ISO 22301 for IT companies: show customers you keep running

An IT company rarely sells software or hosting alone. It sells availability. The purchasing department of a bank, a hospital or a manufacturer knows that an outage at the supplier becomes an outage in its own business. So the supplier questionnaire contains questions such as: Do you have a business continuity plan? When was it last tested? What recovery time do you commit to?

A certificate answers these questions before they are asked. In a tender it replaces a page of free text. In a customer audit it gives the auditor a document number and a verification page instead of a folder of unchecked PDFs.

Managed service providers, SaaS vendors, software houses with support contracts and hosting companies meet this request most often. Customers further up the supply chain pass their own continuity obligations down to their IT suppliers, and ISO 22301 is the standard they point to.

• ISO 22301 at a glance

The standard describes a business continuity management system. It does not ask for a particular technology. It asks that you know which activities matter, how long you can be without them and how you get them back. Some terms carry a specific meaning in an IT company.

Critical activity

A service whose interruption hurts customers quickly, for example the production platform, the ticketing system, the backup service or 24-hour on-call support.

Recovery time objective (RTO)

The maximum time a service may be down. A customer portal might have an RTO of four hours, an internal wiki of three days.

Recovery point objective (RPO)

The maximum data loss you accept, measured in time. Hourly database snapshots mean an RPO of one hour.

Crisis organisation

Named people with deputies who decide, communicate and escalate when an incident exceeds normal operations: who calls the customers, who authorises a failover.

Dependency

Anything your service needs from outside: a cloud region, a data centre, a telecom line, a single key developer or a licensed component.

Exercise

A planned test of a continuity plan, such as restoring a customer database from backup on a clean system and measuring how long it takes.

The standard works from the risks of disruption in your own business. For an IT company the same few scenarios come back, and each one maps to a requirement.

Most IT companies already run parts of this: backups, monitoring, an on-call rota. Certification mostly means connecting these parts and writing down the decisions.

1. 01

   List services and rank them

   Take your service catalogue and rate each service by the damage per hour of downtime. Two or three services usually dominate. This is the business impact analysis.

2. 02

   Set RTO and RPO per service

   Compare the targets with what your setup delivers today. If the contract promises four hours and the restore takes nine, you have found the gap that matters.

3. 03

   Assess and treat the risks

   Record the scenarios from the table above, with likelihood, impact and the measure you chose. A second backup location or a standby database counts as a measure.

4. 04

   Write the plans

   One short plan per critical service: trigger, steps, responsible person, contact details. A plan that fits on two pages gets used during an incident.

5. 05

   Exercise and record the result

   Run a restore test or a failover once and keep the protocol with date, duration and findings. Repeat it each year and after major changes.

• ISO for small and medium businesses

You answer 34 yes/no questions online. Thirteen of them are must-meet questions and all need a yes. They are the core questions of the assessment, not a list of every requirement in the standard. Of the remaining 21 questions at least 14 must be answered yes. SICE reviews every assessment before the certificate is issued.

After you pass and pay, Zertify issues the certificate within 4 hours. It is based on the self-assessment, with no on-site audit. It carries a certificate number and a QR code, so a customer can check it on a public verification page.

The price is CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. The certificate is valid for 3 years. The yearly subscription can be cancelled at any time to the end of the current year in your customer account, and no account is needed to buy. If you certify a second or third standard, for example ISO 27001, a discount of 20% or 30% applies, also on the yearly fee.

• Start the free self-assessment
• See pricing
• ISO 22301 certificate

Some customers write into their contracts that a certification body must audit you on site. If yours does, check the wording before you decide. Where a questionnaire only asks for a valid, verifiable ISO 22301 certificate, the online route is enough to answer it.

The classic route with an on-site audit by a certification body takes weeks to schedule and involves an auditor visiting your premises. The guide below compares both routes so you can match them to what your customers require.

• Compare the certification routes
• Certification without an on-site audit