ISO 22301 Business Continuity
Is ISO 22301 mandatory for your business?
No general rule requires a company to hold an ISO 22301 certificate. It becomes necessary in practice when a customer, a tender or a supply chain asks for proof. If that request is already on your desk, you can obtain the certificate online.
01: Short answer
Is ISO 22301 mandatory by law?
No. ISO 22301:2019 is an international standard for business continuity management systems. It is published by ISO, not by a legislator, and nobody is obliged to apply it or to be certified against it.
Certification is a voluntary step. A company decides to show that it knows its critical activities, has set limits for downtime and data loss, and has tested plans for an IT outage, a failed supplier, a fire or a pandemic.
Some sectors have continuity rules of their own, set by a regulator or written into a contract. Those rules are separate from the standard. If one applies to you, read it directly and do not assume that a certificate replaces it.
02: In practice
When ISO 22301 becomes a de facto requirement
The pressure rarely comes from the state. It comes from the party that pays you. These are the situations in which the certificate turns from optional to expected.
- Customer contract
- A bank, an insurer or a large corporate writes continuity requirements into the contract or the outsourcing agreement. The certificate is the quickest proof that you meet them.
- Supplier questionnaire
- The purchasing department asks whether you hold ISO 22301. A 'no' invites follow-up questions and sometimes a customer audit at your premises.
- Tender
- Public and private tenders list certificates as selection criteria or award points. A missing certificate can take your bid out of the evaluation before anyone looks at the price.
- Supply chain
- A manufacturer or logistics firm inside a just-in-time chain is asked how it keeps delivering when a plant or a system fails.
- Industry expectation
- In IT and cloud services and in business process outsourcing, a continuity certificate is an expected line in the offer, next to the information security certificate.
03: Who is asked
Which businesses get asked for ISO 22301 most often
The request looks different depending on where you sit in the chain. The table shows the typical pattern.
| Business type | Who asks | What they want to see |
|---|---|---|
| IT and cloud service providers | Business customers and their IT security teams | Proof of continuity management for hosted services |
| Suppliers to banks and insurers | Vendor management and outsourcing teams | Certificate or tested plans with defined recovery times |
| Logistics and transport | Shippers and industrial customers | Evidence that deliveries continue after an outage |
| Manufacturers in supply chains | Purchasing department of the customer | Answers in the supplier questionnaire, backed by a certificate |
| Healthcare and energy supply | Operators and contracting bodies | A documented crisis organisation and tested plans |
| Outsourcing and process service providers | Risk management of the client | RTO and RPO for each service you run |
04: Content
What a customer expects behind the certificate
A buyer who asks for ISO 22301 wants to see that six things exist in your company and are in use.
Business impact analysis
List your activities and rank them by how fast the business suffers when they stop.
Recovery objectives
Set an RTO, the time until an activity runs again, and an RPO, the amount of data you can afford to lose.
Risk assessment
Assess what could interrupt the activities and decide how to treat each risk.
Continuity strategies
Choose solutions that meet the objectives, such as a second site, a backup supplier or remote working.
Plans and crisis organisation
Document who decides, who calls whom and which steps restore each activity.
Exercises
Test the plans regularly, record the results and correct what failed.
The standard follows the usual structure of clauses 4 to 10, from context and leadership to performance evaluation and improvement. The operational core sits in clause 8.
05: Zertify
How Zertify fits in when a customer asks
Zertify issues ISO certificates on the basis of an online self-assessment, without an on-site audit. For ISO 22301 you answer 34 yes/no questions. Thirteen are must-meet questions and all of them need a yes. Of the other 21, at least 14 must be yes. These are the core questions of the assessment, not every requirement of the standard.
The certificate is issued by Zertify under licence from SICE, the Swiss Institute of Certification and Education, and SICE reviews every assessment before it is issued. After you pass and pay, the PDF arrives within 4 hours. It carries a number and a QR code, and anyone can check it on the public verification page. A short online re-audit confirms the certificate every year.
The price is CHF 749 (€749) in the first year, then CHF 499 (€499) per year including the yearly online re-audit. The certificate is valid for 3 years. It is an automatic yearly subscription. You can cancel it at any time in your customer account to the end of the current year, and the certificate then ends with the paid year. Two standards earn a 20% discount, three or more 30%, also on the yearly fee. Prices include 8.1% Swiss VAT for customers in Switzerland and Liechtenstein. You do not need an account to buy.
06: Next steps
How to get certified quickly when a customer is waiting
Start with the customer's wording. 'ISO 22301 certified' and 'certified after an on-site audit' are different requests. Ask the purchasing department or the vendor manager whether a certificate based on a self-assessment, with public verification, is acceptable.
If it is, gather what the questions touch: your list of critical activities, the recovery times, the risk assessment, the plans and the record of your last exercise. Then take the self-assessment online. A 'no' on a must-meet question shows which topic still needs work before you go further.
If the customer insists on the classic route with an on-site audit by a certification body, plan for more time and a larger budget. The guide on certification routes compares both ways.
07: FAQ
Questions about ISO 22301 and obligation
No. There is no general obligation to hold an ISO 22301 certificate. The standard is voluntary. Your customers or your sector may still expect it.
Yes, as a condition of a contract or an order. That is a commercial requirement, not a legal one. You decide whether to meet it, and the answer usually depends on how much business is at stake.
Suppliers to banks and insurers are regularly asked to prove their continuity management. Whether the customer names ISO 22301 specifically and which route it accepts is written in its questionnaire or contract. Read that wording first.
Only if the tender documents list it as a requirement or an award criterion. Check the selection criteria and the deadline for submitting proofs. If a certificate is asked for, it must be in hand when you submit.
No. The certificate confirms that the plans and the management system exist. You still have to keep the plans current and exercise them, because a customer or a re-audit will ask for the latest results.
08: Guide
Related pages
Do you need an ISO 22301 certificate for a customer?
Take the self-assessment with 34 questions and see whether you meet the requirements today.
Free and without registration.