ISO 22301
Tested business continuity. A plan that works when ransomware, a supplier outage or a fire hits.
Business continuity
- What is at stake
- A tested plan for ransomware and outages
Who it applies to
- Companies with critical operations
- Providers with demanding SLAs
- Entities under NIS2 or DORA
Typical timeline
3 to 5 months
Business continuity
In detail
Keep running when everything fails.
ISO 22301 defines a Business Continuity Management System (BCMS). Its goal is for the organisation to keep delivering critical services through any disruption: a cyberattack, a fire, a cloud provider outage or a pandemic.
The starting point is the business impact analysis (BIA): which processes are critical, how long they can be down (RTO) and how much data can be lost (RPO). Strategies and plans are designed from there.
What separates a useful plan from a decorative one is exercising. We test plans with realistic drills so that on the day it matters, people know what to do.
Real scenarios
Scenarios we plan for.
Total ransomware
How do you invoice, produce and serve customers for two weeks with no systems? We plan it and rehearse it.
Main supplier outage
If your cloud or SaaS ERP is down for a full day, which processes continue and which stop?
Loss of a site
Remote work, alternative sites and distribution of critical roles across teams.
What you get
What you will have at the end.
- Business impact analysis
- Disruption risk assessment
- Continuity strategies
- Continuity and ICT recovery plans
- Exercise programme
- Certification readiness
How we engage
Three ways to approach it.
Gap analysis
Know exactly what is missing.
- 2 to 3 weeks
- Prioritised report
- Fixed quote
- Most chosen
Full implementation
We take you to the audit.
- Policies and controls
- Evidence prepared
- Audit support
Maintenance
Stay compliant year after year.
- Annual internal audit
- Change tracking
- Support with the auditor
ISO
What we focus on
- 01
Business impact analysis
- 02
Recovery strategies
- 03
Exercises and drills
- 04
Crisis management and communication
ISO 22301
How we work
- 1
Diagnosis
Gap analysis against the framework, prioritised by risk.
- 2
Plan
A roadmap with owners, budget and schedule.
- 3
Implementation
Policies, technical controls and evidence, with your team.
- 4
Audit
Internal pre-audit and support in front of the auditor.
FAQ
Frequently asked questions
How much does preparing for ISO 22301 cost?
It depends on scope and starting point. After the first call we give you a fixed quote, no surprises.
Can I combine it with other frameworks?
Yes. We reuse shared controls so each additional certification costs far less.
Is it the same as a disaster recovery plan?
No. ICT recovery is one part. Continuity also covers people, premises, suppliers and communication.
How often should we exercise?
At least once a year, and whenever processes, systems or suppliers change significantly.
Services
Next step
Shall we talk about your case?
30 minutes with a partner, not a salesperson. No commitment.