ISO 22301 certification requires a scope-based quotation in 2026, not a universal fixed fee. Your total budget must include preparation, independent certification audits, staff time and ongoing maintenance—not just the initial audit. Define what you want certified before you compare quotes.
Why this matters
An audit quotation is not your complete business continuity budget. You still need people to analyse disruption, agree recovery priorities, exercise plans and correct weaknesses.
Keep those responsibilities visible in your 2026 budget. Otherwise, you approve an external fee while leaving the work needed to reach certification unassigned.
OneClickComply provides software that automates cyber security compliance certifications for growing businesses. Business continuity certification still requires you to make operational decisions and demonstrate that your plans work.
How much does ISO 22301 business continuity certification cost?
Your total cost depends on the certification scope and the work needed to make that scope audit-ready. Ask for an itemised quotation against a written description of your business, rather than comparing headline offers.
Separate the budget into the following workstreams. Each has a different owner, and each needs a clear boundary.
| Budget component | What it covers | What to clarify before approval |
|---|---|---|
| Preparation | Assessing current arrangements, analysing business impacts and developing the management system | Which deliverables your team must produce |
| Recovery arrangements | Resources and procedures needed to continue or restore priority activities | Whether existing arrangements meet your recovery needs |
| Internal assurance | Exercises, internal audits and management review | Who performs the work and records the results |
| Initial certification | Stage 1 and Stage 2 assessment by an independent certification body | Audit scope, planned audit time and exclusions |
| Follow-up work | Correcting findings and supplying evidence of completed actions | How additional assessment is handled |
| Ongoing maintenance | Updating plans, exercising arrangements and maintaining certification | Surveillance and recertification arrangements |
Use this breakdown to assign responsibilities before you approve spending. An external provider's deliverable does not remove your responsibility to supply business information, approve priorities or implement changes.
Preparation is separate from certification
Preparation builds the business continuity management system that the auditor assesses. It includes understanding priority activities, disruption risks, recovery needs and the arrangements that support them.
A consultant can help organise this work. Your business must still provide the information and make the decisions.
Ask whether preparation support includes workshops, document development, exercises and internal assurance. A package described only as certification support leaves too much undefined.
Initial certification has distinct assessment stages
Stage 1 reviews your management system and readiness for the next assessment. Stage 2 evaluates its implementation and effectiveness.
Ask the certification body to identify both stages in its proposal. Confirm how it handles readiness issues, findings, additional evidence and any necessary follow-up assessment.
Do not treat a booked audit as proof that you are ready. Booking commits resources; readiness depends on your implemented arrangements and supporting evidence.
Maintaining certification needs its own budget
Certification is not a one-off documentation project. Your business changes, suppliers change and recovery arrangements need review.
For your 2026 approval, request the proposed surveillance and recertification schedule alongside the initial assessment. Include the internal work needed to keep plans current, exercise them and close actions.
A useful budget makes recurring responsibilities visible. It does not stop at the certificate.
Why ISO 22301 certification costs vary
ISO 22301 defines management system requirements, not a universal certification tariff. Your quotation must reflect the organisation being assessed and the work included in the engagement.
Use these factors to explain differences between proposals:
- Certification scope: The services, activities and organisational boundaries you include determine what must be prepared and assessed.
- People and locations: The workforce and sites within scope affect how the certification body plans its assessment.
- Operational complexity: Different activities and dependencies require different continuity arrangements and evidence.
- Existing readiness: Established impact analysis, recovery plans and exercise records differ from arrangements that still need development.
- Implementation support: Your choice of internal delivery, external assistance and supporting software changes the work assigned to each party.
- Assessment arrangements: Audit methods, follow-up requirements and the maintenance programme affect the complete engagement.
Ask each provider to explain its assumptions. If proposals use different boundaries, they are not directly comparable.
Compare like-for-like scope before you compare the commercial terms. A narrower engagement is not automatically a better fit for your customer requirement.
Build a budget you can approve
Start with the business outcome. Identify the contract requirement, procurement condition or internal objective that certification must satisfy.
Then work through the following sequence. Use the same information for every quotation request in 2026.
- Define scope. List the services, organisational units, sites and activities you want on the certificate. Record exclusions and check that they do not undermine your intended purpose.
- Assess readiness. Identify existing plans, impact analysis, exercise results, internal audit records and management reviews. Separate usable evidence from documents that need updating.
- Assign owners. Name the people responsible for business information, recovery decisions, plan maintenance and corrective actions. Confirm their capacity to deliver the work.
- Request quotes. Send the same scope and readiness summary to each provider. Ask for a written breakdown of preparation, assessment and ongoing obligations.
- Approve maintenance. Assign responsibility for keeping the system effective after certification. Include exercises, reviews, changes and the certification body's continuing assessments.
A budget built in this order connects spending to defined work. It also gives your leadership team a clear view of the decisions that remain inside the business.
Define the work before you request a certification quotation.
Write a quotation brief that providers can use
Give providers enough information to assess the same organisation. Do not send a vague request for ISO certification and expect comparable responses.
Your brief should state:
- The proposed certificate scope and your reason for seeking certification.
- The activities, people and locations included.
- The important systems, suppliers and outsourced services supporting those activities.
- The continuity work already completed and the evidence available.
- The preparation tasks you want external support to cover.
- Your intended audit date and any customer deadline.
Ask providers to identify assumptions that need validation. Resolve them before signing, rather than letting different interpretations carry into delivery.
Separate cash spending from staff effort
Record external commitments and internal effort separately. Both belong in the approval, even when staff time does not appear on a supplier invoice.
Ask activity owners to estimate the time needed for interviews, workshops, exercises and action completion. Use your own staffing assumptions rather than a generic implementation estimate.
Protect that time in the delivery plan. A budget without available owners does not establish audit readiness.
Choose how you will prepare
Choose the delivery approach that matches your team's capacity and experience. Certification assessment remains separate from the work you do to prepare.
The following options describe preparation approaches, not substitutes for independent certification.
| Preparation approach | Best for | Main advantage | Main limitation |
|---|---|---|---|
| Internal delivery | Businesses with available continuity expertise and accountable owners | Keeps operational knowledge and decisions close to the work | Requires staff capacity and effective internal assurance |
| Consultant-supported delivery | Businesses needing specialist help with analysis, plans or exercises | Adds expertise to defined preparation tasks | Still requires staff input and clear deliverable boundaries |
| Software-supported delivery | Businesses managing recurring tasks, records and approvals | Helps organise work and maintain an evidence trail | Does not make recovery decisions or issue certification |
These approaches can work together. Define which party owns each task so that neither duplication nor gaps become part of the project.
OneClickComply is best for growing businesses seeking automated cyber security compliance management. Its stated focus includes ISO 27001, Cyber Essentials and SOC 2; confirm ISO 22301 support before including the software in your continuity programme.
The benefit is support for managing cyber compliance work. The boundary is equally important: OneClickComply does not replace your business continuity decisions or the independent certification assessment.
Check what the quotation excludes
Ask for exclusions in writing. A clear boundary is more useful than a broad promise to handle certification.
Check whether the proposal addresses:
- Audit preparation and staff interviews.
- Business impact analysis and recovery planning.
- Exercises and the actions arising from them.
- Internal audit and management review support.
- Travel, additional assessment and follow-up arrangements.
- Continuing certification assessments and future scope changes.
Confirm how the provider handles changes to the agreed engagement. Also check whether taxes and any pass-through charges are included in the commercial proposal.
Do not assume the same provider prepares your system and certifies it. Independent assessment and implementation support serve different purposes.
Verify accreditation and customer acceptance
ISO publishes standards; it does not certify your business. A certification body performs the certification assessment.
If your customer requires accredited certification, verify that the body's accreditation scope covers ISO 22301. For UK accreditation, UKAS is the national accreditation body.
Check the exact procurement requirement before committing. The certificate scope and accreditation status must meet the requirement you are trying to satisfy.
Can I reduce the cost by narrowing the scope?
A focused scope limits the activities you need to prepare and assess. It must still represent the service or business area that needs certification.
Do not exclude a dependency simply because another team owns it. If that dependency supports an in-scope activity, your continuity arrangements need to address it.
Ask the certification body to confirm the proposed boundary. Then check that the resulting certificate will meet your customer's expectation.
Does ISO 27001 reduce the work needed for ISO 22301?
An existing ISO 27001 management system provides material to review for reuse, including governance, document control and internal assurance arrangements. It does not establish ISO 22301 conformity by itself.
You still need business continuity analysis, strategies, plans and exercises that meet the relevant requirements. Assess existing evidence against those requirements instead of assuming another certificate completes the work.
Does buying continuity software include certification?
Software supports your management system; certification requires independent assessment. Treat a software subscription and a certification engagement as separate commitments unless the written agreement explicitly sets out both.
Check what the software actually supports. Task tracking and document storage alone do not demonstrate that recovery arrangements are effective.
Frequently asked questions
One last thing
Before approving certification, ask an activity owner to explain how their service will continue during a disruption. Then ask for the exercise evidence supporting that explanation.
That conversation turns a certification budget into an operational decision. Fund the arrangements you need to work, not just the documents you need to show.
Seriously Simple Cyber Compliance.