Business Continuity Management · ISO 22301
Keep critical services running through disruption.
From the business impact analysis to the certification audit and maintenance visits in years two and three, we build an ISO 22301 programme that knows which services matter most and how to restore them under pressure.
Why it matters
Disruption will come. Be ready before it does.
Know what to save first
A business impact analysis ranks your services by the damage an outage would cause, so recovery effort goes where it protects the most.
Plans people can follow
Crisis, evacuation and impact assessment plans with named roles, rehearsed in walkthroughs, so the response does not depend on who is in the office.
Regulators expect resilience
ISO 22301 and regional rules such as SAMA BCM ask for tested continuity. One programme built to ISO 22301 serves both with a single body of work.
How we deliver
From initiation to the third-year review.
We stay past certification day, returning in the second and third years to keep plans current and the certificate valid.
Initiation
We agree the scope and objectives of the programme and name the team who will own business continuity in your organisation.
BCM governance
Structure, roles, reporting lines and the continuity policies and procedures that give the programme its authority.
Risk assessment & BIA
We rank threats to your operations, measure what a disruption would cost each service and set its recovery objectives (RTO and RPO).
Strategy & BC plans
Continuity strategies for each critical service, then detailed plans for restoring operations during and after a disruption.
Walkthrough testing
At least three scenario walkthroughs test the plans with the people who will use them and expose gaps before a real event.
Audit & certification
An internal audit against ISO 22301, then hands-on guidance as you prepare for and sit the certification audit.
Annual maintenance
Visits in the second and third years keep the programme effective and up to date and support your ISO 22301 certificate.
What you receive
Set up and analyse, plan and test, then audit and maintain.
Expected outcomes: recovery priorities agreed by leadership, plans tested with the people who will use them, and readiness for ISO 22301 certification.
01 · Analyse
Set-up and analysis
Project plan and timeline
Project team roles and responsibilities
Risk assessment report
Business impact analysis report
BCM policies and procedures
02 · Prepare
Plans and testing
Business continuity roles and responsibilities
Crisis management plan
Evacuation team plan
Impact assessment plan
Business continuity testing plan
Walkthrough scenarios (minimum three)
03 · Sustain
Audit and upkeep
Internal audit report
ISO 22301 certificate, when awarded by your certification body
Annual BCMS review report
Corrective actions & improvement plan
Track record
Continuity expertise we teach and practise.
BSI ISO 22301 Lead Implementer · May 2025
100% pass rate for the candidates we trained
IT Security C&T · ISO 27001
We run a certified management system ourselves
IT Security C&T · Jordan
Security consulting for MENA organisations since 2011
Score continuity risks live in ExceedGRC.
Your BIA and risk assessment should not freeze inside a report. ExceedGRC scores continuity risks live on a graphical view and ties each mitigation to its owner, so every annual review starts from current data rather than last year's files.
Related services
Resilience runs wider. Strengthen the rest.
Continuity plans work best alongside a certified ISMS, responders on call and owners who know the standard.
Incident Response Retainer
Experienced responders on call when a cyber incident becomes the disruption your plans were written for.
Explore the IR retainerInformation Security Management
Pair ISO 22301 with an ISO 27001 ISMS, so continuity and security controls are governed together.
Explore ISO 27001Compliance
Meet SAMA BCM and other regional continuity requirements with the plans and evidence you already hold.
Explore complianceISO 22301 training
ISO 22301 Lead Implementer and Lead Auditor courses from BSI and PECB, for whoever will own the programme.
View continuity coursesFAQ
Business continuity, clearly explained.
What leadership teams ask before starting an ISO 22301 programme.
What is the difference between a BIA and a risk assessment?
A risk assessment asks what could disrupt you and how likely it is. A business impact analysis asks what a disruption would cost each service. We run both, because good plans need both answers.
Do walkthrough tests stop live services?
No. Walkthrough testing talks the plans through with the people who own them, using at least three scenarios. It exposes gaps in roles, contacts and steps without stopping live services.
Does this cover cyberattacks or only physical events?
Both. The programme plans for any disruption to critical services, whether the cause is a cyberattack, a natural disaster, a pandemic or the loss of a key site.
Who issues the ISO 22301 certificate?
An independent certification body. We run the internal audit first, then guide you through the certification audit and help you respond to any findings it raises.
What happens after certification?
We return for maintenance visits in the second and third years. Each one produces an annual BCMS review report and a corrective action and improvement plan to keep the programme current.
Plan for disruption
Name what must not stop. We'll plan how to keep it running.
Share your critical services and any deadline, and a continuity consultant will reply with a scoping proposal for your BCM programme.
Tell us your critical services and locations
A business continuity consultant weighs your needs
A scoped proposal for your BCM programme follows