Frequently asked questions about ISO 22301
Here you find short answers about ISO 22301. Official sources: ISO 22301 , ISO 22313 guidance , and accreditation through the RvA (Dutch Accreditation Council) .
New to this? Start by reading what ISO 22301 is, decide who it is relevant for, and then follow the step-by-step plan.
ISO 22301 frequently asked questions at a glance
| Question | Short answer | Read more |
|---|---|---|
| Is ISO 22301 mandatory? | Usually not by law, but often relevant under contracts | Who is it for? |
| How long does certification take? | 4-12 months on average | Step by step |
| What does it cost? | Often €20,000 - €150,000+ in year 1 | Costs and timeline |
| How often is there an audit? | Stage 1, stage 2, yearly surveillance, recertification in year 3 | Audit process |
| What are BIA/RTO/RPO? | The core of prioritisation and recovery targets | BIA, RTO and RPO |
| ISO 22301 or ISO 9001 first? | Depends on your biggest risk: downtime or quality failures | ISO 22301 vs ISO 9001 |
Is ISO 22301 mandatory?
In short: usually not by law, but often by contract. Read the full explanation at Is ISO 22301 mandatory?, including what NIS2 means here.
For most organisations it is not legally required. In practice, it is often a contract requirement from customers or a strong requirement from enterprise procurement.
How long does ISO 22301 certification take on average?
Usually 4 to 12 months, depending on scope, process complexity, supply chain dependencies and internal capacity.
What does ISO 22301 cost roughly?
In year 1, often €20,000 to €150,000+, depending on size, testing intensity and external support.
How often are you audited under ISO 22301?
After initial certification, there is usually a yearly surveillance audit, and recertification in year 3.
Is ISO 22301 the same as disaster recovery?
No. Disaster recovery is part of a broader continuity approach. ISO 22301 covers governance, BIA, strategy, testing and improvement.
What is the difference between ISO 22301 and ISO 27001?
ISO 22301 focuses on continuity during disruptions. ISO 27001 focuses on information security. Many organisations combine both.
For another popular comparison, you can also look at ISO 22301 vs ISO 9001.
Which documents are crucial for the ISO 22301 audit?
Often, among others:
- BIA outcomes and prioritisation;
- documented RTO/RPO for each critical process;
- continuity and crisis plans;
- test results with follow-up;
- internal audit and management review records.