Skip to main content

Explainers

ISO 22301 Certification Explained: What Vendors Publish

ISO 22301 certifies business continuity, not information security. Here is how to check a vendor's BCMS claim against its own certificate evidence.

Solomon AmosPublished 13 Oct 20269 min read

ISO 22301 is a certification for business continuity management, and it is a different standard from ISO 27001 with a different scope, a different set of clauses and its own certificate number. Vendors sometimes mention both on the same trust page as though a business continuity claim and an information security claim were one badge. They are not. This article explains what ISO 22301 actually certifies, what a genuine certificate record should contain, and how the CertReports index treats the two as separate listings so a buyer can check whether a vendor's BCMS claim has the same independent evidence as its ISO 27001 listing, rather than borrowing credibility from it.

What is ISO 22301?

ISO 22301:2019, formally titled Security and resilience, business continuity management systems, requirements, is the international standard for a business continuity management system, or BCMS. It sets out what an organisation must do to identify threats to its critical activities, assess the impact of a disruption, set recovery time objectives, build continuity and recovery plans, and then test those plans through exercises rather than leaving them as a document nobody has opened. Like ISO 27001, it is a management system standard. A vendor builds a programme, an accredited certification body audits that programme against the clauses of the standard, and a pass produces a certificate with a number, an issuing body, a defined scope and an expiry date.

Those four facts, the certificate number, the issuing body's accreditation, the scope statement and the expiry date, are what turn a claim into evidence. You can check which vendors in the index carry a live ISO 22301 listing with that detail attached, rather than a single sentence about resilience sitting next to an information security badge.

ISO 22301 is not a stand-in for ISO 27001

ISO 27001 certifies an information security management system, an ISMS, built to protect the confidentiality, integrity and availability of information. ISO 22301 certifies a BCMS, built to keep critical business activities running through a disruption and recover them within agreed timeframes. A vendor can hold either one without the other, and plenty do. The 2022 edition of ISO 27001 does require continuity-related controls inside Annex A, covering ICT readiness for business continuity, but those controls sitting inside an ISMS audit scope do not amount to a certified BCMS. They are tested as part of the information security certificate, not issued as a separate one. If a vendor's ISO 27001 listing is the only continuity evidence on offer, that is worth noting as a gap, not treating as equivalent.

The same caution applies to SOC 2 reports. Some vendors describe continuity controls inside the availability criterion of a SOC 2 report, which is a legitimate control test, but it is an auditor's opinion inside a report, not a certification scheme with its own number and accreditation chain. The two evidence types answer different questions, and the SOC 2 vs ISO 27001 comparison is worth reading if a questionnaire response blurs the line between a report and a certificate. ISO 22301 sits in a third category again, and it should be checked on its own terms.

Certificates also go stale. ISO 27001 certificates citing the 2013 edition of the standard lapsed on 31 October 2025 under IAF MD 26, and many vendor pages still reference the old edition months later, as covered in ISO 27001:2013 to 2022: what the transition deadline means. The same discipline applies to ISO 22301: a certificate is only current if its expiry date has not passed, regardless of how recently the badge image was uploaded to a trust page.

Reading a genuine ISO 22301 certificate record

AttributeISO 22301ISO 27001
Full titleSecurity and resilience: business continuity management systems, requirementsInformation security management systems, requirements
What the audit coversBusiness impact analysis, recovery time objectives, continuity plans, exercise recordsRisk assessment, Annex A controls, information security policy and operating practice
Typical audit cycleThree-year certification cycle with annual surveillance auditsThree-year certification cycle with annual surveillance audits
Current edition20192022, since the 2013 edition lapsed on 31 October 2025
Question it answers for a buyerWill this vendor keep operating, or recover quickly, if a facility, supplier or system fails?Does this vendor manage information security risk through a documented, audited programme?
Where the index lists itFramework listing for business continuityFramework listing for information security

ISO 22301 and ISO 27001 are audited on separate cycles against separate clauses, so a single trust page badge cannot stand in for both.

Diagram comparing the scope of an ISO 22301 business continuity management system against an ISO 27001 information security management system, with a small overlap shown for continuity-related controls
ISO 22301 covers continuity of operations, ISO 27001 covers information security, and the two scopes overlap but are not interchangeable.

Trust pages commonly show an ISO badge as an image with no accompanying detail. A badge proves nothing on its own. The questions worth answering before accepting the claim are whether the issuing body is accredited for the ISO 22301 scheme by a recognised national accreditation body, whether the scope statement actually covers the product, service or legal entity you are buying from rather than a parent company or a different office, and whether the certificate is inside its validity window. The certification bodies a vendor names are part of that check, since an unaccredited issuer undermines the whole claim regardless of how the certificate itself reads. The same reading discipline applies across any certification, and how to read a trust centre in ten minutes sets out the general approach for working through a vendor's published evidence page by page rather than taking the top banner at face value.

  1. 1

    Find the certificate number

    A genuine ISO 22301 certificate carries a unique number issued by the certification body. If the trust page only shows a logo with no number, treat the claim as unverified.

  2. 2

    Check the issuing body's accreditation

    The certification body should itself be accredited for the ISO 22301 scheme by a national accreditation body. An unaccredited issuer cannot produce a certificate that means much to a buyer.

  3. 3

    Read the scope statement

    Confirm the scope names the legal entity, locations and services you are actually buying, not a sibling business unit or a narrower pilot programme.

  4. 4

    Check the expiry date

    ISO 22301 certificates typically run on a three-year cycle with annual surveillance audits. An expired certificate is not current evidence, however recent the website copy looks.

  5. 5

    Cross-reference the listing

    Compare the claim against the certification body's own public register, and check evidence expiring this month in case the certificate you are reviewing has already lapsed before it goes into a questionnaire response.
3 years
Typical ISO 22301 certification cycle
Annual surveillance audits normally run inside that three-year cycle
31 Oct 2025
ISO 27001:2013 lapse date
The IAF MD 26 transition deadline, a separate clock from any ISO 22301 expiry date a vendor holds
2 listings
ISO 22301 and ISO 27001 tracked as separate entries
in the CertReports index on 2026-10-13
ISO 22301 specifies requirements to plan, establish, implement, operate, monitor, review, maintain and continually improve a documented management system to protect against, reduce the likelihood of, and ensure an organization recovers from disruptive incidents.

What good evidence looks like in practice

The clearest way to see the difference between a stated claim and an independently checkable record is to look at a vendor that keeps several ISO certificates side by side, each with its own entry rather than one combined wall of badges. The card below shows how a trust centre can list multiple ISO certifications separately, with their own scopes, which is the same pattern a careful ISO 22301 listing should follow rather than folding it into an information security claim.

Docebo logo

Docebo · Trust report

Education · Public evidence as of 12 Oct 2026

Visit trust centreFull evidence

Framework overview

CertReports state for each framework with public evidence: 2 verified, 9 vendor-stated.

2 more frameworks on the evidence page

5Documents and agreements

Legal and review documents Docebo publishes or offers, as of 30 Sep 2026.

2Security practices

Public statements from Docebo, shown as statements, not attestations, as of 30 Sep 2026.

  • Penetration testing · annual
  • Data residency · Australia, Canada, EU, India, US

1Subprocessors

Named on Docebo's public subprocessor list, last seen 30 Sep 2026.

Separate ISO certificates, each with its own standard and scope, rather than one combined security badge. Every line is a dated public record from the FedRAMP Marketplace, the Data Privacy Framework list and Docebo's trust centre. A framework not shown means no public evidence was found, not that Docebo lacks it.CertReports
Mock certificate record showing fields for certificate number, issuing body, scope statement and expiry date
A genuine ISO 22301 listing names the certificate number, the accredited certification body and the expiry date, not just a logo.

Watch for a combined badge wall

Some trust pages group ISO 27001, ISO 22301 and other management system badges into one graphic with a single caption such as 'certified to leading standards'. That phrasing hides whether each certificate is current, which entity it covers and which certification body issued it. Ask for the certificates separately, or run the claim through a bulk vendor security check before it goes into a sourcing decision.

What to ask when a questionnaire says 'we have ISO 22301'

  • Ask for the certificate number and the issuing body's name, not a screenshot of a badge.
  • Ask what the scope statement covers: which locations, which services, which legal entity.
  • Ask for the expiry date and whether any surveillance audit has lapsed since issue.
  • Ask how the BCMS defines recovery time objectives for the specific service you depend on, since a generic company-wide RTO may not match your workload.
  • Ask whether business continuity is covered by a standalone ISO 22301 certificate or only mentioned as a control inside an ISO 27001 or SOC 2 scope.

None of these questions require the vendor to hand over anything confidential. A certificate number, an issuing body and a scope statement are public-facing facts by design, the same way a 30-minute vendor security review treats any other public certificate as the starting point before a questionnaire call rather than after it.

People also ask

What is iso 22301?

ISO 22301 is the international standard for a business continuity management system, or BCMS. It sets requirements for identifying threats to an organisation's critical activities, building continuity and recovery plans, and testing them through exercises. An accredited certification body audits that programme and issues a certificate with its own number, scope statement and expiry date, separate from any information security certificate the vendor holds.

What is iso 22301 certification?

ISO 22301 certification is the formal result of an accredited audit against the ISO 22301 standard. A certification body reviews a vendor's business continuity management system, including its risk assessment, business impact analysis and recovery plans, and if the programme meets the clauses it issues a certificate. That certificate lists a certificate number, the issuing body's accreditation, the scope of activities covered and a validity period with annual surveillance audits in between.

What is iso 22301 bcms?

BCMS stands for business continuity management system, the programme ISO 22301 certifies. It covers how a vendor identifies disruptive risks, sets recovery time objectives for critical activities, maintains continuity plans and tests them regularly. A BCMS is broader than a disaster recovery plan for IT systems alone, since it also covers people, suppliers, facilities and communications during an incident, not just data and infrastructure.

Is iso 22301?

If the question is whether ISO 22301 is a genuine, accredited certification scheme, yes, it is published by ISO and audited by accredited certification bodies in the same way as ISO 27001 and ISO 9001. If the question is whether a specific vendor holds it, check for a certificate number, issuing body and expiry date rather than a logo, since a badge alone proves nothing.
ISO 22301business continuityISO 27001BCMSvendor security
S

Solomon Amos · Founder, CertReports

Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.

Read next on CertReports

You might also like