ISO 22301 business continuity certification proves your business can keep operating after a disruption — and UK buyers are asking for it more in 2026 tenders and vendor questionnaires than they did two years ago.
Why this matters
ISO 22301 is the international standard for a business continuity management system. It's not a cyber standard — it covers how you keep serving customers when a supplier fails, a site floods, or a key system goes down.
UK procurement teams increasingly bundle it alongside ISO 27001 and Cyber Essentials in supplier due diligence, especially in finance, healthcare, and public sector supply chains. If you're being asked for it once, expect the question again from the next three prospects.
Before you commit budget, get clear on choosing the right compliance framework for your actual risk profile — ISO 22301 solves continuity, not security posture, and conflating the two wastes a quarter.
Who this is for
This is for UK SMEs — typically 20 to 250 staff — that run operations customers depend on daily: SaaS platforms with uptime SLAs, professional services firms tied to client deadlines, logistics and supply chain operators, and public sector suppliers where continuity is now a scored criterion in tender documents. If a single outage would cost you a contract, not just a bad day, ISO 22301 earns its place on the roadmap.
What to look for in ISO 22301 for UK SMEs
A business impact analysis that matches your real operations
A generic BIA template gets rejected at stage 1 audit. The auditor wants to see your actual critical processes, dependencies, and maximum tolerable downtime — not a copy-paste from a consultant's last client.
Recovery time objectives you can actually hit
Setting a 4-hour RTO on a system that's never recovered in under 12 hours is a paperwork lie that collapses the first time you test it. Set objectives your team has proven, not objectives that look good on a slide.
A UKAS-accredited certification body
ISO 22301 certificates from non-accredited bodies get rejected by procurement teams doing vendor due diligence. Confirm UKAS accreditation before you sign a contract with any certifier.
Evidence you can maintain without a dedicated hire
Most SMEs don't have a full-time business continuity manager. The system needs to run on evidence your existing team can update monthly, not a manual only a consultant understands.
Integration with frameworks you already hold
If you're already certified to ISO 27001 or hold Cyber Essentials, your incident response and risk registers overlap heavily with ISO 22301 requirements. Reusing that evidence cuts audit prep time significantly.
A realistic surveillance audit cadence
ISO 22301 runs a 3-year certification cycle with an annual surveillance audit and a full recertification audit in year three. Confirm your certification body's audit schedule and cost structure before signing, not after.
Top routes to ISO 22301 certification
The DIY route — the cheapest on paper. One spec that matters: staff hours. Expect 200+ internal hours building your BIA, policies, and test plans from scratch across a 6-month window in 2026. Works if you already have an ISO 27001 lead or compliance manager in-house. Consider.
The consultant-led route — the safe pick for firms with zero prior certification experience. A consultant runs your BIA, writes your policies, and preps you for the stage 1 and stage 2 audits. Timeline typically compresses to 3-4 months. Cost scales with consultant day rate, so get a fixed-scope quote before you start. Buy if budget allows and you need it fast for a tender deadline.
The automated platform route — the wildcard for SMEs already juggling ISO 27001, Cyber Essentials, or SOC 2 evidence. Automating evidence collection for audits turns policy tracking, testing schedules, and audit trails into a system that updates itself instead of a folder someone forgets to touch. If you're already running automated evidence collection for audits for another certification, extending it to ISO 22301 evidence is incremental work, not a new project. Buy if you're already on a compliance platform for another standard.
The hybrid route — consultant for the BIA and policy build, platform for ongoing evidence and surveillance audit prep. Best fit for SMEs with more than one certification on the roadmap in 2026. Consider.
Automate your compliance evidence trail
See how automated evidence collection keeps ISO and Cyber Essentials audits ready year-round.
What to avoid
- A BIA copied from another company's template. Auditors spot generic templates within the first ten minutes of a stage 1 review — it's the single most common reason SMEs fail their first attempt.
- Skipping the tabletop exercise before your audit. A tabletop exercise for incident response proves your plan works under pressure — auditors ask for evidence of testing, not just a written plan sitting untested.
- Confusing ISO 22301 with ISO 27001. If your prospects are only asking about data security, ISO 27001 for SaaS startups covers that ground — ISO 22301 is a separate, additional spend, not a substitute.
Verdict comparison
| Route | Timeline (2026) | Staff hours | Best for | Verdict |
|---|---|---|---|---|
| DIY | 5-6 months | 200+ hours | In-house compliance lead already in place | Consider |
| Consultant-led | 3-4 months | 40-60 hours | Tender deadline pressure | Buy |
| Automated platform | 3-4 months | 60-80 hours | Already certified to ISO 27001 or Cyber Essentials | Buy |
| Hybrid | 4-5 months | 80-100 hours | Multiple certifications on the roadmap | Consider |
Frequently asked questions
One last thing
The SMEs that pass ISO 22301 on the first attempt almost always share one habit: they test their recovery plan with a tabletop exercise before the auditor ever shows up, not after a near-miss forces the issue in 2026.