ISO 22301 cost: what you pay and where

The certificate itself is a small part of the bill. The money goes into four blocks, and most quotes only show one or two of them.

All ranges on this page are indicative. Real quotes depend on headcount, number of sites and the scope of your critical activities. If you go the classic route, ask at least two certification bodies for a written quote.

Consulting

Optional, but common for a first BCMS. Consultants run the business impact analysis with you and draft the plans.

Certification audit

The fee of the certification body for the on-site audit, plus travel and report.

Internal effort

Hours of your IT lead, operations manager and management. Rarely budgeted, often the largest block.

Recurring fees

Yearly audits and the larger audit at the end of the three-year cycle.

• Guide: what ISO certification costs

In the classic route a certification body sends auditors to your premises. They review your documentation in one step and your running system in a second. You pay per audit day, and the number of days grows with staff and sites.

The table puts the cost items next to the Zertify route. Figures for the classic route are indicative ranges for a small or medium business, excluding VAT.

Nobody invoices this part, so it is easy to forget. For a small or medium business, plan for several weeks of part-time work spread over the people who know your processes. This is an indicative planning figure, not a quote.

The work is the same whichever route you choose. Where the routes differ is how much of it you must document up front for an auditor on site.

1. 01

   Business impact analysis

   List your activities, rank them by damage per hour of downtime and name the owners.

2. 02

   Recovery objectives

   Set a recovery time objective (RTO) and a recovery point objective (RPO) for each critical activity.

3. 03

   Risk assessment

   Assess the risks of disruption, from IT outage to supplier failure, and decide how to treat them.

4. 04

   Plans and crisis organisation

   Write the continuity plans and fix who decides, who informs and who restarts what.

5. 05

   Exercises

   Test the plans, record what failed and correct it. This repeats every year.

A certificate from the classic route is valid for three years. In between, the certification body returns for a surveillance audit each year. The audit at the end of the cycle, the recertification, covers more ground than a surveillance visit and costs more.

Add the cost of keeping the system alive: exercises, updates to the impact analysis after a reorganisation, and the hours of whoever owns the system. Auditors look for evidence that you exercised and improved, so these hours cannot be skipped.

Zertify charges CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. The certificate is valid for 3 years. The yearly fee is an automatic subscription that you can cancel at any time in your customer account, effective at the end of the current year. If you cancel, the certificate ends with the paid year.

You start with an online self-assessment of 34 yes/no questions. Thirteen are must-meet questions and all need a yes. They are the core questions of the assessment, not every requirement of the standard. Of the other 21 questions, at least 14 need a yes. SICE reviews every assessment, and Zertify issues the certificate under licence from SICE within 4 hours after you pass and pay. No on-site audit takes place, and you do not need an account to buy.

Every certificate carries a number and a QR code on the PDF. Your customer's purchasing department can check it on the public verification page. If you certify against two standards, you get 20% off, and 30% off with three or more. The discount also applies to the yearly fee.

• ISO 22301 certificate at Zertify
• Prices and multi-standard discount
• Start the free self-assessment

Many requests come as a line in a supplier questionnaire or a tender: certificate required, number to be stated. A verifiable certificate with a QR code answers that line at a fraction of the classic cost.

Some contracts go further. A bank or an outsourcing client may write into its terms that an on-site audit by a certification body is required. Read the clause before you decide, or ask the customer directly. If the clause is there, the classic route is the one to budget for.

• Compare the certification routes
• Certification without an on-site audit