Image: TÜV Rheinland ©

Questions and answers about ISO
22301 certification for business
continuity management
Our experts have collected the most importantquestions and answers about ISO 22301 certification.
Contact us for more information!

1 . W H AT I S I S O 2 2 3 0 1 C E R T I F I C AT I O N F O R B U S I N E S SCONTINUIT Y MANAGEMENT?

The international standard for business continuity
management (BCM) was published in May 2012 and isdesigned to reduce the risk of any kind of interruption
to operations. This standard takes the place of current
British standard BS 25999. It contains all requirements forplanning, setting up and running a documented continuity
management system. The standard is not specific to any
particular industry but can apply to all sectors regardless ofindustry or size of the company. A formalised BCM system
can help prepare a company to mitigate incidents.

www.tuv.com/en/bcm

In the process, business continuity management deals witha series of questions, such as:
How does the company work when conditions are notideal, e.g. after an unusual event or failure of existential
business processes?
How badly would your company‘s effectiveness beaffected?
How do you deal with a worst case scenario?
What is the maximum tolerable outage time?

··
····
··

··Organizations that want to set up a business continuity
management system or improve their existing BCM.
··Organizations that want to use their management system
to ensure conformity.
··Organizations that wish to document conformity for third··BCM communication··Performance of business impact analysis··Risk assessment··Strategy development··BCP planning··Test scenarios··Monitoring and improvement of the business continuity

3 . W H AT A R E T H E A D VA N TA G E S O F C E R T I F Y I N G Y O U R

5 . W H AT I S T H E I S O 2 2 3 0 1 P R O C E S S ?

BUSI N ESS CONTI N U IT Y M A N AGEM ENT SYSTEM?

1. Documentation review
The audit team assesses to what extent thedocumentation for your business continuity management
system already complies with the requirements ofthe standard ISO 22301. In addition, they check theboundaries of the scope of the BCMS.
2. Preliminary audit (optional)
The preliminary audit can take place before or after thedocumentation review.
3. Creation of audit plan / schedule
Our auditors systematically identify potential intervals
for achieving the specified objectives and coordinate therelevant testing appointments with you.
4. Certification audit
This verifies implementation i.e. the practical applicationof your business continuity management system. Ourauditors assess whether it is appropriate and effective
and meets the requirements of the standard. This will
involve gathering and verifying information by interview
and via objective evidence and an inspection of yourfacilities.
5. Issuance of certificate
If all criteria are met, your company is issued withcertification according to ISO 22301. This confirms thatyour business continuity management system functions
and complies with the standard. Your company will also
be added to Certipedia, our online certificate database.
6. Surveillance audits
Our annual surveillance audits help you continuously
improve your processes.

2 . W H I C H O R G A N I Z AT I O N S A P P LY T H E I S O 2 2 3 0 1
S TA N D A R D ?

parties.

············
··
··
··
··

Gain an independent, external verification of yourbusiness continuity management system
Reduce outage and recovery times for applications
Create structured procedure for incidents
Align business processes with the operational risk
management process
Obtain comprehensive risk assessments involving alllevels of the business
Help meet internal, stakeholder and international
standards requirements
Increase the involvement of managers in emergency
management
Help provide greater confidence in the company tostakeholders
Gain a competitive edge through the international
standard
Identify potential savings on insurance policies

4 . W H AT C R I T E R I A A N D A R E A S D O O U R E X P E R T S
A S S E S S D U R I N G C E R T I F I C AT I O N A S P E R I S O 2 2 3 0 1?

Our catalog of criteria is based, among other things, on
the PDCA cycle (plan, do, check, act) and involves allphases of the business continuity management life cycle.
During certification as per ISO 22301 our experts examineand assess the following areas of a business continuity
management system
BCM policy
BCM scopeSpecifications for the BCM
Assessment of interfaces
BCM in the value chain
Organization of the business continuity management
systemManagement commitment
Business continuity objectives
Planning as regards risk and opportunity planningManagement support regarding the necessary resources
and competences····················

www.tuv.com/en/bcm

management system

6 . W H AT A R E T H E A D VA N TA G E S F O R Y O U R B U S I N E S S ?

··Your existential business processes need to run

without interruption if you are to achieve your businessobjectives.
You improve your stability in a crisis and make yourbusiness more resilient.
You obtain documented proof of a functioning emergency
management process.

····aware of emergencies and crises and improve theirconfidence.
Regular tests and drills train you and your employees how
to behave in an emergency and master such situations
with confidence.
Continuity: a reliable flow of information makes for wellrunning processes.
You know your risks and are able to minimize them.
Cost savings: you create clear structures and reduce yourinsurance premiums.
Competitive advantage: you gain an edge over yournational and international competitors, as ISO 22301 is
recognized around the world.
Business continuity management supports the entire value
chain process and integrates your business partners.

············

7. W H AT A R E T H E R E Q U I R E M E N T S F O R A
COMPREHENSIVE BUSINESS CONTINUITY
M A N AGEM ENT SYSTEM?

··All critical processes within a company/department must
be recorded.
··A business impact analysis must be performed to identify

potential damage resulting from failure of one of these
critical business processes.
A risk assessment must be completed to reduce thelikelihood and effects of potential risks.
Strategies must be developed, both as proactive
measures and as reactions to emergencies.
All emergency plans must be described.
Scenario-based tests and drills must be performed.
The BCMS must be monitored and improved.

··········

8 . W H AT A R E T H E M O S T I M P O R TA N T Q U E S T I O N S F O R
ANY BUSINESS?

··How will I continue to serve my customers, how will mycustomers react to a prolonged outage?
··How are critical business processes maintained?
··How can critical business processes continue on an
acceptable level in an emergency?
··How do I minimize losses and effects?
··How badly will my company‘s effectiveness be impaired?
··Have we considered all possible failure scenarios beyond
pure IT failures?
··What is the maximum tolerable outage time?
··Which legal requirements are being damaged?
··What justified interests of the interested parties(stakeholders) need to be maintained?

D O Y O U H AV E M O R E Q U E S T I O N S F O R O U R E X P E R T S , O R W O U L D Y O U L I K E T O R E C E I V E A N I N D I V I D U A L O F F E R ?
C O N TA C T U S !

TÜV Rheinland Cert GmbHAm Grauen Stein
51105 Cologne, Germany
Tel.: +49 800-888 2378
tuvcert@de.tuv.com
www.tuv.com/en/bcm® TÜV, TUEV and TUV are registered trademarks. Their use and exploitation requires prior consent.

··Control: process structures are documented. You identify
potential risks and can take effective countermeasures.
··Awareness: your employees become familiar with and