ISO 22301 Certification: Process, Cost and Timeline

Certification Process

1. Gap assessment against Clauses 4–10
2. Implement BCMS (BIA, strategies, plans, competence, exercises)
3. Internal audit and management review
4. Stage 1 — CB reviews documentation and readiness
5. Stage 2 — CB assesses implementation and effectiveness
6. Certificate issuance; address any nonconformities
7. Surveillance audits during the cycle; recertification at cycle end

Timeline Drivers (Qualitative)

• Existing continuity maturity vs greenfield BCMS
• Number of sites, legal entities, and critical activities in scope
• Supplier complexity and DR technical debt
• Ability to complete clause 8.5 exercises before Stage 2
• Certification body scheduling

Organisations with mature incident and recovery practices often move faster; multi-site financial groups typically need longer coordination windows. Exact calendars are scoped per engagement.

Cost Drivers (No Currency Figures)

• Gap assessment — internal or advisory review of clause readiness
• Documentation — policy, BIA, plans, procedures, records
• Remediation — process design, training, technical DR upgrades
• Certification body fees — Stage 1 / Stage 2, surveillance, travel if applicable
• Consulting / programme management — optional acceleration and coaching
• Tooling — evidence platforms (e.g. CSA), monitoring (e.g. ThreatHawk) where cyber continuity matters

Costs vary by scope complexity, geography, and how much work is already done. Request a readiness-based estimate rather than relying on generic public “price lists.”

How CyberSilo Helps

• BCMS programme artefacts — BIA, plans, exercise records — organised in Compliance Standards Automation
• ThreatHawk SIEM / SOAR for detection, response evidence, and ICT continuity telemetry during disruption
• Advisory scoping for certification readiness — contact CyberSilo

Frequently Asked Questions

Why no dollar or euro amounts?

Published ranges are often stale marketing. Drivers and scope dominate; we estimate after understanding your BCMS boundary.

Is surveillance included in initial CB fees?

Commercial packages differ. Ask the certification body what the three-year cycle includes.

Can we certify without exercises?

Clause 8.5 expects exercising and testing. Stage 2 commonly examines these records.

Related ISO 22301 Resources

BCM services · CSA ISO 22301 · What is ISO 22301 · Hub