ISO 22301 step by step
From zero to an ISO 22301 certificate. This step-by-step plan takes you through the full process. Use ISO 22313 as practical guidance, and check your certification body through the RvA (Dutch Accreditation Council) .
A realistic process usually takes 4-12 months. If you start with mature risk management and clear process owners, it goes faster.
Overview of the ISO 22301 process
| Phase | Guide duration | Key result | Read more |
|---|---|---|---|
| 1. Scope and governance | 2-4 weeks | Clear boundaries and ownership | Who is it for? |
| 2. BIA and risk assessment | 3-8 weeks | Critical processes and impact limits | BIA, RTO and RPO |
| 3. Continuity strategy | 4-10 weeks | A recovery strategy for each critical process | Requirements of the standard |
| 4. Planning, testing, training | 6-16 weeks | Proven effectiveness in exercises | Audit process |
| 5. Stage 1 + stage 2 | 4-8 weeks | Certification decision | Costs and timeline |
Tip: The business impact analysis (step 2) determines the rest of your process. Invest enough time here. Once you know which processes are truly critical and what acceptable recovery times are, the next steps fall into place.
The 8 steps to ISO 22301 certification
Step 1: Define scope, purpose and ownership
Decide which services, locations and processes fall within scope. Also record which management roles hold final responsibility.
Action: Link your continuity objectives to concrete business objectives (revenue, SLAs, customer commitments).
Step 2: Carry out the BIA and set RTO/RPO
Carry out a business impact analysis (BIA):
- what is business-critical;
- what is the maximum tolerable downtime;
- how much data loss is acceptable;
- which dependencies are crucial.
Action: Formally record the RTO/RPO decisions for each critical process.
Step 3: Design the continuity strategy
Choose a recovery strategy for each scenario:
- fallback to an alternative location;
- redundancy in systems and suppliers;
- prioritising the order of recovery;
- the minimum capacity required.
Action: Make explicit what you will and will not secure within budget.
Step 4: Draft the continuity plans
Translate the strategy into plans you can carry out:
- incident and crisis management plan;
- process recovery plans;
- communication and escalation protocols;
- supplier agreements for continuity.
Action: Make sure the plans are short, role-based and immediately usable. Use the example structure from the business continuity plan as your basis.
Step 5: Exercise, test and improve
ISO 22301 requires proven effectiveness, not just documents:
- tabletop exercises;
- technical recovery tests;
- evaluation and corrective and preventive actions (CAPA).
Action: Keep test results and follow-up as audit evidence.
Step 6: Internal audit and management review
Carry out a full internal audit of scope, evidence and effectiveness. Discuss the outcomes in the management review, with deadlines and ownership.
Action: Close critical findings before the external audit starts.
Step 7: Stage 1 audit
The auditor assesses whether the BCMS design and documentation are ready for audit.
Action: Address the stage 1 findings with demonstrable corrections.
Step 8: Stage 2 audit
The auditor assesses how things work in practice: processes, tests, response and evidence.
Action: Make sure process owners can clearly explain their decisions and evidence.
ISO 22301 timeline per type of organisation
Small team
Total duration: 4-7 months
- Scope + BIA: 4-6 weeks
- Strategy + plans: 6-8 weeks
- Testing + audit preparation: 6-10 weeks
- External audit: 4-6 weeks
Common mistakes in ISO 22301 implementation
| Mistake | Result | Better alternative |
|---|---|---|
| Scope too broad in phase 1 | The process becomes slow and expensive | Start with critical processes |
| BIA without firm impact criteria | Weak prioritisation | Work with measurable impact thresholds |
| Plans not tested | Insufficient audit evidence | Plan regular exercises |
| Insufficient management involvement | Decisions stall | Governance with clear owners |
| Supplier continuity forgotten | Recovery stays dependent on third parties | Tighten contracts and fallback scenarios |