![\"ISO](\"http:\/\/brandcompliance.com\/wp-content\/uploads\/2023\/03\/AdobeStock_484083612-300x169.jpeg\")
<\/p>\nDisruptive incidents can affect your organization\u2019s employees, locations, IT systems, suppliers and ability to deliver products and services. An effective business continuity management system provides a structured approach for preparing for, responding to and recovering from these disruptions.<\/p>\n
<\/p>\n
ISO 22301 certification provides independent confirmation that your organization\u2019s business continuity management system meets the applicable requirements of the standard. Brand Compliance assesses whether the management system has been established, implemented, maintained and continually improved.<\/p>\n
Would you like to discuss the certification scope, audit process and expected audit time for your organization? Schedule an introductory meeting<\/a>.<\/p>\n ISO 22301 is the internationally recognized requirements standard for business continuity management systems. A business continuity management system is also referred to as a BCMS.<\/p>\n The standard provides a framework for identifying potential disruptions, determining their possible impact and establishing arrangements for responding to disruptive incidents. The objective is to enable the organization to continue delivering prioritized products and services at an acceptable predefined capacity during a disruption and to recover its activities in a controlled manner.<\/p>\n ISO 22301 can be applied by organizations of any size and in any industry. How the requirements are applied depends on factors such as the organization\u2019s activities, operating environment, dependencies, interested parties and the complexity of its products and services.<\/p>\n Brand Compliance provides ISO 22301 certification outside the scope of its accreditation by the Dutch Accreditation Council (RvA), registration C 548. ISO 22301 certificates issued by Brand Compliance therefore do not carry the RvA accreditation mark. Further information is available on our page about accreditations and conditions<\/a>.<\/p>\n ISO 22301 certification can provide several benefits to organizations that want to manage business continuity systematically:<\/p>\n Certification cannot guarantee that disruptions will not occur or that every activity will continue without interruption. It provides independent confirmation that the organization has established and implemented a management system for managing business continuity.<\/p>\n ISO 22301 requires an organization to establish, implement, maintain and continually improve a business continuity management system. The precise application of the requirements depends on the organization\u2019s context, risks, activities and continuity objectives.<\/p>\n Important elements of a BCMS include:<\/p>\n A business impact analysis identifies the organization\u2019s activities and evaluates the consequences of a disruption over time. It provides a basis for determining which activities should be prioritized, the resources and dependencies required for these activities and the timeframes within which they should be resumed.<\/p>\n The organization must also assess the risks of disruptions to its prioritized activities. The business impact analysis and risk assessment have different purposes but are used together when determining appropriate business continuity strategies and solutions.<\/p>\n Based on the outcomes of the business impact analysis and risk assessment, the organization selects strategies and solutions for maintaining and recovering prioritized activities. These may relate to employees, locations, technology, information, equipment, suppliers, transport, utilities and financial resources.<\/p>\n The organization must establish plans and procedures for responding to disruptions. These arrangements should describe matters such as roles, responsibilities, escalation, internal and external communication, warning and notification, incident response and the continuation or recovery of prioritized activities.<\/p>\n Business continuity plans and procedures must be exercised and evaluated at planned intervals. The results provide input for corrections, improvements and changes to the BCMS.<\/p>\n The NIS2 Directive requires relevant entities to take appropriate and proportionate technical, operational and organizational measures to manage cybersecurity risks. These measures include business continuity, such as backup management, disaster recovery and crisis management.<\/p>\n A business continuity management system based on ISO 22301 can provide a structured approach to these continuity-related measures. It can help an organization identify critical activities, establish recovery priorities, manage dependencies and evaluate continuity arrangements.<\/p>\n ISO 22301 certification does not demonstrate that an organization fully complies with NIS2. The NIS2 Directive also contains requirements relating to subjects such as risk analysis, incident handling, supply chain security, vulnerability handling, cybersecurity training, access control and incident reporting. Further information about these requirements is available in Directive (EU) 2022\/2555<\/a>.<\/p>\n ISO 22301 and ISO 27001 can complement each other. ISO 22301 focuses on the continuity of prioritized products and services, while ISO 27001 certification<\/a> focuses on managing information security risks and preserving the confidentiality, integrity and availability of information.<\/p>\n Before applying for certification, your organization must have established and implemented a business continuity management system. Brand Compliance subsequently performs an independent certification audit.<\/p>\n You can also read more about the general process from application and application review to the proposal, agreement and audit planning in our article about the certification process step by step<\/a>.<\/p>\n If nonconformities are identified during the certification audit, the organization must address them within the applicable timeframe. A nonconformity means that a requirement from the standard or the organization\u2019s own management system has not been fulfilled.<\/p>\n The certificate forms part of a three-year certification cycle. Surveillance audits are conducted during this cycle to assess whether the BCMS continues to meet the applicable requirements. A recertification audit is conducted before the end of the cycle. Read more about the certification cycle<\/a>.<\/p>\n The cost of establishing and implementing a business continuity management system is separate from the cost of certification. Implementation costs may include purchasing the standard, training employees, allocating internal capacity, conducting exercises and engaging an external consultant if the organization chooses to do so.<\/p>\n The cost of ISO 22301 certification depends on factors such as:<\/p>\n Certification costs may include the application review, audit preparation, the Stage 1 and Stage 2 certification audits, reporting, the certification decision, certificate fees, administration and travel expenses.<\/p>\n There is no standard duration for an ISO 22301 certification process. The total lead time depends on the organization\u2019s preparation, the availability of auditors, the size and complexity of the organization and any follow-up required after the audit. Read more about how long ISO certification takes<\/a>.<\/p>\n Would you like an indication of the expected audit time and certification costs for your organization? Schedule an introductory meeting<\/a>.<\/p>\n The current certifiable edition is ISO 22301:2019, Security and resilience, Business continuity management systems, Requirements. Organizations must also consider ISO 22301:2019\/Amd 1:2024<\/a>, which adds climate change considerations to the management system requirements.<\/p>\n ISO is developing a third edition of ISO 22301. This new edition is currently still at the committee draft stage and cannot yet be used as the basis for certification. Until a new edition has been published and the applicable transition arrangements have been determined, organizations should continue to use ISO 22301:2019 and Amendment 1:2024.<\/p>\n Further information about the current edition and the development status of the standard is available on the official ISO 22301 page<\/a>.<\/p>\n Would you like to have your business continuity management system independently assessed against ISO 22301? During an introductory meeting, we discuss the intended certification scope, the audit process, the expected audit time and the information required for a proposal.<\/p>\nWhat is ISO 22301?<\/h2>\n
ISO 22301 certification and accreditation<\/h2>\n
Benefits of ISO 22301 certification<\/h2>\n
\n
ISO 22301 requirements<\/h2>\n
\n
Business impact analysis and risk assessment<\/h3>\n
Business continuity strategies, plans and exercises<\/h3>\n
ISO 22301 and NIS2<\/h2>\n
ISO 22301 certification process<\/h2>\n
Preparing for ISO 22301 certification<\/h3>\n
\n
\nPurchase an official copy of NEN-EN-ISO 22301:2019<\/a> from NEN or another national standards body. The applicable climate action amendment must also be considered.<\/li>\n
\nDuring a non-binding introductory meeting<\/a>, the intended certification scope, audit process, expected audit time and relevant organizational characteristics can be discussed.<\/li>\n
\nEstablish a business continuity management system that meets the applicable ISO 22301 requirements. The BCMS must be appropriate to the organization\u2019s context, activities, products, services and continuity needs.<\/li>\n
\nIdentify prioritized activities, possible impacts, dependencies, required resources and risks of disruption. Use the results to determine appropriate business continuity strategies and solutions.<\/li>\n
\nDocument the arrangements for responding to disruptions and continuing or recovering prioritized activities. Exercise and evaluate these arrangements at planned intervals.<\/li>\n
\nConduct internal audits to determine whether the BCMS conforms to the applicable requirements and has been effectively implemented and maintained. Read more about conducting an internal audit<\/a>.<\/li>\n
\nTop management must review the continuing suitability, adequacy and effectiveness of the BCMS. The management review provides a basis for decisions about changes, resources and improvement opportunities.<\/li>\n<\/ol>\nStage 1 and Stage 2 certification audit<\/h3>\n
\n
\nDuring Stage 1, the auditor assesses the documented information relating to the BCMS, the organization\u2019s understanding of the standard and its readiness for Stage 2. The auditor also evaluates whether important elements, such as the scope, business impact analysis, risk assessment, internal audits and management review, have been addressed.<\/li>\n
\nDuring Stage 2, the auditor assesses the implementation and effectiveness of the BCMS against the applicable ISO 22301 requirements. Audit evidence may be obtained through interviews, observations and the review of documents and records.<\/li>\n<\/ol>\nCertification decision and ISO 22301 certificate<\/h3>\n
\n
\nFollowing completion of the audit process and any required follow-up, the audit results are independently reviewed. If the certification decision is positive, Brand Compliance issues the ISO 22301 certificate.<\/li>\n<\/ol>\nWhat does ISO 22301 certification cost?<\/h2>\n
\n
Which version of ISO 22301 applies?<\/h2>\n
Start your ISO 22301 certification journey<\/h2>\n