ISO 22301 Business Continuity Management
Business impact analysis, recovery time objectives, plan testing, and certification. Aligned with NESA BCM and UAE federal continuity requirements.
What you get
- ISO 22301 scope, policies and Statement of Applicability drafted to current standard
- Risk register, asset inventory and treatment plan ready for audit
- Internal audit and management review run end-to-end
- Stage 1 + Stage 2 certification audit support with major registrars
- Awareness training for your whole team — recorded and licensable
- 12-month post-cert sustainment plan
Specialised. Outcome-focused. UAE-based.
We do not sell PDFs. We embed with your team and deliver measurable outcomes.
Audit-ready in 12–16 weeks
Most clients are Stage 1-ready by week 12 for ISO 22301.
Fixed-scope pricing
One commercial. No hourly drift. Clear deliverables tied to certification.
UAE-based consultants
On-site engagement in DIFC, ADGM, JAFZA, Sharjah, Abu Dhabi free zones.
Registrar-aligned
We map to BSI, DNV, Bureau Veritas, Intertek audit checklists.
Our 4-step delivery
Gap Assessment
Where you are vs the ISO 22301 controls. Report plus roadmap delivered.
System Build
Policies, procedures, risk register, evidence package drafted with your owners.
Internal Audit
Mock Stage 1 plus Stage 2 run by our lead auditors before the registrar arrives.
Certification
We coordinate the registrar visit and hand you a 12-month sustainment plan.
Everything before kickoff
How long does ISO 22301 certification take?
Typical UAE engagements run 12 to 16 weeks from kickoff to Stage 2. Larger scope: 16 to 20 weeks.
What does it cost?
Fixed-scope pricing per engagement. UAE SME range AED 90k to 180k for a single-scope build plus audit support. Registrar fees are separate.
Which registrar should we use?
We recommend based on your customer base. BSI and DNV lead UAE federal procurement; Bureau Veritas and Intertek are strong in DIFC and ADGM.
Do we need a dedicated ISMS person after certification?
Smaller orgs can sustain with 0.3 to 0.5 FTE on an existing security lead using our runbook. Larger orgs allocate a dedicated officer.
Will our existing certifications count?
Yes — substantially. We map your SOC 2, ISO 27001, PCI DSS evidence to ISO 22301 first so you only build what is missing.
Can we add related standards later?
Yes — ISO 27701, ISO 27017, ISO 22301 can be bolted onto a working ISMS within 6 months of first cert.
Talk to our consultants
Fill in your details and we will respond within one business day with a tailored proposal.
Ready to start?
Book a free 30-minute consultation with Dr. Mohamed Atef. We will review your current state and give you an honest assessment.