Complete guide · Business continuity
ISO 22301 in Romania
The standard for business continuity management: how to prepare your organisation to withstand a crisis — from IT failures to supply chain disruption — and how to obtain certification.
What is ISO 22301?
ISO 22301 is the international standard for a Business Continuity Management System (BCMS). It provides the framework through which an organisation prepares for, responds to and recovers from disruptive events — from IT incidents and natural disasters to breaks in the supply chain.
The current version is ISO 22301:2019. The standard requires you to identify critical activities, assess the impact of disruption, and prepare the plans that ensure operations resume within an acceptable time.
The central element is the business impact analysis (BIA): the process through which you learn which activities cannot afford to stop, how long they can be interrupted, and what resources they need to restart. The rest of the system is built on those answers.
Why organisations implement ISO 22301
In a world of ever more frequent disruption — cyber, climate, geopolitical — continuity has become a contractual requirement and a market expectation.
Operational resilience
A demonstrated ability to keep critical activities running during a crisis
A contractual requirement
Large clients and regulated sectors increasingly ask for continuity plans
Readiness for cyber incidents
Complementary to NIS2 and to information security management
Less downtime
Tested plans that dramatically shorten recovery after a disruption
Smaller losses
A managed incident costs a fraction of one that catches the organisation unprepared
Market confidence
A signal of maturity to clients, insurers and investors
How ISO 22301 is implemented — the process stages
Context and gap analysis
We understand the organisation, its interested parties and its current position against ISO 22301:2019. Duration: 2 weeks.
Business impact analysis (BIA)
We identify the critical activities, set acceptable recovery times and determine the minimum resources required.
Risk assessment
We assess the threats to critical activities and the plausible disruption scenarios.
Strategies and plans
We draw up continuity strategies and the response and recovery plans for each scenario.
Testing and exercises
We test the plans through exercises — because an untested plan is only an assumption. We adjust whatever does not work.
Certification audit
The accredited body audits the system and issues the ISO 22301 certificate, valid for 3 years.
What ISO 22301 certification costs
Cost depends on the number of critical processes and sites, and on the complexity of the continuity scenarios. Indicative figures over a 3-year cycle:
Small organisation
One site, simple processes
EUR 8,000–11,000
Standard complexity · 3 years
Medium organisation
Multiple critical processes
EUR 11,000–16,000
Medium complexity · 3 years
Complex organisation
Multiple sites, critical IT
EUR 16,000–25,000
High complexity · 3 years
✅ Costs cover consultancy and the certification body fee over 3 years. ISO 22301 integrates well with ISO 27001 for information security — combined implementation reduces effort wherever the processes overlap.
How long ISO 22301 implementation takes
The impact analysis and the testing of plans dictate the timeline. The average is 4–8 months.
Fast start
3–4 months
Small organisation, clear critical processes, committed leadership.
Standard
4–7 months
Several critical processes, scenarios to test, a single main site.
Complex
7–11 months
Multiple sites, complex IT dependencies, a critical supply chain.
Frequently asked questions about ISO 22301
What is the business impact analysis (BIA)?
The BIA is the heart of ISO 22301. It is the process through which you identify the critical activities of the organisation, how long they can be interrupted without unacceptable consequences, and what resources are needed to resume them. Without a solid BIA, continuity plans are only assumptions.
How does ISO 22301 relate to cyber security?
They are complementary. ISO 27001 protects information; ISO 22301 ensures continuity when that protection fails. A major cyber incident tests precisely the continuity plans — which is why many organisations implement both together, especially in the context of NIS2.
Do I have to test my plans?
Yes, it is mandatory. ISO 22301 requires periodic exercises and testing. A continuity plan that has never been tested is very likely to fail exactly when it is needed. Testing exposes the wrong assumptions before the crisis, not during it.
Is it relevant for a small company?
Yes, although the scale differs. Any organisation that would lose significantly from a disruption — in revenue, clients or reputation — benefits from structured continuity. For small firms the system is proportionately simpler, but the principle holds.
Who issues the certificate?
An accredited certification body, independent of the consultant. Golden Audit Consulting® handles implementation, testing and preparation; certification is carried out by the accredited body.
Other ISO standards for your company
Verifiable credentials
IRCA Lead Auditor for integrated systems
CQI | IRCA certified courses, taken with RINA: ISO 9001, ISO 14001 and ISO 45001.
ISO 9001
ISO 14001
ISO 45001See the certificates →How long would your business survive a crisis?
We build the continuity system to ISO 22301, from the impact analysis to tested plans. The first conversation is free.