Why ISO 22301, and why here
ISO 22301:2019 is the international standard for business continuity management systems — the one your global clients, parent companies and certification bodies recognise. In the UAE it lives alongside NCEMA 7000, the national standard whose structure deliberately mirrors it. That alignment is your leverage: one well-built system, documented once, satisfies both — if you plan for it from the start rather than retrofitting.
The implementation sequence
- 1 · Scope and gap (weeks 1-3). Define what the BCMS covers — entities, facilities, activities — and assess the current state against every clause. Output: a gap register priced in effort and downtime risk.
- 2 · Leadership and policy (week 4). A short signed policy, named accountability, objectives. Clause 5 is small on paper and decisive in audits: certification interviews start at the top.
- 3 · BIA and risk assessment (weeks 5-8). The money-first BIA described in our method guide, plus the risk assessment. This pair carries the whole system.
- 4 · Strategies and plans (weeks 9-14). Continuity strategies per prioritised activity, the BCP, technology recovery, first-hours structure with written authority.
- 5 · Exercise and correct (weeks 15-18). A realistic test with timings and findings; fix what broke; document the loop. Auditors read exercise reports before they read plans.
- 6 · Internal audit and management review (weeks 19-22). Clause 9 in action — an independent look, a leadership review, decisions recorded.
- 7 · Certification (weeks 23-26). Stage 1: documentation readiness. Stage 2: on-site effectiveness — interviews, evidence, the exercise trail. Then annual surveillance audits.
Total realistic timeline for a mid-size organisation: about six months to certification-ready. Compressing below four usually produces a paper system that stage 2 interviews expose.
What drives the cost
| Driver | Why it matters | How to control it |
|---|---|---|
| Scope breadth | Every added entity and facility multiplies interviews, plans and evidence | Certify the critical core first; extend scope at surveillance |
| Current maturity | A working DR capability and recent BIA cut months | Run the gap assessment before budgeting, not after |
| Internal availability | Activity owners' time is the scarcest input | Batch interviews; one strong coordinator beats a large committee |
| Dual-standard alignment | NCEMA terminology and supplier-evaluation extras | Design documents once with both standards mapped |
Frequently asked questions
Is ISO 22301 certification mandatory in the UAE?
No. It is voluntary — but tenders, parent companies and international clients ask for it, and for regulated sectors it is strong evidence toward NCEMA 7000 and CBUAE expectations. Which requirement binds you depends on sector; see our NCEMA and CBUAE guides.
Can we implement without a consultant?
Yes, with a competent internal lead and leadership time. Where external help pays back is the BIA (method discipline), the exercise (independent pressure) and pre-certification review (an auditor's eye before the auditor).
How much does certification cost?
Certification-body fees depend on headcount and sites; the larger cost is internal effort. The honest budgeting order: gap assessment first, then price remediation from the register — never the other way around.
ISO 22301 or NCEMA 7000 first?
Build once, map both. If your clients are local and governmental, lead with NCEMA 7000 alignment; if international recognition drives you, lead with ISO certification. The system underneath is the same.