ISO 22301 certification confirms that a business runs a business continuity management system (BCMS) that meets the international standard ISO 22301:2019. In simple words, it shows customers and lenders that you know which work must never stop, how quickly you will restart it after a disruption, and that you have tested your plans. In India the standard is published by the Bureau of Indian Standards as IS/ISO 22301:2019, and certification is voluntary.
Who needs ISO 22301 certification?
No law makes ISO 22301 compulsory for an ordinary business. It is usually asked for by someone you supply to. Common cases are:
- IT, software and BPO companies serving Indian or foreign clients
- fintech, payment and other businesses that support banks or regulated entities
- manufacturers and logistics firms that are part of a larger supply chain
- hospitals, data centres and firms handling outsourced accounts or payroll
- businesses bidding for tenders that list business continuity as a requirement
The standard is written for organisations of every type and size, so a small office can be certified as easily as a large group.
What does the standard ask a business to do?
ISO 22301 follows the same clause structure as ISO 9001 and ISO 27001. The main work is:
- Fix the scope — which offices, services and activities are covered.
- Business impact analysis (BIA) — for each key activity, how long it can stop before the damage becomes unacceptable, the target time to restart it (recovery time objective, RTO) and how much data can be lost (recovery point objective, RPO).
- Risk assessment — what could stop those activities: fire, flood, power or internet failure, a cyber attack, a key supplier failing, or loss of key staff.
- Strategies — backup site or work from home, cloud backups, alternate suppliers, cross-trained staff.
- Plans and procedures — who does what, in which order, with contact lists and authority to decide.
- Exercises — test the plans, record what went wrong and fix it.
- Review — internal audit and management review of the whole system.
Since Amendment 1 of 2024 (published by ISO on 23 February 2024), the business must also decide whether climate change is a relevant issue for it, for example flood or heat risk to its premises or transport.
Step-by-step ISO 22301 certification process
| Step | What happens | Who does it |
|---|---|---|
| 1. Gap check | Compare current practices with the standard | Business with its consultant |
| 2. Build the BCMS | Policy, BIA, risk assessment, plans | Business with its consultant |
| 3. Exercises | Test at least the key plans and record results | Business |
| 4. Internal audit and management review | Check the system before the external audit | Business |
| 5. Stage 1 audit | Certification body reviews documents and readiness | Certification body |
| 6. Stage 2 audit | Certification body checks the system is working | Certification body |
| 7. Certificate | Issued after any nonconformities are closed | Certification body |
| 8. Surveillance | Audits normally every year during the three-year cycle | Certification body |
ISO itself does not issue certificates. Choose a certification body accredited for ISO 22301 by an accreditation body that is a member of the International Accreditation Forum (IAF), and check the certificate on the accreditation body's website after it is issued.
How long does ISO 22301 certification take?
Time depends on the size of the scope and how much is already in place. A small office with one or two services and existing backups needs far less work than a multi-site operation. The step that takes longest is usually the business impact analysis, because it needs inputs from the people who actually run each activity. Allow time for at least one exercise before the stage 2 audit — auditors expect evidence that plans have been tested, not just written.
Documents required for ISO 22301 certification
Business documents (for the application):
- PAN of the business
- GST certificate or Udyam (MSME) registration
- incorporation certificate, MOA and AOA for a company, or partnership deed for a firm
- address proof of the sites to be covered
- a list of services and activities within the scope
BCMS documents (prepared during implementation):
| Document | Purpose |
|---|---|
| Business continuity policy | Top management's commitment and objectives |
| Scope statement | Sites, services and any exclusions |
| Business impact analysis | Recovery time and data loss targets |
| Risk assessment | Threats to prioritised activities |
| Business continuity plans | Response and recovery steps |
| Exercise reports | Proof that plans were tested |
| Internal audit and management review records | Proof that the system is checked |
ISO 22301 vs ISO 27001: which one do you need?
ISO 27001 is about protecting information. ISO 22301 is about keeping the business running, which covers people, premises, suppliers and technology. A customer worried about data leaks will ask for ISO 27001; one worried about you stopping work will ask for ISO 22301. Many IT and BPO businesses hold both and run them as one integrated system. You can read more about related standards on our ISO 9001:2015 certification page.
How Indian Salahkar can help
Indian Salahkar works with businesses in Agra and across India on ISO certifications, from the gap check and documentation to coordination with an accredited certification body. The documents list, process and plans are on our ISO 22301 business continuity certification page.
Frequently asked questions
What is ISO 22301 certification?
It is an independent audit confirming that a business runs a business continuity management system (BCMS) meeting ISO 22301:2019. The system shows how critical activities continue, or restart within agreed times, after a disruption.
Is ISO 22301 compulsory in India?
No. The Bureau of Indian Standards has adopted it as IS/ISO 22301:2019 and lists certification as voluntary. Customers, banks, outsourcing contracts and some tenders may still ask for it.
Can a small business or MSME get ISO 22301?
Yes. The standard applies to organisations of every type and size. A small business can keep the scope narrow, for example one office and its key services, and keep documents simple.
How long is the certificate valid?
Usually three years, with surveillance audits normally once a year. A recertification audit is done before the three years end.
What is the difference between ISO 22301 and ISO 27001?
ISO 27001 protects information. ISO 22301 keeps the whole business running, covering people, premises, suppliers and technology. Many IT and BPO firms hold both, and the two share the same clause structure.
Sources: services.bis.gov.in · services.bis.gov.in
General information, not professional advice. Rules change — check the current position before acting.
