ISO 22301:2019 — Business Continuity

A BIA identifies your organisation's critical activities, their dependencies, and the impact of disruption over time. It is a core requirement of ISO 22301 and forms the basis of your continuity strategy.

Yes — it covers all types of disruptive incidents including cyber attacks, natural disasters, pandemics, supply chain failures, and key personnel loss. It complements ISO/IEC 27001 for information security. ISO/IEC 27001 is a By CAS scheme, outside the EGAC accredited scope.

Yes. CAS is accredited by EGAC, the Egyptian Accreditation Council, as a certification body under ISO/IEC 17021-1:2015 (accreditation certificate 012418A, schedule 012418B), valid to 27 November 2029. ISO 22301:2019 business continuity is one of the six standards in that accredited scope, and CAS audits it under ISO/IEC TS 17021-6:2014, the certification-body requirement specific to business continuity management systems.

No. ISO 22301 is within CAS's EGAC accreditation, but business continuity is outside EGAC's IAF MLA scope. An accredited CAS ISO 22301 certificate therefore carries the EGAC accreditation mark and appears on the EGAC register, without the IAF MLA mark. The five standards within EGAC's IAF MLA scope are ISO 9001, ISO 14001, ISO 45001, ISO 22000 and ISO 50001.

Amendment 1:2024 is the climate action change ISO published for ISO 22301:2019 and other management system standards. It adds two requirements: in clause 4.1 the organisation shall determine whether climate change is a relevant issue, and clause 4.2 gains a note stating that relevant interested parties can have requirements related to climate change. The CAS scheme is ISO 22301:2019 + Amd.1:2024, and CAS incorporates these requirements into all certification audits.

An accredited CAS certificate is valid for 3 years. Annual surveillance audits in Year 1 and Year 2 verify that the business continuity management system continues to meet the requirements of ISO 22301 and that previously identified nonconformities have been addressed. A full recertification audit in Year 3 renews the certificate for a further cycle.

Certification follows two stages. Stage 1 reviews your documentation, confirms the scope of certification and checks readiness. Stage 2 is the full on-site audit against every requirement of ISO 22301: context and leadership, the business impact analysis and risk assessment, business continuity strategies and solutions, plans and procedures, the exercise programme, performance evaluation, management review and improvement. Nonconformities identified must be corrected before the certificate is issued.

Yes. ISO 22301 requires an exercise programme that tests business continuity strategies, solutions and plans over time, with results reviewed and acted on. It also requires the organisation to evaluate its business continuity documentation and capabilities. During the audit, certification checks that exercises have taken place as planned, that they are recorded, and that lessons from them feed into corrective action and improvement.

Yes. CAS conducts integrated audits covering multiple ISO management system standards simultaneously, in accordance with IAF MD 11:2023. ISO 22301 shares the harmonised structure used by ISO 9001, ISO 14001 and ISO/IEC 27001, so common clauses such as context, leadership, planning and management review can be audited once. You receive separate certificates for each standard. ISO/IEC 27001 is a By CAS scheme, outside the EGAC accredited scope.

CAS is accredited for business continuity management across all sectors; no IAF technical-code restriction applies to ISO 22301 in EGAC schedule 012418B. This differs from ISO 9001, ISO 14001 and ISO 45001, where the schedule lists specific IAF technical sectors. The full per-standard scope is published on our Accreditation page, together with the schedule of accreditation itself.