Reviewed by the Aegentra Security Team — NV1-cleared ISO 27001 practitioners · Updated May 2026
A practical guide to ISO 22301 — the international standard for business continuity management systems. Built for Australian organisations facing APRA CPS 230, SOCI Act critical-infrastructure obligations, and the operational reality of natural disasters and cyber outages. Covers what the standard requires, the typical timeline, real AUD costs, the three PECB course tiers from $600 + GST, the exam format, and the credential experience ladder.
ISO 22301:2019 is the international standard for business continuity management systems (BCMS). In Australia, PECB certification training runs from $600 + GST for Foundation to $980 + GST for Lead Implementer or Lead Auditor through Aegentra, with the official exam voucher and one free resit included.
ISO 22301 sets the requirements for identifying what an organisation must keep running, analysing the impact of disruption, selecting continuity strategies, documenting and exercising plans, and improving continuity capability over time. Its technical core is the business impact analysis (BIA): establishing priority activities and the recovery objectives — RTO, RPO, and MTPD — that every continuity strategy is selected to meet. It shares the Annex SL structure with ISO 27001 and ISO 9001, so the management-system machinery carries across. View the ISO 22301 Lead Implementer course.
Four groups generate most demand: APRA-regulated entities under CPS 230 (banks, insurers, super funds), critical-infrastructure operators under the SOCI Act (energy, water, transport, communications, health, food and more), risk and resilience professionals building BCP/DR careers, and any organisation exposed to natural disaster or multi-day cyber outage. Roles include Business Continuity Manager, Resilience Manager, Operational Risk Manager, and GRC positions across financial services, utilities, health, and government.
APRA CPS 230 took effect on 1 July 2025 and requires regulated entities to identify critical operations, set board-approved tolerance levels for disruption, maintain systematically tested continuity plans, and manage material service provider risk — the BIA and exercise programme of an ISO 22301 BCMS map directly onto those obligations. The SOCI Act requires responsible entities across eleven sectors to run an all-hazards Risk Management Program covering asset availability and to report significant cyber incidents to the ACSC within 12 hours. Bushfire, flood, and ransomware seasons make continuity a practical capability, not paperwork. It pairs naturally with ISO 27001 — combined ISMS + BCMS audits are common.
ISO 22301 Foundation is $600 + GST Self-Study / $680 + GST eLearning (10–15 hours, 14 CPD credits) — the overview tier for anyone new to business continuity. ISO 22301 Lead Implementer is $980 + GST / $1,060 + GST (35–45 hours, 31 CPD credits, 450+ pages) — the practitioner tier for whoever will build and run the BCMS using PECB's IMS2 methodology. ISO 22301 Lead Auditor is $980 + GST / $1,060 + GST (35–45 hours, 31 CPD credits, 400+ pages) — for auditing a BCMS under ISO 19011 and ISO/IEC 17021-1. All prices exclude GST and include the official PECB exam voucher, one free resit within 12 months, and 12 months of myPECB access.
Foundation is a one-hour multiple-choice exam across two competency domains. Lead Implementer and Lead Auditor are three-hour open-book exams — mixed multiple-choice and scenario-based questions across seven competency domains. All have a 70% pass mark and are remotely proctored, so you can sit them from anywhere in Australia.
No experience is needed to train or sit the exam — passing earns the Provisional credential immediately. Implementer requires two years of experience (one in business continuity) plus 200 hours of project activity; Lead Implementer requires five years (two in BCM) plus 300 hours; Senior Lead Implementer requires ten years (seven in BCM) plus 1,000 hours. The Lead Auditor ladder mirrors this with audit hours. All tiers require signing the PECB Code of Ethics.
A greenfield BCMS takes an Australian SMB 12–16 weeks of readiness (8–12 with an existing ISO 27001 ISMS), followed by a Stage 1 / Stage 2 audit by an accredited certification body. Typical costs: $30,000–$60,000 greenfield readiness, $10,000–$20,000 for the certification audit, surveillance from $2,500 annually, on a three-year cycle. For the leadership layer above the BCMS, see the crisis management certification guide, or browse all Aegentra Academy courses.