ISO 22301 is the certificate banks, government entities and critical service operators ask for when they need to know you will keep delivering through a disruption. We build a business continuity management system around the activities that matter most, exercise it, and prepare you for an accredited certification body.
ISO 22301 certification in the UAE and Dubai with ESGweise: gap analysis, business impact analysis and risk assessment, continuity strategies and plans, exercise programmes, internal audit, management review and Stage 1 and Stage 2 audit support. Systems are built to ISO 22301:2019 with its 2024 climate action amendment, and mapped to NCEMA 7000 where a UAE client requires it. ESGweise is not a certification body.
What is ISO 22301 certification?
ISO 22301 certification is an accredited body's confirmation that your business continuity management system meets ISO 22301:2019, the current edition of the standard.
The standard sets the requirements for a system that prepares an organisation for disruption, keeps its priority activities running through it, and recovers them in a planned order and time.
ISO published the second edition in October 2019, replacing the 2012 edition. Amendment 1 of 2024 adds climate action: the organisation determines whether climate change is a relevant issue for its system. ISO has started a revision, and the 2019 edition remains the one certification bodies certify to. Guidance on applying it is in ISO 22313:2020. The clause structure is the same as ISO 9001, ISO 14001 and ISO/IEC 27001, so ISO 22301 fits into an integrated system.
Who needs ISO 22301 in the UAE and GCC?
Any organisation whose clients or regulators need proof that it can keep operating through a disruption; no UAE law mandates the certificate itself.
- Suppliers and outsourcing providers to banks and insurers, which are expected to show their critical providers can recover on time.
- Suppliers to government entities, where business continuity appears in prequalification and tender criteria.
- Data centres, technology and managed service providers whose outage becomes their clients' outage.
- Utilities, logistics, ports and other operators of critical services that the wider economy depends on.
NCEMA, the UAE's National Emergency Crisis and Disasters Management Authority, publishes its own National Standard for Business Continuity Management System, NCEMA 7000:2021. Where a UAE client names it, we build one system and map it to both NCEMA 7000 and ISO 22301.
How do you get ISO 22301 certified?
In six steps over six to twelve months: scope and gap analysis, business impact analysis and risk assessment, strategies and plans, exercises, internal audit and management review, then the certification audit.
Scope and gap analysis
The products, services and sites the system covers, where you stand against every clause, and a fixed quote for the rest including expected certification body fees.
Business impact analysis and risk assessment
Priority activities identified, recovery time objectives set from the impact of stopping each one, and the risks of disruption to them assessed and treated.
Strategies and plans
Continuity strategies for people, premises, technology, information and suppliers, then response and recovery plans written for the people who will use them under pressure.
Exercise and build the records
An exercise programme from tabletop walk-throughs to live recovery tests, with the lessons fed back into the plans and the records an auditor will ask for.
Internal audit and management review
An impartial internal audit of the whole system and a management review on real exercise results, both required before Stage 2.
Certification audit
Help choosing an accredited certification body, then support through Stage 1 and Stage 2 and the closure of any findings.
How much does ISO 22301 certification cost in the UAE?
Certification body fees typically run from AED 10,000 to AED 20,000 for initial certification and AED 7,000 to AED 15,000 for recertification; our own work is quoted as a fixed scope after a short call.
- Certification body, initial certification: typically AED 10,000 to AED 20,000
- Surveillance audits: smaller annual audits in years two and three
- Recertification: typically AED 7,000 to AED 15,000 every third year
- ESGweise: quoted as a fixed scope after a short call. Contact us for a quote.
How long does ISO 22301 certification take?
Six to twelve months, because the certification body needs evidence that the plans have been exercised and improved, not only written.
The business impact analysis and the first plans take the opening months. The rest goes on running exercises, fixing what they expose, and completing an internal audit and a management review. That sequence is what Stage 2 tests.
Who certifies you, and what does ESGweise do?
ESGweise prepares you; an accredited certification body, operating under ISO/IEC 17021-1, audits the system and issues the certificate.
Consultancy and certification are kept apart by the accreditation rules, and that separation is what gives the certificate its value. We have no commercial tie to any certification body, so we can help you compare them on accreditation, scope and fees across the full three-year cycle. See ISO certification in the UAE for how the audits run and ISO implementation for how the system is built.
Once you are certified, ISO certification maintenance keeps plans current and exercises on schedule between audits, and internal audit is available on its own, including business continuity internal audits for organisations already certified.
ISO 22301 Certification: questions we hear most
Is ISO 22301 mandatory in the UAE?
Not as a general legal requirement. No UAE law requires an organisation to hold an ISO 22301 certificate. It becomes a requirement through contracts and regulators: banks, government entities and operators of critical services ask suppliers for proof that they can keep delivering through a disruption, and a certificate is the most recognised form of that proof. Where a regulator sets its own business continuity rules, a certified system is strong evidence against them, but it does not replace them.
What is the difference between ISO 22301 implementation and certification?
Implementation is building and running the business continuity management system: the scope, the business impact analysis and risk assessment, continuity strategies, plans, exercises, internal audit and management review. Your organisation does it, often with a consultant. Certification is the independent two-stage audit of that system by an accredited certification body, which issues a certificate valid for three years and kept through annual surveillance audits. Under ISO/IEC 17021-1 the two stay separate. ESGweise implements and prepares; an accredited body certifies.
How much does ISO 22301 certification cost in the UAE?
There are two parts. Certification body fees typically run from AED 10,000 to AED 20,000 for initial certification, with smaller surveillance audits in years two and three and recertification at AED 7,000 to AED 15,000. Headcount, number of sites and the risk of what you do decide where you sit in each range. The second part is building the system. ESGweise quotes that as a fixed scope after a short call, with the expected certification body fees shown alongside, so the total is known before work starts. Contact us for a quote.
How long does ISO 22301 certification take?
Six to twelve months from a standing start. The business impact analysis and the plans take the first part. The certification body then needs evidence that the system works: plans exercised and the lessons acted on, a completed internal audit and a management review. An exercise programme cannot be compressed into a week before Stage 2, so the timeline is set by how soon the first exercises can run.
What is a business impact analysis?
The analysis at the centre of ISO 22301. It identifies the activities that deliver your products and services, works out how the impact of stopping each one grows over time, and sets the point by which each must be resumed before the damage becomes unacceptable. Those recovery time objectives, and the resources each activity needs to restart, decide the continuity strategies. A plan written without a business impact analysis protects whatever was easiest to think about, not what matters most.
What is NCEMA 7000 and how does it relate to ISO 22301?
NCEMA, the UAE's National Emergency Crisis and Disasters Management Authority, publishes its own National Standard for Business Continuity Management System, NCEMA 7000:2021. ISO 22301 is the international standard and the one accredited certification bodies certify to. Where a UAE government client or regulator names NCEMA 7000, we build one business continuity system and map it to both documents, so the organisation does not run two sets of plans.
Can ISO 22301 be combined with ISO 27001?
Yes, and it often should be. Both use the same harmonised clause structure, so context, leadership, risk, documented information, internal audit and management review can be shared, with one audit programme and one management review. The scopes do not have to match. Information security incidents are one of the main causes of disruption, so the incident response in an ISO 27001 system and the continuity plans in ISO 22301 should be designed together rather than side by side.
Tell us what must keep running.
Your critical services, sites and any regulator or customer requirement. We scope the business impact analysis, the continuity plans and the system around them.