ISO 22301 duration: from months to a few hours

On the classic route, an on-site audit by a certification body, a small or medium business needs about 5 to 12 months from first preparation to certificate. This is an indicative range. The spread depends on how much of a business continuity management system you already run.

With Zertify the assessment takes about an hour. There is no audit date to book and no auditor calendar to wait for. The time you spend beforehand depends on one thing only: whether your critical activities, recovery targets and plans already exist.

The durations below are indicative. They assume a company of roughly 20 to 250 employees with one or two sites. Waiting for an auditor slot adds weeks between the phases.

1. 01

   Preparation

   You define the scope, run a gap analysis and carry out the business impact analysis. Critical activities are ranked, RTO and RPO are set, and disruption risks are assessed. Indicative: 6 to 16 weeks.

2. 02

   Documentation and exercises

   Continuity plans, strategies and the crisis organisation are written down. Each plan is exercised at least once and the result is recorded before the audit. Indicative: 6 to 12 weeks, partly in parallel with preparation.

3. 03

   Stage 1 audit

   The auditor reviews your documents and checks that you are ready for the full audit. This takes 1 to 2 days. Findings are fixed afterwards, which takes 2 to 6 weeks.

4. 04

   Stage 2 audit

   The auditor checks on site whether the system works in practice. Plan 2 to 5 days depending on size. Report, corrective actions and the certification decision add 2 to 6 weeks.

The table shows where the time goes. The preparation work is the same on both routes if you start without a business impact analysis. What disappears with Zertify is everything that depends on an auditor's calendar.

Business continuity needs input from outside the quality or IT department. Four things cause most of the delay.

Business impact analysis

Every department head has to say which activities cannot stop and for how long. Interviews and workshops take weeks to schedule.

Exercises

A plan counts only once it has been tested. A tabletop exercise or a failover test needs a date on which everyone involved is available.

Supplier and IT dependencies

A recovery time objective of four hours means little if your cloud provider's contract promises recovery in two days. Checking contracts and closing such gaps takes time.

Management approval

Under clause 5, Leadership, top management must approve the policy and objectives. Where decisions wait for the next board meeting, the project waits too.

The online self-assessment for ISO 22301 has 34 yes/no questions. 13 of them are must-meet questions and all 13 need a yes. Of the remaining 21, at least 14 need a yes. Plan for about an hour. The questions cover the core of the assessment, not every requirement of the standard.

SICE reviews every assessment before the certificate is issued. Once you have passed and paid, Zertify issues the certificate within 4 hours under licence from SICE. The PDF carries a certificate number and a QR code that leads to the public verification page. A short online re-audit confirms the certificate each year.

The price is CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. The certificate is valid for 3 years. You can cancel at any time in your customer account, effective at the end of the current year, and you need no account to buy.

If a must-meet question is a no, the gap is real. Close it first, for example by running the business impact analysis or exercising a plan, and then pass the assessment.

• ISO 22301 at Zertify
• Pricing
• Start the free self-assessment

If a supplier questionnaire or a tender gives you a few weeks, the classic route will not get you there. The Zertify route fits such a deadline because the certificate arrives within 4 hours after you pass and pay.

If a customer's purchasing department writes into its requirements that the certificate must come from an on-site audit, ask for the exact wording before you decide. Most requests ask for a valid ISO 22301 certificate that the customer can verify. The guide on the certification routes shows how the two compare.

• Compare the certification routes
• Certification cost explained