Resilience & Governance · ISO 22301:2019
ISO 22301 certificationBusiness Continuity Management
ISO 22301:2019 business continuity management system certification for UK organisations, assessing BIA, continuity plans and exercising.
- Evidence for customers
- Clear recovery priorities
- Tested plans
- Understanding dependencies
Overview
What is ISO 22301:2019?
ISO 22301:2019 specifies requirements for a business continuity management system (BCMS). It helps an organisation prepare for, respond to and recover from disruptive incidents when they occur. The core of the standard sits in clause 8, which requires a business impact analysis and risk assessment, business continuity strategies and solutions, documented plans and procedures, an exercise programme and evaluation of business continuity capability. It follows the Harmonized Structure and integrates with other management system standards.
Hexa Certifications Limited provides independent third-party certification audits against ISO 22301. Our auditors review how you have identified prioritised activities, set recovery objectives and tested your plans, and whether the outcomes of exercises lead to improvement. We do not write business impact analyses or continuity plans for clients, as ISO/IEC 17021-1 requires certification bodies to be impartial. An optional pre-assessment is available to check readiness before Stage 1.
In the UK, business continuity is a growing expectation in supply chains for financial services, utilities, healthcare, public services and technology. The standard can support operational resilience work, although it does not by itself satisfy specific regulatory regimes such as those set by the financial regulators. The 2024 climate change amendment applies, so clause 4.1 now asks whether climate change, including severe weather and its effects, is a relevant issue.
Who it is for
Organisations that choose ISO 22301
- IT, cloud and managed service providers supporting critical client operations
- Financial services firms and their outsourced service providers
- Utilities, telecommunications and infrastructure operators
- Healthcare suppliers and outsourced public service providers
- Logistics and supply chain businesses with time-critical deliveries
- Organisations whose customers require evidence of tested continuity arrangements
Benefits
What ISO 22301 certification does for you
Evidence for customers
Customers increasingly ask suppliers how they would maintain service during disruption. Independent certification shows that your continuity arrangements have been assessed against an international standard.
Clear recovery priorities
Business impact analysis identifies which activities matter most and how quickly they must be resumed, so that resources during an incident are directed to the right places.
Tested plans
ISO 22301 requires an exercise programme. Regular exercises reveal gaps in plans, contact details, dependencies and decision-making before a real disruption exposes them to customers and staff.
Understanding dependencies
The analysis covers people, premises, technology, information and suppliers, helping you understand which dependencies could halt prioritised activities and how best to protect them in advance.
Coordinated response
Defined response structures, communication procedures and warning arrangements help leaders make timely decisions and keep staff, customers and interested parties informed throughout an incident and its recovery.
Integration with security and IT
ISO 22301 aligns with ISO/IEC 27001 and ISO/IEC 20000-1, so continuity, information security and service management can share risk assessment, internal audit and management review processes.
Requirements
What the auditor will assess
The main clauses of ISO 22301:2019 and what each one asks of your organisation.
Clause 4
Context of the organisation
Determine issues affecting continuity, including whether climate change is relevant, interested party needs, legal and regulatory requirements and the scope of the BCMS.
Clause 5
Leadership
Top management must demonstrate commitment, establish a business continuity policy and assign roles, responsibilities and authorities for the BCMS.
Clause 6
Planning
Address risks and opportunities to the BCMS, set business continuity objectives with plans to achieve them and plan changes in a controlled manner.
Clause 8.2
BIA and risk assessment
Conduct a business impact analysis to set prioritised activities and recovery time objectives, identify dependencies and resources, and assess risks of disruption.
Clause 8.3
Strategies and solutions
Identify and select strategies and solutions to protect prioritised activities, reduce the likelihood and impact of disruption and provide the required resources.
Clause 8.4
Plans and procedures
Establish a response structure, warning and communication procedures, business continuity plans and recovery arrangements to return to normal operations.
Clause 8.5 to 8.6
Exercising and evaluation
Implement an exercise programme to validate strategies and plans, and evaluate the suitability, adequacy and effectiveness of business continuity documentation and capabilities.
Clause 9 to 10
Evaluation and improvement
Monitor and measure the BCMS, carry out internal audits and management reviews, correct nonconformities and continually improve.
Audit evidence
What we will ask to see
Auditors sample records and talk to people doing the work. Having these ready makes Stage 2 smoother and faster.
- BCMS scope and business continuity policy
- Business impact analysis with prioritised activities and recovery time objectives
- Risk assessment of disruption to prioritised activities
- Selected strategies and solutions with resource requirements
- Business continuity and incident response plans with contact details
- Exercise programme, exercise reports and lessons learned
- Supplier continuity assessments for critical dependencies
- Internal audit, management review and corrective action records
Process
Your route to ISO 22301 certification
- 1
Application and quotation
You tell us your scope, sites, headcount and standards. We calculate audit duration using the accreditation rules and send a fixed quotation for the full three-year cycle.
- 2
Stage 1 audit
Your auditor reviews your documented information, scope, legal and regulatory awareness, internal audit and management review, and confirms you are ready for Stage 2.
- 3
Stage 2 audit
An on-site evaluation of how your management system works in practice. The auditor interviews people, observes activities and samples records against every requirement.
- 4
Certification decision
Any nonconformities are closed with evidence. A qualified reviewer who did not take part in the audit makes the certification decision and your certificate is issued.
- 5
Surveillance and recertification
Surveillance audits take place at least once a year to confirm continued conformity. A recertification audit before the third anniversary renews your certificate.
Certificate verification
Check a Hexa certificate
Need to know whether a supplier's certificate is current? Customers, buyers and other interested parties can ask us to confirm the details held in our records.
We confirm the organisation name, certificate number, ISO standard, certified scope, status, and issue and expiry dates.
FAQs
ISO 22301 certification questions
Answers about scope, timing and audits for ISO 22301:2019.
What is a business impact analysis?
A business impact analysis (BIA) assesses the impacts over time of not performing activities that support your products and services. From it you determine prioritised activities, the time frame within which they must be resumed, and the resources and dependencies they need, including suppliers. ISO 22301 clause 8.2.2 sets out these requirements.
Do we need to have run an exercise before certification?
Yes. Auditors expect to see evidence that your exercise programme has started and that at least one exercise has been carried out and evaluated before Stage 2, with lessons learned recorded and actions raised. Exercises can range from discussion-based tabletop sessions to live tests, as long as they are appropriate to your objectives and scope.
Is ISO 22301 the same as an IT disaster recovery plan?
No. Disaster recovery focuses on restoring technology. ISO 22301 covers the whole organisation, including people, premises, suppliers, information and communications, as well as technology. IT recovery arrangements are often one of the solutions within a BCMS, and auditors will check they align with the recovery objectives set by the business impact analysis.
Can we limit the scope to certain services or sites?
Yes. Many organisations certify a defined set of products, services or locations, for example those supporting key customer contracts. The scope must be clearly described, including any dependencies outside it, and must not mislead customers. Your certificate will state the scope so customers can see which services are covered.
Does ISO 22301 meet UK operational resilience regulations?
Not by itself. UK financial regulators have their own operational resilience requirements, such as identifying important business services and setting impact tolerances. ISO 22301 provides a well-structured management system that can support this work, but firms should check regulatory requirements directly rather than relying on certification as evidence of compliance.
Can Hexa help us write our business continuity plans?
No. ISO/IEC 17021-1 prevents certification bodies from providing management system consultancy to clients, because this would mean auditing our own work. You can develop plans internally or with an independent adviser. We offer an optional pre-assessment that gives an impartial view of readiness without supplying the content.
How does ISO 22301 work with ISO 27001?
ISO/IEC 27001 includes controls on information security during disruption and ICT readiness for business continuity, while ISO 22301 provides the full continuity management framework. Both share the Harmonized Structure, so many organisations run them together with shared risk, internal audit and management review processes, and we can carry out integrated audits.
How often must plans be reviewed?
ISO 22301 requires the BIA and risk assessment to be reviewed at planned intervals and when there are significant changes within the organisation or its context. Plans must be updated following exercises, incidents and changes. Most organisations review annually as a minimum, and auditors check that documentation reflects current people, suppliers and systems.
Who needs ISO 22301?
Sectors that commonly ask suppliers for ISO 22301.
ISO 22301 certification near you
We audit ISO 22301 systems on site across the UK, including:
- ISO 22301 London
- ISO 22301 Birmingham
- ISO 22301 Manchester
- ISO 22301 Leeds
- ISO 22301 Glasgow
- ISO 22301 Edinburgh
- ISO 22301 Cardiff
- ISO 22301 Belfast
- ISO 22301 Bristol
- ISO 22301 Liverpool
- ISO 22301 Newcastle upon Tyne
- ISO 22301 Sheffield
- ISO 22301 Nottingham
- ISO 22301 Southampton
- ISO 22301 Cambridge
- ISO 22301 Aberdeen
Integrated audits
Standards often combined with ISO 22301
Organisations frequently certify these together in one integrated audit, with one plan and fewer days on site.
Information & Technology
ISO/IEC 27001:2022Information Security Management
ISO/IEC 27001:2022 specifies requirements for an information security management system (ISMS). It requires an organisation to assess information security risks to the confidentiality, integrity and availability of information, select controls to treat them and manage those controls through a continual cycle of monitoring and review. Annex A lists 93 reference controls in four themes: organisational, people, physical and technological. Each organisation compares its chosen controls against Annex A and records the outcome in a Statement of Applicability.
- Answer security questionnaires
- Risk-based security
- Supports data protection duties
- Management oversight
Information & Technology
ISO/IEC 20000-1:2018IT Service Management
ISO/IEC 20000-1:2018 specifies requirements for establishing, implementing, maintaining and continually improving a service management system (SMS). It covers the planning, design, transition, delivery and improvement of services to meet agreed requirements. Clause 8 sets out the operational processes, grouped into service portfolio, relationship and agreement, supply and demand, service design, build and transition, resolution and fulfilment, and service assurance. The 2018 edition follows the Harmonized Structure, which allows integration with ISO/IEC 27001 and ISO 9001.
- Procurement credibility
- Consistent service delivery
- Clear service agreements
- Controlled change
Resilience & Governance
ISO 37001:2025Anti-Bribery Management
ISO 37001 specifies requirements for an anti-bribery management system. It helps an organisation prevent, detect and respond to bribery, whether by the organisation, its personnel or business associates acting on its behalf, and bribery of the organisation. Requirements include an anti-bribery policy, top management and governing body oversight, an anti-bribery compliance function, bribery risk assessment, due diligence, financial and non-financial controls, gifts and hospitality controls, and processes for raising and investigating concerns. The second edition, ISO 37001:2025, was published in February 2025.
- Supports adequate procedures
- Risk-based controls
- Due diligence on third parties
- Clear governance oversight
Start your certification
Get your ISO 22301 certification quote
Tell us about your organisation and the standards you need. We will confirm audit days, scope and dates in writing, with no obligation.