Standards and schemes
Business continuity management (ISO 22301)
More than one framework requires continuity. ISO 22301 is a way of organising it into one system instead of several sets of documents.
Who it is for
Continuity matters where an outage costs money in hours, not days — and where someone outside the organisation can see it.
Manufacturing and industry · Energy · Healthcare · Financial sector · Public administration · Logistics and IT services
You are not buying a standard. You are buying what you already need to have
Most texts about ISO 22301 start by saying that it is an internationally recognised standard. That is true, and it does not interest the reader.
What matters more is that continuity is required of you by more than one framework at once — and most organisations answer them with separate sets of documents that contradict each other.
DORA. The whole regulation is about digital operational resilience, and continuity and recovery are its core, not an annex. Financial entities are required to have an ICT business continuity policy, to carry out a business impact analysis and to test their ICT business continuity plans.
ISO/IEC 27001. ICT readiness for business continuity is one of the controls assessed at certification.
ISO 22301 does not duplicate these requirements — it organises them. One system, one business impact analysis, one set of plans, one testing plan. That is the whole benefit of the standard, and there is no need to promise anything else.
What it means in practice
Business continuity management is not a document. It is four things that have to exist and have to be kept up to date.
Business impact analysis. Which activities cannot tolerate an outage, for how long they can tolerate it and what happens when that time is exceeded. Without it, the plans are guesswork.
A recovery time objective for every critical activity. Not one number for the whole company — each activity has its own.
Plans that someone can actually use. A business continuity plan, a technology recovery plan and a crisis communication plan, written so that the person on duty can work with them, not only their author.
Testing. A plan that has not been tested is an assumption. The standard does not prescribe an interval — the organisation sets it according to how critical the activity is. DORA requires financial entities to test the ICT business continuity plans and the ICT response and recovery plans in relation to ICT systems supporting all functions at least yearly.
Where our role ends
We do not issue ISO 22301 certificates. A certificate is issued by an accredited certification body, not by an adviser. The same organisation may not both build a management system and certify it — that is a requirement of impartiality and it applies without exception. We prepare you for certification and accompany you through it; the assessment itself is carried out by someone else.
Nobody audits their own work. If we built your continuity system or wrote its plans, its internal audit is carried out by someone who did not.
Where to read more
Continuity draws on the same inputs as risk analysis and risk management — the same asset inventory and the same risk register: Risk analysis.
Legal position verified as of 21 October 2026.
How we help
Packages, scope and indicative price
Business continuity manager role
Taking on the role if you have no one in-house: running the system, coordinating the business impact analysis, managing continuity risks and reporting regularly to management.
Documentation
Continuity policy, business continuity plan, technology recovery plan and crisis communication plan — including the business impact analysis they are based on.
Testing
From tabletop exercises to the simulation of a real outage. The output is an evaluation with findings and recommendations, not a certificate of attendance.
Expert consultation
Assessment of the current state, ongoing support, preparation for an audit or for the certification assessment.
We do not list prices on this page. We agree the scope and the price with you in advance — the quotation follows the initial assessment.
What determines the price
The price is determined by scope, not by the size of the company. Effort is driven mainly by an additional site, an additional information system in scope, a supplier that has to be assessed, and a second jurisdiction. Each such extension adds roughly a third to a half to the effort. We agree the scope at the initial assessment and the quotation states the number of days as well.
Frequently asked
What people ask us most often
Do you issue ISO 22301 certificates?
No. A certificate is issued by an accredited certification body, not by an adviser — the same organisation may not both build the system and certify it. We prepare you for certification and accompany you through it; the assessment itself is carried out by someone else.
How often should the continuity plan be tested?
The standard does not prescribe an interval — the organisation sets it according to how critical the activity is. DORA requires financial entities to test the ICT business continuity plans and the ICT response and recovery plans in relation to ICT systems supporting all functions at least yearly. A plan that has not been tested is an assumption, not a plan.
Why ISO 22301 if DORA already requires continuity?
The standard does not duplicate those requirements; it organises them — one system, one business impact analysis, one set of plans and one testing plan instead of several sets of documents that contradict each other.
What is a business impact analysis?
It determines which activities cannot tolerate an outage, for how long they can tolerate it and what happens when that time is exceeded. The recovery time objective for each critical activity follows from it — and the plans follow from that.
Tell us which activities must not stop
Send us what you already have — a policy, plans, the results of the last exercise — and we will tell you what is missing and what the work involves.