ISO 22301: keep running when systems or sites fail
ISO 22301 is the international standard for business continuity: keeping your critical services running through an outage, a cyber attack or the loss of a site. The standard suits firms that clients depend on every day. We implement your continuity system with your team; an accredited certification body audits and issues the certificate.
50+ ISO 27001 and 22301 implementations
Who asks for it, and what it shows them
One certificate. Many audiences read it.
- Board and shareholders“If we are hit, how long until we are back in business?”A tested, documented plan for disruption. the Cyber Security Agency found business disruption was the top impact of incidents, reported by 48% of businesses.CSA, read 12 Oct 2026
- Management“Do we respond to a crisis systematically, or improvise?”ISO says a business continuity management system gives a systematic response to crises.ISO, read 12 Oct 2026
- Partners and multinational clients“(A bank or insurer client) Can you meet our recovery targets in a disruption?”Evidence you can meet the measurable recovery targets MAS expects financial institutions to set for third parties.Allen & Gledhill (summary of MAS guidelines), read 12 Oct 2026
- Insurers“Do you have a business continuity plan that covers cyber events?”Insurer proposal forms ask this directly; an ISO 22301 system answers it.MSIG Insurance (Singapore), read 12 Oct 2026
- Customers“Will you still be able to serve us if something goes wrong?”ISO says the standard increases stakeholder trust in your resilience.ISO, read 12 Oct 2026
MAS expects financial institutions to bind third parties to specific, measurable recovery targets. A supplier with no continuity management has nothing to show against those terms.
Allen & Gledhill (summary of MAS guidelines), read 12 Oct 2026Who it is for
Firms whose clients or regulators expect continuity, such as logistics, healthcare, finance, technology and facilities services. Operations and risk leads get a business continuity management system (BCMS) with impact analysis, plans and tested recovery.
Who does what
- You
You name a project lead, agree the critical services and take part in exercises.
- Us: we prepare you
We implement: business impact analysis, risk assessment, continuity plans, exercises, internal audit and management review.
- Independent body: audits and certifies
An accredited certification body audits your continuity management system and, if you conform, issues the certificate.
What you get
Deliverables mapped to what the assessor tests.
- A business impact analysis and recovery targets
- Continuity plans, tested in an exercise
- Records mapped to the ISO 22301 clauses
- Internal audit and management review records
What drives the time and the effort
- How many critical services and sites are in scope
- How many systems and suppliers those services depend on
- Existing plans, backups and recovery tests
- How many exercises you need before the audit
- The certification body’s audit fee, charged by that body
Our track record: 50+ ISO 27001 and 22301 implementations.
Common questions
What is ISO 22301?
The international standard for business continuity management, published by the International Organization for Standardization (ISO). The standard asks you to know your critical services, plan for disruption, test the plans and keep improving.
Is a business continuity plan the same as ISO 22301?
A plan is one part. ISO 22301 wraps plans in a managed system: impact analysis, owners, exercises, reviews and improvement, checked by an independent audit.
Does ISO 22301 cover cyber attacks?
Yes, as one cause of disruption among others, such as power, site or supplier failure. ISO 22301 pairs well with ISO 27001, which covers protecting the information itself.
How much does ISO 22301 certification cost?
Our fee depends on the services, sites and suppliers in scope and what plans exist; the certification body charges its own audit fee. You get a fixed-fee proposal after a short scoping call. Government grants may cover part of the cost. We check at your first call. Tell us your scope in 5 minutes and you get a fixed-fee proposal within 2 working days: Scope your project
Latest PDPC case on this topic · 2026-08-05 · Construction, engineering and manufacturing · Voluntary undertaking
Relying on an IT vendor does not remove your responsibility: know how your servers are secured and maintained, and check the vendor is doing it.
Read the PDPC decision of 5 August 2026, on pdpc.gov.sg (opens in a new tab)ISO work is led by a practising lead auditor, certified through IRCA or PECB.
Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)