ISO 22301 — business continuity.
Overview
ISO 22301 is the international standard for a Business Continuity Management System (BCMS): how an organisation prepares for, responds to, and recovers from disruptive incidents. BroadNet holds ISO 22301 certification.
What the standard is
ISO 22301:2019 specifies the requirements to plan, establish, implement, operate, monitor, review, maintain, and continually improve a BCMS. Its core is the business impact analysis (BIA) and risk assessment, which identify the organisation's most time-critical activities and the maximum tolerable disruption for each. From these, the organisation sets recovery objectives, defines continuity and recovery strategies, and validates them through regular exercising and testing. Certification is issued by an accredited registrar and maintained through surveillance audits.
Why it matters to an enterprise buyer
For messaging that carries OTPs, alerts, and transactional traffic, continuity is not optional. ISO 22301 is evidence that recovery is planned and rehearsed, not improvised during an incident.
- A tested business continuity plan rather than an untested document.
- Defined recovery-time and recovery-point objectives for critical services.
- Supplier-failure and single-point-of-failure scenarios assessed in advance.
- Regular exercises with documented results and lessons learned.
BroadNet's status
BroadNet holds ISO 22301 certification for its business continuity management system covering production messaging operations. Continuity plan summaries are shared with evaluators under NDA.
Scope & validity
The certified scope statement, certificate number, certification body and validity dates are printed on the certificate; specific RTO/RPO targets are set out in the continuity plan summary. To verify independently, search for “BroadNet” on IAF CertSearch (iafcertsearch.org), the IAF database of accredited management-system certificates. Request the continuity plan summary and current certificate under NDA at trust@broadnet.me.
Definitions
Trust artefact terminology used on this page is defined below. Acronym choices follow Shared Assessments (SIG) and Cloud Security Alliance (CAIQ) conventions.
- Audit report
- Independent attestation by a qualified auditor over a defined scope and period.
- SIG / CAIQ
- Standard Information Gathering and Consensus Assessments Initiative Questionnaire — completed annually.
- NDA
- Mutual non-disclosure agreement — pre-requisite for receiving non-public audit evidence.
- Evaluator package
- Curated bundle: certificate copies, audit letters, pen-test summary, SIG/CAIQ, and DPA.
Questions?
Need a document under NDA, an evaluator briefing, or evidence for procurement? Our trust team coordinates with security, legal, and finance.
legal@broadnet.me