The ISO 22301
Implementation Roadmap

Plan on 8–14 weeks for a single-scope organisation: scoping and gap assessment in weeks 1–2, the BIA and risk assessment by week 5, strategies and plans through week 9, exercises by week 11, internal audit and management review by week 12, and the certification body’s Stage 1 and Stage 2 audits in weeks 12–14. Multi-site groups and complex supply chains run longer; an existing ISO 27001 ISMS shortens the governance phases because the Annex SL machinery is shared.

Scoping — before any documentation. Define the products and services the BCMS protects, the sites in scope, the interested parties (the bank, regulator, or contract that set your deadline), and the legal and contractual continuity requirements that apply. Then run a gap assessment against all of Clauses 4–10. Everything that follows — the BIA, the strategies, the plans — inherits its boundaries from this step, which is why a scope written around departments instead of products and services causes rework for the rest of the project.

Yes — the standard does not require a consultant, and ISO 22313 provides implementation guidance. The honest trade-offs are time and audit risk: an internal team doing this for the first time typically takes two to three times longer, and the most common self-build failures (plans before the BIA, unresourced strategies, no impartial internal audit) only surface at Stage 2, when fixing them is most expensive in calendar terms. Many clients split the difference: TCSA runs the BIA, the exercise design, and the internal audit — the three places experience moves the result most — while their team owns the system day to day.

Follow the dependency chain: scope and context records first, then the BIA and risk assessment, then strategy selections, then the policy, response structure, and continuity plans, and finally the exercise, audit, and review records the operating system produces. The one document teams most often write first — the business continuity plan — is the one that depends on everything else. A plan can only be as good as the recovery targets it serves, and those come from the BIA.

Substantially. Both standards share the Annex SL structure, so your context analysis, document control, competence and awareness machinery, internal audit programme, and management review cadence are largely reusable — and ISO 27001’s Annex A controls 5.29 and 5.30 mean some continuity thinking already exists. What remains genuinely new is the operational core: the BIA, the disruption risk assessment, continuity strategies and plans, and the exercise programme. We scope integrated engagements so the shared layer is extended once, not rebuilt.

Every engagement is custom-scoped — headcount, number of sites, products in scope, your regulator or contract deadline, and whether an existing ISO 27001 ISMS can be reused all move the effort. After a short scoping call you receive a fixed, all-inclusive quote covering the gap assessment, BIA, risk assessment, strategies, documentation, exercises, internal audit, and certification-audit support — no hourly billing, no scope creep. The accredited certification body’s Stage 1 and Stage 2 audit fee is quoted separately by that body, because the consultant and the certifier must remain independent.