ISO 22301:2019
ISO 22301 certification online: Business Continuity Management by self-assessment
With the ISO 22301 certificate from Zertify you show your management system to customers and purchasing teams. ISO 22301 certification works by self-assessment, with no on-site audit. It costs CHF 749 in the first year, then CHF 499 per year with an online re-audit.
- Questions
- 34
- Mandatory requirements
- all 13
- Other questions
- min. 14 of 21
- Validity
- 3 years
- First-year price
- CHF 749
01: Overview
What is ISO 22301?
ISO 22301:2019 sets the requirements for a business continuity management system (BCMS). A business knows its critical activities, limits downtime and data loss, and has tested plans for IT outages, supply shortages, fires or pandemics. When something fails, it can keep delivering.
02: Benefits
What it gives you
- Shorter downtime during disruptions and crises
- Clear priorities from the business impact analysis
- Proof of delivery capability to customers and partners
- A stronger position in tenders and supplier audits
- A rehearsed crisis team with clear roles
- Dependencies on suppliers and IT under control
03: Who it is for
Who is ISO 22301 for?
- IT and cloud service providers
- Suppliers to banks and insurers
- Logistics and transport
- Manufacturers in supply chains
- Healthcare and energy supply
- Outsourcing and business process service providers
04: Requirements
Key requirements
Business impact analysis with prioritised activities
Set recovery time objectives (RTO) and recovery point objectives (RPO)
Assess and treat the risks of disruption
Implement business continuity strategies and solutions
Document business continuity plans and the crisis organisation
Exercise and improve the plans regularly
05: Demand
Who asks for ISO 22301?
ISO 22301 is asked for where customers depend on your ability to deliver and want to know what happens during an outage.
- Corporate customers and outsourcing contracts
- Anyone who outsources processes, IT or services often asks the provider for evidence of continuity plans, recovery times and exercises.
- Financial sector and critical service providers
- Banks and insurers must demonstrate operational resilience, in Switzerland for example under FINMA Circular 2023/1, in the EU under DORA. They pass these expectations on to their service providers.
- Supply chains in IT, logistics and production
- Suppliers whose outage would stop entire production lines or services are increasingly asked about their continuity planning in supplier audits.
06: Cost
What does ISO 22301 cost? Audit, consulting or self-assessment
With ISO 22301, the number of sites, critical processes and the scope of exercises set the price. For a company with 10 to 50 employees, expect roughly these figures.
| Route | Indicative range | What is behind it |
|---|---|---|
| Accredited audit | CHF 6,000 to 12,000 initial audit, then 3,000 to 5,500 per year | The price follows headcount, sites and the complexity of critical activities. The auditor will want to see exercise reports and a current BIA. |
| Consulting and implementation | CHF 12,000 to 35,000 one-off | Business impact analysis, strategies, plans and a first exercise. The BIA and alignment with IT are usually the biggest item. |
| Zertify self-assessment | CHF 749 in year 1, then CHF 499 per year | You check whether BIA, recovery times, strategies, plans and exercises are demonstrably in place. A self-assessment does not replace a practical exercise of your plans. |
All amounts are non-binding indicative ranges for Swiss SMEs, not quotes. Only the providers' own quotes are binding.
07: Duration
How long does ISO 22301 take?
For ISO 22301, a BIA, plans and at least one exercise must be in place, so the accredited route usually takes six to twelve months.
| Phase | Accredited | Zertify |
|---|---|---|
| BIA, plans and exercise | 4 to 8 months for business impact analysis, strategies, plans and a first exercise | None. You answer the questions based on where you stand today |
| Assessment | Stage 1 and 2, plus review of exercise reports and the crisis organization | About 25 to 35 minutes online, scored immediately |
| Certificate | Release after 2 to 6 weeks, then annual surveillance audits | PDF with QR verification within 4 hours |
08: Sample questions
Sample questions from the ISO 22301 assessment
Four of 34 questions from the catalogue, and why they count.
Has a business impact analysis (BIA) been carried out that prioritizes the activities supporting your products and services?
The BIA is the foundation of the BCMS. Without it you do not know which activities must be running again first.
Is it defined for each prioritized activity how long an outage can be tolerated at most (MTPD) and within what time it must resume (RTO)?
Recovery times make continuity measurable. Only with them can you check whether a solution is fast enough.
Are the business continuity plans documented with tasks, resources and contact details, and accessible to those involved in an emergency?
A plan only helps if it is at hand in an emergency, even without access to the office, network or email.
Are the business continuity plans and solutions exercised regularly according to an exercise programme, with results recorded in reports?
Plans that are never exercised often fail on details such as outdated phone numbers. Exercises reveal such gaps beforehand.
09: Assessment
How the assessment works
The assessment has 34 yes/no questions, online and at your own pace. 13 of them are mandatory requirements of the standard and must all be answered yes. Of the other 21 questions you need at least 14 yes.
| The questions fall into these topics: | Questions | Mandatory |
|---|---|---|
| Context of the organization | 4 questions | 1 |
| Leadership | 3 questions | 1 |
| Planning | 3 questions | 1 |
| Support | 4 questions | 1 |
| Business impact analysis and risk assessment | 7 questions | 2 |
| Strategies and solutions | 2 questions | 1 |
| Plans and procedures | 4 questions | 2 |
| Exercises and evaluation of capabilities | 2 questions | 1 |
| Performance evaluation | 3 questions | 2 |
| Improvement | 2 questions | 1 |
10: Price
Price and validity
First-year price
CHF 749
- From year 2
- CHF 499 per year
- Validity
- 3 years
Your customer requires an audit or an accredited certification? Clarify requirements
Included in the price
- Online assessment with 34 questions
- Certificate as PDF, issued under licence from SICE
- QR code on the PDF and a public verification page
- 3 years of validity
- Yearly online re-audit
- Support by email
The verification page shows the status, standard and validity of every certificate. Read more in the FAQ
See the sample and assessment methodChecklist
ISO 22301:2019 checklist by email
All 34 questions of the ISO 22301 self-assessment as a PDF to tick off, ordered by topic. Free, by email.
11: More standards
More standards
Many companies combine several standards. Two or more earn a discount.
- ISO 27001:2022: View standard
Information Security Management
Information security during disruption and ICT readiness are anchored in both standards, and risk assessment and management system can be run together.
from CHF 849
- ISO 20000-1:2018: View standard
IT Service Management
IT service providers link service continuity and availability with the BCMS, and incident and recovery processes interlock.
from CHF 799
- ISO 9001:2015: View standard
Quality Management
Structure, audits and management review are built identically, so an existing QM system saves a lot of set-up work.
from CHF 599
13: Questions
Frequently asked questions about ISO 22301
ISO 22301 certificate within 4 hours.
The assessment is free. You pay only once you have passed.
The verification page shows the status, standard and validity of every certificate.