787 974 136
Just a few years ago, most companies discussed with their insurers mainly the value of their assets, claims history and basic technical safeguards. Today, the situation is different. The growing number of cyberattacks, infrastructure failures, supply chain disruptions and operational issues means that insurance companies are analysing organisations’ resilience to crises in ever greater detail. This is precisely why the ISO 22301 standard is beginning to play an increasingly significant role in risk assessment and the determination of policy terms.
For businesses, this represents a significant change. ISO 22301 certification is no longer merely a factor in building a professional image. Increasingly, it is becoming a factor influencing the premium rate, the scope of cover and the insurer’s approach to the organisation as a whole.
From an insurer’s perspective, the greatest risk today is not the failure or incident itself, but the prolonged disruption to a company’s operations. The longer a business is unable to provide services, carry out production or make deliveries, the higher the costs of compensation, lost revenue and customer claims are likely to be. Insurance companies are therefore increasingly asking not only whether an organisation has safeguards in place, but also how quickly it will be able to resume operations following a crisis.
ISO 22301 addresses precisely this issue. The standard sets out a framework for business continuity management and requires the preparation of emergency procedures. The organisation identifies critical processes, analyses risks, creates response scenarios and defines how to restore operations following an incident. For the insurer, this signals that the company is proactively managing threats and minimising the risk of costly downtime.
The impact of ISO 22301 on insurance terms and conditions is not always explicitly stated in the quote. In practice, however, certification very often improves an organisation’s rating during the underwriting process. A company that has documented crisis procedures and regularly tests them is perceived as more predictable and stable.
This can be particularly significant for policies covering business interruption, cyber insurance or IT infrastructure protection. The insurer can then see that the company has a contingency plan in place, meaning the risk of a multi-week shutdown is lower. In many cases, this translates into the ability to negotiate more favourable terms or secure a broader scope of cover.
Increasingly, the certificate also helps companies in high-risk sectors. This includes, amongst others, the IT, logistics, manufacturing, e-commerce and healthcare sectors. In these areas, the lack of business continuity plans can be seen as a serious organisational shortcoming that increases the risk for the insurer.
The importance of the standard is particularly evident today in the field of cybersecurity. Just a few years ago, many companies could obtain a policy based almost exclusively on basic technical safeguards. Nowadays, insurers expect much more. It is not just a firewall or an antivirus system that counts, but also the organisation’s readiness to maintain operations following a cyberattack.
Companies are asked, among other things, about contingency procedures, data backup, system recovery time, crisis communication and incident management. ISO 22301 fits these expectations very well, as it focuses precisely on an organisation’s ability to function despite disruptions. Combined with ISO 27001, the certificate becomes a strong argument for many businesses when negotiating the terms of cyber protection.
The importance of ISO 22301 is likely to continue to grow. Insurance companies are increasingly focusing on analysing organisational resilience, rather than solely on assets or claims history. For businesses, this means that a well-prepared business continuity management system can have a tangible impact on operating costs.
Certification helps build the image of a responsible organisation that manages risk proactively and is prepared for crises. In many sectors, this is becoming important not only for customers and business partners, but also for financial institutions and insurers. As a result, ISO 22301 increasingly plays a dual role — it enhances a company’s operational security whilst simultaneously strengthening its position when negotiating policy terms.
DJB DORADZTWO
Marcin Chorąży
