads the audit? | One dedicated senior auditor, from the scope call to the certificate and on through surveillance. |
| How is the audit priced? | One fixed fee, set by the audit man-days your scope requires. No hidden costs are added after you agree it. |
| Will you test our plans? | We review your exercise results and incident records; we don't run your exercises for you. |
| Can you audit ISO 27001 at the same time? | Yes, as one integrated audit program with shared evidence. |
| How long will certification take? | Usually 6–12 weeks for the audit itself, once your BCMS is in use. |
What You Receive
Covering your defined BCMS scope, valid for three years with annual surveillance.
Each finding linked to the evidence and the clause behind it.
Customers can check your certificate on our certificate verification page.
Certificate and scope wording ready for contracts and resilience questionnaires.
Dates and focus areas for your annual surveillance audits.
Add ISO 27001 or ISO 9001 to the same audit program whenever you're ready.
Frequently Asked Questions About ISO 22301 Certification
Straight answers on requirements, cost, timeline, and choosing a certification body.
What is ISO 22301 certification?
ISO 22301 certification is independent confirmation, by an accredited certification body, that an organization's business continuity management system (BCMS) meets ISO 22301. It shows that critical activities are identified, recovery objectives are set, and continuity plans have been tested.
What is the latest version of ISO 22301?
ISO 22301:2019 is the current edition. In February 2024, ISO added Amendment 1 on climate action, which asks organizations to consider whether climate change is relevant to their BCMS.
What are the ISO 22301 certification requirements?
ISO 22301 requires a defined BCMS scope, leadership commitment and a continuity policy, and a business impact analysis with recovery objectives. It also requires a risk assessment, continuity strategies, documented plans, an exercise program, internal audit, management review, and corrective action.
How do I get ISO 22301 certified?
Define your BCMS scope, complete a business impact analysis and risk assessment, and put continuity plans in place. Run at least one exercise, an internal audit, and a management review, then have an accredited certification body audit it. With Accredify Global the path is a free scope review, application, Stage 1, Stage 2, certification decision, and annual surveillance.
What is a business impact analysis?
A business impact analysis (BIA) identifies your critical activities and how the impact of disruption grows over time. It sets recovery time objectives and the resources needed to recover, and it is the foundation of an ISO 22301 BCMS.
What is the difference between RTO and RPO?
The recovery time objective (RTO) is how quickly an activity must resume after disruption. The recovery point objective (RPO) is how much data loss is acceptable, measured as the time between the last good copy and the disruption.
How much does ISO 22301 certification cost?
ISO 22301 certification cost depends on the audit man-days your scope requires. The main drivers are headcount, sites, the number and complexity of critical activities, and supplier dependence. Accredify Global reviews your scope for free and issues one fixed-fee proposal, with no hidden costs added afterwards.
How long does ISO 22301 certification take?
The certification audit typically takes 6 to 12 weeks. That is 6–8 weeks with mature continuity plans and exercises, 8–10 weeks for a first formal BCMS, and 10–12 weeks for multi-site or mission-critical scopes.
How long is an ISO 22301 certificate valid for?
Three years. Annual surveillance audits confirm the BCMS is still maintained, and a recertification audit is required before the certificate expires.
Do we need to run an exercise before certification?
Yes. ISO 22301 requires an exercise and testing program. The Stage 2 auditor will look for exercise results and evidence that lessons learned led to changes. Plan at least one exercise before Stage 2.
What is the difference between ISO 22301 and ISO 27001?
ISO 27001 manages information security and includes ICT continuity controls. ISO 22301 manages the continuity of the whole business, including people, sites, suppliers, and services. Many organizations certify both.
Does ISO 22301 help with DORA or NIS2?
Yes. ISO 22301 supports the continuity, recovery, and testing expectations in DORA for EU financial entities, and the business continuity and crisis management measures in NIS2. It does not replace either law's specific requirements.
What is an ISO 22301 certification body?
An ISO 22301 certification body is an independent organization that audits business continuity management systems and issues ISO 22301 certificates. Choose one accredited under the IAF MLA framework so customers can verify the certificate on IAF CertSearch.
Can I switch to Accredify Global if I'm already ISO 22301 certified?
Yes. This is a transfer audit, not a first-time certification. We review your certificate, scope, and any open nonconformities, then align your audit cycle without resetting your certification history.
Can ISO 22301 be combined with other standards?
Yes. ISO 22301 can be audited with ISO 27001 or ISO 9001 in one integrated program. That reduces repeated audit time for shared processes such as risk assessment, incident management, internal audit, and management review.
Get One Fixed-Fee Proposal for Your Actual Continuity Scope
Tell us about your critical services, sites, and the customer or tender asking for ISO 22301. We'll recommend a timeline and return a fixed-fee proposal.
Book your free audit scope review →