ISO 22301 · Business continuity
It requires analysing the impact of a disruption, defining continuity strategies and testing them through exercises.
- Sectors
- Finance · Telecommunications · Logistics
- Edition
- ISO 22301:2019
We use cookies needed for the site to work and, if you accept, others to measure use and improve our communications. You can change your choice at any time. See the details
It requires managing physical assets across their life cycle, with objectives, risks and an asset management plan.
The issuing body and applicable conditions are identified in the proposal and certification agreement.
Initial certification follows these steps.
What you are asked for, what activities you carry out, and at which sites and in which country you operate.
In writing, sized to the standard, the activities, the sites and the country.
The assigned team assesses the documentation and the operation with evidence.
A function separate from the audit team decides. The certificate can be checked by its code.
Continuity of the cycle is agreed for your case.
Issuance depends on the audit and an independent decision.
ISO 55001:2024 replaced ISO 55001:2014. The applicable edition is confirmed according to the type and date of the audit before a proposal is issued.
There is no list price: the proposal is sized on standard, scope, sites, headcount, activities, system complexity and delivery mode. The request is reviewed first and the proposal is then issued.
Findings are documented and classified. The organization submits correction, root cause and corrective action with evidence; the audit team evaluates it and only then does the file go to decision.
A competent function separate from the audit team. Those who audit do not decide, and no outcome is anticipated before that review.
In the public certificate register, by code.
It requires analysing the impact of a disruption, defining continuity strategies and testing them through exercises.
It requires assessing bribery risk and applying controls: due diligence, financial and non-financial controls and reporting channels.
It requires identifying compliance obligations, assessing their risks and assigning responsibilities within a structure.
It requires assessing security risks in the supply chain and treating them with controls.

The proposal arrives in writing, with the standard, the scope and the timeline.