ISO 22301 business continuity management in Georgia

What ISO 22301 is

ISO 22301:2019 sets requirements for a business continuity management system (BCMS). It was amended in 2024 to add climate change considerations. The standard asks you to identify which activities matter most, decide how quickly each must be restored after a disruption, put continuity and recovery plans in place, and prove through exercises that the plans work. It covers people, premises, IT, suppliers and communication, not only data centre recovery.

Why it is relevant in Georgia

Several features of the Georgian market make continuity planning a practical question rather than a formality:

• Financial sector supervision. The National Bank of Georgia supervises banks, microfinance organisations and payment service providers and has issued regulation on cybersecurity management for commercial banks. Supervisors and correspondent banks expect tested recovery capability for critical services.
• Critical information systems. The Law of Georgia on Information Security, as amended in 2021, groups critical information system subjects into categories, including private sector entities such as banks and electronic communications companies, and gives the Operational-Technical Agency regulatory powers. Availability of these systems is part of their security obligations.
• Transit and logistics. Georgia is a link in the transport corridor between Europe and Central Asia through the ports of Poti and Batumi. Freight forwarders, terminals and carriers depend on IT systems, fuel, border processes and a small number of key staff.
• Service exports. IT, outsourcing and contact centre companies serving foreign clients are asked for continuity plans and test results in contracts and audits.

How BALTUM prepares you

1. Scope and context. We agree which products, services and locations are in scope and identify relevant legal, regulatory and contractual requirements.
2. Business impact analysis (BIA). We work with process owners to determine the impact of disruption over time and to set the maximum tolerable period of disruption, RTO and RPO for each activity.
3. Risk assessment. We assess the threats that could cause disruption, from power and network failure to supplier loss, cyber incidents and extreme weather.
4. Strategies and plans. We help choose continuity strategies and write incident response, business continuity and IT recovery plans that people can follow under pressure.
5. Exercises. We design and facilitate a tabletop exercise and, where possible, a technical recovery test, and record lessons learned.
6. Internal audit and management review. We audit the BCMS and prepare the management review.
7. Certification support. We help choose an accredited certification body and support you during the audits.

The duration depends on the number of critical activities, sites and IT systems in scope. We agree the plan after the first assessment.

How certification works

A certification body audits the BCMS in two stages. In stage 2 the auditor expects to see a completed BIA, approved plans and records of at least one exercise. The certificate is valid for three years with annual surveillance audits. Prefer a certification body accredited by an IAF MLA signatory and check certificates in IAF CertSearch.

Related standards and reading

ISO 22301 works closely with ISO/IEC 27001, which requires information security during disruption and ICT readiness for business continuity. Financial organisations should also read cybersecurity requirements for banks and financial companies in Georgia. Our guide on internal audit and management review covers the last steps before the certification audit.

To discuss your critical services and scope, send a short description through the request form or to info@baltum.org.

Frequently asked questions

What is the difference between ISO 22301 and a disaster recovery plan?

A disaster recovery plan covers IT systems. ISO 22301 covers the whole organisation: people, premises, suppliers, communication and IT, and requires you to test and improve the plans regularly.

Do we need a second data centre to get certified?

Not necessarily. The standard requires strategies that meet the recovery objectives you set in the BIA. These may be a backup site, cloud recovery, manual workarounds or supplier arrangements, depending on your risks and budget.

How often do we need to test our plans?

The standard requires exercises at planned intervals and after significant changes. Most organisations run at least one exercise a year, and the certification auditor will ask for the records.