ISO 22301 for energy sector companies

Nobody notices energy supply until it stops. A municipal utility, an industrial customer or a grid operator that buys from you needs to know what happens to your service on the day your systems fail. The question appears as a line in the supplier questionnaire: is there a business continuity management system, and can you prove it?

The same line shows up in tenders from purchasing departments for metering services, billing software, maintenance contracts and fuel deliveries. ISO 22301 is the standard buyers name for this topic, so a certificate answers the question in one document.

Small firms further down the chain get it too. Installers, engineering offices, meter reading providers and software vendors for energy trading serve customers who must show that their own suppliers are covered. If you are one of those suppliers, the request is for you, however small your team is.

• ISO 22301 at a glance

The standard does not prescribe technology. It asks you to identify the activities that cannot stop for long and to plan for the events that would stop them. In the energy sector, the dependencies tend to look like this.

Control room outage

The grid control centre or plant control room is unusable after a fire, a power failure in the building or a cyberattack. The plan names a fallback site or manual procedure and who switches to it.

Metering and billing data

Meter readings or smart meter data stop arriving, or the billing system is down at month end. The plan defines how long invoicing may wait and how much data may be lost.

Fuel or material supply

A heating oil, pellet or spare parts supplier cannot deliver during a cold spell. The plan lists alternative suppliers and minimum stock levels.

Field service staff

Illness, a pandemic wave or a storm leaves too few technicians on call. The plan sets out who covers which duty and what work is postponed.

Telecom and IT links

The data line to a substation or a cloud service provider fails. The plan describes a second route or an offline way of working until the link returns.

The requirements sit mainly in clauses 6 and 8 of the standard: planning and operation. In practice, an energy company works through them in four steps.

1. 01

   Run a business impact analysis

   List your activities, for example dispatching, meter data processing, customer hotline, invoicing, maintenance call-outs. Rank them by the damage a stoppage causes after one hour, one day and one week.

2. 02

   Set RTO and RPO per activity

   The recovery time objective is how long an activity may be down. The recovery point objective is how much data you can afford to lose. A hotline may tolerate a day. Operational data from the control system may not.

3. 03

   Write the continuity plans

   One plan per critical activity, plus a crisis organisation: who decides, who informs customers, who is the deputy. Keep them short enough to use at night.

4. 04

   Exercise and correct

   Test the plan: a restore of the billing database, a call-out drill, a switch to the fallback control room. Record what failed and fix it. The record is your evidence.

A customer audit or a tender evaluation rarely asks for the whole system. It asks for a few documents that show the system exists and is used. The table shows what that looks like for an energy company.

You answer 34 yes/no questions online. Thirteen of them are must-meet questions and all must be answered yes. They cover the core of the assessment, not every requirement of the standard. Of the other 21 questions, at least 14 need a yes. SICE reviews every assessment before the certificate is issued. Zertify then issues it under licence from SICE, within 4 hours after you have passed and paid. No account is needed to buy.

The price is CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. The certificate is valid for 3 years and is confirmed each year by that short online re-audit. The subscription renews automatically and you can cancel it in your customer account at any time to the end of the current year. If you cancel, the certificate ends with the paid year. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. Combining standards earns 20% off for two and 30% off for three or more, also on the yearly fee.

Every certificate carries a number and a QR code on the PDF. Your customer scans it and lands on a public verification page. That saves the back and forth with the purchasing department.

• Start the free self-assessment
• See pricing
• Standard page ISO 22301

Read the tender text or the supplier questionnaire before you decide. Some buyers ask only for a verifiable ISO 22301 certificate. Others write that an on-site audit by a certification body is required. The Zertify certificate rests on an online self-assessment without an on-site audit. The classic route has that audit, takes longer and costs more.

If the wording is unclear, ask the buyer. One email settles it and saves you from buying the wrong certificate.

• Compare the certification routes
• Certification without an on-site audit