They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
How ISO 22301 certification actually works — from the first gap assessment, through building and exercising the BCMS, to the certification body’s Stage 1 and Stage 2 audits and the three-year certificate cycle. Written for teams facing a bank, regulator, or contract deadline in the Gulf, Australia, or beyond.
Guided by the consultants who prepared ADIB (Abu Dhabi Islamic Bank), Mashreq Bank, and AMEX for ISO 22301 in the Middle East — TCSA prepares you. An independent accredited certification body issues the certificate.
1,000+audits across India, USA, UK, Australia & UAE
300+SOC 2 engagements to date
8–14weeks to certification-ready
ISO/IEC 22301:2019 · Stage 1 & Stage 2 by accredited bodies · Last reviewed June 2026
Key Takeaways
- ISO 22301 certification follows a fixed sequence: readiness and gap assessment, BCMS build, at least one exercise cycle, internal audit and management review — then the certification body’s Stage 1 (documentation) and Stage 2 (implementation evidence) audits.
- TCSA prepares you but never certifies you — accreditation rules keep consultants and certifiers separate. We coordinate with independent accredited bodies such as TÜV, BSI, and DNV, which conduct the audits and issue the certificate.
- Stage 2 auditors sample evidence, not intentions: BIA results and sign-offs, exercise reports, internal audit reports, management review minutes, corrective actions, and communication tests.
- A typical single-scope organisation is certification-ready in 8–14 weeks. The certificate then runs a three-year cycle with annual surveillance audits and full recertification in year three.
- Engagements are custom-scoped — headcount, sites, and whether an existing ISO 27001 ISMS can be reused all move the effort — with a fixed, all-inclusive quote after a scoping call.
The Path
Seven Steps From Gap to Certificate
The sequence is fixed by the standard and the accreditation rules — you cannot book Stage 2 without an internal audit, and you cannot pass it without exercise evidence. Here is the order that works.
1
Readiness & gap assessment
Assess current continuity arrangements against every ISO 22301:2019 requirement, define the BCMS scope and the products and services it protects, and turn the gaps into a sequenced remediation plan with your regulator or contract deadline as the anchor.
2
Build the BCMS
Run the business impact analysis and set RTO/RPO/MTPD, assess disruption risks, select and resource continuity strategies, then document the policy, response structure, business continuity plans, and recovery procedures.
3
Exercise the plans
Launch the exercise programme — tabletop walkthroughs first, scenario-based exercises after — so that real exercise reports and closed corrective actions exist before any external auditor arrives. Stage 2 cannot pass without them.
4
Internal audit & management review
An impartial internal audit covers every clause, top management reviews the BCMS with the required inputs and records decisions, and the findings are closed. These two records are explicit preconditions for Stage 1.
5
Stage 1 — documentation review
The certification body reviews your documented BCMS: scope, policy, BIA, strategies, plans, and the internal audit and management review records. It confirms readiness for Stage 2 and lists any areas of concern to fix first.
6
Stage 2 — certification audit
Auditors test implementation through interviews and record sampling — including exercise results. Nonconformities are classified major or minor. Once they are addressed, the auditor recommends certification.
7
Certificate & the 3-year cycle
After an independent technical review, the body issues a certificate listing your scope and sites, valid for three years — with annual surveillance audits in years one and two and a full recertification audit in year three.
The detailed requirements behind each step are covered in our clause-by-clause requirements guide, and the week-by-week build is in the implementation roadmap.
The Timeline
An Indicative 14-Week Schedule
For a single-scope organisation starting from limited maturity. Multi-site groups run longer, while an existing ISO 27001 ISMS shortens the governance phases. Phases overlap deliberately.
| Phase | Indicative timing | What happens | Key output |
|---|---|---|---|
| Phase 1 — Readiness & gap assessment | Weeks 1–2 | Current state assessed against all of Clauses 4–10. BCMS scope, interested parties, and regulatory deadlines defined. Remediation plan agreed. | Gap report & project plan |
| Phase 2 — BIA & risk assessment | Weeks 2–5 | Business impact analysis ranks products and services and sets RTO, RPO, and MTPD. Disruption risks to prioritised activities assessed. | Signed-off BIA & risk assessment |
| Phase 3 — Strategies, plans & documentation | Weeks 5–9 | Continuity strategies selected and resourced. Policy, response structure, business continuity plans, and recovery procedures drafted and controlled. | Controlled BCMS document set |
| Phase 4 — Exercises & embedding | Weeks 8–11 | Exercise programme launched. Tabletop and scenario exercises run with post-exercise reports. Awareness rolled out across continuity roles. | Exercise reports & closed actions |
| Phase 5 — Internal audit & management review | Weeks 10–12 | Impartial internal audit across all clauses. Management review held with required inputs. Corrective actions closed before the external audit. | Audit report & review minutes |
| Phase 6 — Stage 1 audit | Week 12 (scheduled with the CB) | Certification body reviews documentation and readiness, confirms scope, and flags areas of concern to resolve before Stage 2. | Stage 1 report |
| Phase 7 — Stage 2 audit & certificate | Weeks 13–14 | Implementation evidence sampled — interviews, records, exercise results. Findings closed. Auditor recommends certification, and the certificate follows the body’s technical review. | ISO 22301 certificate |
Stage 1 and Stage 2 dates depend on the certification body’s scheduling — we book them early in the engagement so your regulator or contract deadline drives the plan, not the audit calendar.
Stage 2 Evidence
What Auditors Actually Sample
Stage 2 is an evidence audit, not a conversation. This is the sampling list we prepare every client against — if each item is on the table before the auditor asks, the audit is short.
- BIA methodology, results, and management sign-off — with review dates that postdate your last organisational change
- The disruption risk assessment tied to prioritised activities, not a generic risk register
- Traceability from each RTO/RPO target to a resourced strategy and a documented plan
- The exercise programme, scenarios used, post-exercise reports, and actions raised
- Evidence that corrective actions from exercises and incidents were closed and verified
- Internal audit programme, reports, and proof the auditor was impartial
- Management review minutes covering the required inputs, with decisions and owners
- Warning-and-communication arrangements — including contact-list currency and any notification tests
- Continuity arrangements for critical suppliers and outsourced processes
- Staff interviews: people in continuity roles describing what they would actually do
Who Certifies You
Consultants Prepare. Accredited Bodies Certify.
The separation is not a TCSA policy — it is how the accreditation system is built, and it is what makes the certificate worth something to the bank reading it.
TCSA prepares — accredited bodies certify
Accreditation rules (ISO/IEC 17021-1) require the consultant who builds your BCMS and the body that audits it to be independent. TCSA runs the gap assessment, BIA, documentation, exercises, and internal audit. An accredited certification body conducts Stage 1 and Stage 2 and issues the certificate.
Choose an accredited body
Only certificates from bodies accredited for ISO 22301 by a recognised national accreditation body carry weight with regulators and bank vendor-assessment teams. TÜV, BSI, and DNV are examples of the accredited bodies we coordinate with — Gulf banks recognise all the major international names.
We manage the audit logistics
TCSA helps you shortlist bodies, obtain comparable audit-day quotes, schedule Stage 1 and Stage 2 against your regulator deadline, and sit beside you during both stages — walking auditors through evidence and closing findings fast.
After the Certificate
The Three-Year Certification Cycle
Certification is a cycle, not an event. The certificate stays valid only while surveillance audits keep finding a living system — exercises run, reviews held, actions closed.
Year 0 — certificate issued
After the Stage 2 recommendation passes the certification body’s independent technical review, the certificate is issued listing your scope, sites, and the standard — valid for three years.
Years 1 & 2 — surveillance audits
Annual surveillance audits sample the live system: internal audits, management reviews, corrective actions, and fresh exercise evidence, plus rotating clause coverage. The exercise programme must keep producing results between visits.
Year 3 — recertification
A full recertification audit re-examines the whole BCMS before the certificate expires, and the three-year cycle restarts. Organisations that exercised and improved throughout treat it as routine.
Many clients keep TCSA engaged after certification for exercise facilitation, internal audits, and surveillance preparation — see our operational resilience services.
“Stage 2 is won or lost months earlier — in the exercise programme. An auditor can forgive a thin procedure, but they cannot forgive a plan that has never been tested. We never send a client into Stage 2 without exercise reports the auditor can pull apart.”
See verified client reviews and audit outcomes from 1,000+ audits across India, USA, UK, Australia and UAE.
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
ISO 22301 Certification — Frequently Asked Questions
Straight answers about Stage 1, Stage 2, and the three-year cycle from the consultants who sit beside you in both audits.
What are the steps to ISO 22301 certification?
Seven, in a fixed order: a readiness and gap assessment against the standard, building the BCMS (BIA, risk assessment, strategies, plans), exercising the plans so real evidence exists, an impartial internal audit plus a management review, the certification body’s Stage 1 documentation review, the Stage 2 implementation audit, and finally the certificate, which runs on a three-year cycle with annual surveillance audits. A typical single-scope organisation is certification-ready in 8–14 weeks of preparation.
What is the difference between the Stage 1 and Stage 2 audits?
Stage 1 is a documentation and readiness review: the auditor checks your BCMS documents — scope, policy, BIA, strategies, plans — and confirms the internal audit and management review have happened, flagging areas of concern to fix before proceeding. Stage 2 tests implementation: interviews with leadership and continuity teams, sampling of records, and scrutiny of exercise results. Stage 1 asks “is the system designed and described?” Stage 2 asks “does it actually operate?”.
Can you fail the ISO 22301 certification audit?
Yes — Stage 2 findings are classified as major or minor nonconformities. A major (for example, no exercise evidence, no internal audit, or a missing BIA) blocks certification until corrective action is taken and verified, sometimes requiring a follow-up visit. Minors require a corrective-action plan but do not block the certificate. Preparation is how you avoid both: TCSA’s internal audit applies the same lens the certification body will.
Who can issue an ISO 22301 certificate?
Only independent certification bodies accredited for ISO 22301 by a recognised national accreditation body — TÜV, BSI, and DNV are well-known examples we regularly coordinate with. Consultants cannot certify their own work. The accreditation rules deliberately separate the two roles. When a bank or regulator reviews your certificate, the issuing body’s accreditation is one of the first things its vendor-assessment team checks.
What happens during surveillance audits?
In each of the two years after certification, the certification body returns for a shorter surveillance audit. It always checks the heartbeat of the system — internal audits, management reviews, corrective actions, and recent exercise reports — plus a rotating sample of other clauses, changes to scope, and use of the certification mark. The practical implication: your exercise programme and review cadence must keep producing evidence year-round, not just before audits.
How much does ISO 22301 certification cost?
There are two components, and we deliberately quote neither as a flat figure. TCSA’s preparation work is custom-scoped to your headcount, sites, existing maturity, and deadline, and confirmed as a fixed, all-inclusive quote after a short scoping call — no hourly billing, no scope creep. The certification body’s Stage 1 and Stage 2 audit fee is quoted separately by that body, based on audit-day calculations driven by your size and scope. An existing ISO 27001 ISMS typically reduces the preparation effort, since the governance machinery is shared.
Keep Exploring
Related Reading
ISO 22301
ISO 22301 Knowledge Hub
Every guide in the business-continuity cluster, in one place.
Read moreISO 22301
ISO 22301 Requirements
Clauses 4–10 explained, with what auditors actually look for.
Read moreISO 22301
Implementation Roadmap
The 7-phase build, week by week, with deliverables per phase.
Read moreISO 22301
Business Impact Analysis
RTO, RPO and MTPD — the analysis every continuity decision flows from.
Read moreService
Operational Resilience Consulting
One ISO 22301-grade BCMS that answers CBUAE, SAMA, CPS 230 and DORA.
Read moreTrust
Proof & Track Record
Every number we publish — explained, sourced and verifiable.
Read more