ISO 22301 Business Continuity
ISO 22301 benefits: what the certificate does for your business
An ISO 22301 certificate shows customers, purchasing departments and tender evaluators that you know your critical activities and have tested plans for when they fail. Internally, it forces the decisions about downtime and data loss that most firms postpone. With Zertify you take an online self-assessment and receive the certificate within 4 hours of passing and payment.
01: Overview
What ISO 22301 gives a business in practice
ISO 22301:2019 describes a business continuity management system. In practice it means you have written down which activities you cannot afford to lose, how long you can be down, how much data you can lose and what you do when it happens. The benefits fall into five areas.
- Customer trust
- A bank, an insurer or an industrial customer wants to know what happens to its orders if your systems or your site fail. The certificate is a documented answer that it can check.
- Tenders
- Continuity requirements in tenders and supplier questionnaires can be answered with a certificate number instead of a page of assurances.
- Internal efficiency
- Roles, contact lists and recovery steps are written down once. In an incident nobody has to search for who decides.
- Risk reduction
- Disruption risks are assessed and treated before they happen, not discovered during an outage.
- Marketing
- The certificate PDF carries a QR code. Anyone can check the number on the public verification page.
02: Tenders
How the certificate helps in tenders and supplier questionnaires
Purchasing departments in finance, logistics and IT send questionnaires with a block on business continuity. The questions are fairly standard, and each one maps to a requirement of ISO 22301.
| Question from the customer | What your ISO 22301 work answers |
|---|---|
| Which of your activities are critical? | The business impact analysis with prioritised activities (clause 8) |
| How long can you be down? | Recovery time objectives (RTO) per activity |
| How much data can you lose? | Recovery point objectives (RPO) per activity |
| Who acts in a crisis? | Documented business continuity plans and crisis organisation |
| Have you tested your plans? | Regular exercises and improvement (clauses 9 and 10) |
A certificate does not win a tender on its own. Price, references and technical fit still count. What it does is give the evaluator evidence that can be verified in a minute, which removes one reason to mark you down.
03: Operations
Where ISO 22301 reduces risk and saves effort internally
The work behind the certificate is where most of the internal value sits. Each step replaces an assumption with a decision.
Business impact analysis
You rank activities by the damage per hour of downtime. Budget then goes to the few activities that matter.
Recovery objectives
RTO and RPO turn 'as fast as possible' into numbers that IT, operations and management agree on.
Risk treatment
IT outage, supplier failure, fire, pandemic: each risk gets a measure or a conscious decision to accept it.
Plans and crisis organisation
One set of documents names who decides, who calls the customers and in which order systems come back.
Exercises
A tabletop exercise shows gaps while they still cost nothing.
The return is highest where one failure stops deliveries: IT and cloud providers, logistics, manufacturers in supply chains, healthcare and energy supply, outsourcing providers.
04: Marketing
Using the certificate and the verification link with customers
Every Zertify certificate has a number and a QR code. Both lead to a public verification page that shows the certificate exists and is valid. Put the number into your quote template, your email signature and your answer to the supplier questionnaire. A purchasing officer or a customer auditor can check it without calling you.
Describe the certificate accurately. It confirms a business continuity management system based on an online self-assessment, reviewed by SICE and confirmed every year by a short online re-audit. Customers who open the verification page will see the details anyway.
05: Zertify
How Zertify fits in
Zertify issues the certificate under licence from SICE, the Swiss Institute of Certification and Education. SICE reviews every assessment before the certificate is issued. There is no on-site audit. You answer 34 yes/no questions: 13 are must-meet questions that must all be yes, and at least 14 of the other 21 must be yes as well. These are the core questions of the assessment, not every requirement of the standard.
The certificate costs CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. It is valid for 3 years. The subscription renews automatically and can be cancelled at any time to the end of the current year in your customer account. The certificate then ends with the paid year. Two standards get 20% off, three or more 30%, also on the yearly fee. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. You do not need an account to buy.
06: Limits
What the certificate does not do
A certificate does not keep your systems running. The benefit depends on plans that are accurate and exercised, so keep them current after the assessment.
Some customers write the classic route with an on-site audit by a certification body into their contracts. Read the wording of the requirement before you decide which route fits.
07: FAQ
Questions about ISO 22301 benefits
It helps where a tender asks for continuity evidence. You answer with the certificate number, and the evaluator verifies it on the public page. It does not replace price, references or technical fit. A few buyers require a certificate from the classic route, so read the tender wording.
Those whose customers depend on uninterrupted delivery: IT and cloud providers, suppliers to banks and insurers, logistics, manufacturers in supply chains, healthcare and energy supply, outsourcing providers. If your customers can wait a week, the direct return is smaller.
No. It limits their impact. You identify risks, treat them and set recovery targets, so downtime and data loss stay within limits you decided in advance.
If a customer or a tender asks about continuity, yes. A small firm has fewer critical activities, so the analysis and the plans stay short. The self-assessment shows which gaps you have before you commit.
Yes. Show the certificate number and link to the verification page, or use the QR code. Describe it as a certificate issued by Zertify under licence from SICE, based on an online self-assessment.
08: Guide
Related pages
Check whether you pass ISO 22301
Answer 34 yes/no questions online and see where your business continuity stands.
Free and without registration.