Business impact analysis across your critical functions, systems, and dependencies
Business Continuity
ISO 22301 Certification
Business Continuity
ISO 22301 Certification
Find Out If Your Business Continuity Plan Actually Works Before You Need It To
ISO 22301 certification proves your organization can keep critical operations running, or recover them fast, when disruption hits, not just that you have a plan sitting in a folder nobody's opened since it was written. We build the business continuity management system underneath that certificate, stress-test it, and get you certified without pulling your team away from the operations they're protecting.
The challenge
The Problem We're Usually Called In For
Most business continuity plans fail quietly, in a drawer, not during an actual disruption, because that's the first time anyone tests whether they work. A recovery time objective was set without checking if it was actually achievable. A key supplier's own continuity plan was never verified. A plan assumes a specific person will lead the response, and that person is on leave when the disruption happens.
We work with COOs, Heads of Risk, IT Directors, and CISOs at organizations where operational disruption carries real financial or reputational cost, particularly in financial services, healthcare, logistics, and technology. Some of you are pursuing certification for a customer or regulatory requirement. Some had a near-miss that exposed how untested the plan really was. Others simply want confidence that when disruption hits, the plan holds.
Scope
What the Certification Process Covers
Gap analysis against ISO 22301, benchmarked against your current continuity and disaster recovery plans
Risk assessment covering the disruption scenarios most relevant to your operations and location
Recovery strategy development, including realistic recovery time and point objectives, not aspirational ones
Third-party and supplier continuity review, since your plan is only as strong as your weakest critical vendor
Crisis communication and incident response planning, including who leads, and who leads if they can't
Exercise and testing program design, so the plan gets validated before a real event does it for you
Internal audit support and management review ahead of certification
Engagement
How the Engagement Works
A proven 7-step consulting process from discovery to sustained process excellence.
Step 01
Discovery & Scoping
Step 02
Business Impact Analysis & Gap Assessment
Step 03
Build & Remediation
Step 04
Exercise & Validation
Step 05
Certification Support
A short call to understand your critical operations, current continuity planning, and what's driving certification. We agree on scope before assessment begins.
We identify your critical functions and their recovery requirements, then benchmark current planning against ISO 22301's requirements.
We help build or refine recovery strategies, response plans, and supplier continuity requirements, tested against realistic scenarios rather than assumptions.
We run a structured exercise to test the plan before certification, surfacing gaps a tabletop discussion alone would miss.
We support the internal audit, management review, and certification body's Stage 1 and Stage 2 audits, helping resolve findings quickly.
Outcomes
Proof, Not Promises
Financial services firm pursuing certification for a regulatory requirement
the business impact analysis found a critical payment system's stated recovery time objective was four hours, but a test recovery took closer to eighteen. Rebuilding the recovery strategy around a realistic target closed a gap that would have failed under real disruption, not just under audit.
Client outcome
Logistics company with a single-supplier dependency for a critical component
the supplier continuity review found that supplier had no tested continuity plan of its own. Adding a qualified backup supplier closed a single point of failure nobody had previously flagged.
Client outcome
FAQ
Questions We Get Asked Before Signing
Typically four to seven months, including at least one structured exercise to validate the plan before certification.
Not a full-scale simulation necessarily, but ISO 22301 requires evidence of exercising and testing. We scope an exercise proportionate to your risk and resourcing.
Disaster recovery typically focuses on IT systems. Business continuity is broader, covering people, facilities, suppliers, and communications, everything needed to keep the business functioning, not just the technology.
Yes, and we help scope which functions and locations are genuinely critical rather than certifying everything indiscriminately.
The business impact analysis involves structured interviews, and the exercise is scheduled deliberately, but neither requires taking systems offline or halting operations.
Certification runs on a three-year cycle with annual surveillance audits, and ISO 22301 requires ongoing exercising between audits, which we can support or hand off to your internal team.
Ready to Know Your Continuity Plan Actually Works?
A continuity plan is a hypothesis until it's tested. ISO 22301 certification forces that test to happen on your terms, before a real disruption forces it on someone else's.
Schedule a 30-minute continuity readiness call and find out where your plan would break. When you reach out, we'll ask for your name, work email, company, role, and a brief note on what's driving the certification. That's enough for us to come prepared.