ISO 22301 process: from self-assessment to certificate

Nobody visits your premises and no auditor needs a date in your diary. The sequence is the same for every business.

1. 01

   Start the self-assessment

   Open the assessment for ISO 22301. It is free and needs no registration.

2. 02

   Answer 34 questions

   Each question is a yes or no. They cover the business impact analysis, recovery objectives, risk treatment, continuity plans and exercises.

3. 03

   Reach the pass mark

   All 13 must-meet questions need a yes. Of the other 21 questions, at least 14 need a yes.

4. 04

   Pay and enter your company details

   You pay the first-year fee and give the legal name that will appear on the certificate. You do not need an account.

5. 05

   SICE reviews the assessment

   SICE checks every assessment before a certificate is issued. The certificate follows within 4 hours after passing and payment.

6. 06

   Download and use the certificate

   You receive a PDF with a certificate number and a QR code. Anyone can check it on the public verification page.

• Start the free self-assessment
• How it works

The questions ask about things that exist in your business, not about intentions. Answer yes only if you can show the document, the record or the person responsible.

Business impact analysis

A list of your activities, ranked by how fast a failure would hurt. Order processing may rank well above internal reporting.

RTO and RPO

The recovery time objective is how long an activity may stand still. The recovery point objective is how much data you can lose, measured in time.

Risk assessment

Disruption scenarios such as an IT outage, a failed supplier, a fire or a pandemic, each with a decision on how you treat it.

Continuity plans

Written steps for each critical activity, plus a crisis organisation with named people and deputies.

Exercises

Records that you tested the plans, for example a restore from backup or a call-tree test, and what you changed afterwards.

• ISO for small and medium businesses

The 13 must-meet questions are the core of the assessment. They are not a copy of every requirement in ISO 22301:2019. A single no among them means the assessment is not passed.

The other 21 questions give you some room: you can answer no to seven of them and still pass. Clause 8 (operation) carries most of the continuity work in the standard, so expect many of your answers to depend on the business impact analysis, the strategies and the plans you already maintain.

• ISO 22301 requirements

Zertify issues the certificate under licence from SICE, the Swiss Institute of Certification and Education. SICE reviews each assessment before issue. Zertify runs the platform, the payment and the verification page.

The price is CHF 749 in the first year, then CHF 499 per year including the yearly online re-audit. For customers in Switzerland and Liechtenstein, the 8.1% Swiss VAT is included. If you certify a second standard you get 20% off, from a third standard 30%, and the discount also applies to the yearly fee.

• The ISO 22301 standard page
• Prices
• Start the self-assessment

Every certificate carries a number and a QR code. A purchasing department or a customer auditor scans the code on your PDF, or types the number into the verification page, and sees whether the certificate is valid.

The certificate is valid for 3 years. Each year a short online re-audit confirms it, and the re-audit is part of the yearly fee. Billing is an automatic yearly subscription. You can cancel at any time in your customer account, effective at the end of the current year. The certificate then ends with the paid year.

• General questions

The classic route means an on-site audit by a certification body. The figures for that route below are indicative and vary with company size, number of sites and the body you choose.

• Compare the certification routes
• Certification without an on-site audit
• Certification cost