AceQu

Ask an operations manager in Nairobi about the last big blackout and you’ll usually hear a version of the same story. Tills went dead, the generator ran short on diesel by mid-afternoon, and customers quietly moved to whoever was still trading.

For most firms it was a rough day. For a few, it was the week they lost an important client. That, in plain terms, is what business continuity in Nairobi comes down to: whether your organisation can keep its promises when something outside your control goes wrong.

ISO 22301 is the international standard written for exactly that problem. Below, we’ll look at what it covers, why a certificate carries more weight than a plan sitting in a shared drive, and what the process looks like for a Nairobi business.

What ISO 22301 Actually Covers

ISO 22301:2019 sets out the requirements for a Business Continuity Management System, or BCMS. Strip away the jargon and it’s a documented, tested way of spotting what could stop you trading, deciding what has to keep running, and getting back on your feet quickly.

In practice, the standard asks you to put these pieces in place:

• Business impact analysis (BIA): working out which activities matter most and how long you can realistically survive without each one.
• Risk assessment: identifying the threats most likely to interrupt those activities.
• Continuity strategies, such as an alternate site, a backup supplier or a manual workaround when systems are down.
• Written plans with named owners, so people know who does what at 6am on a bad day.
• Regular exercises and tests, because an untested plan is mostly guesswork.
• Management review, so lessons from every test or real incident feed back into the system.

You can read the standard’s official summary on ISO’s page for ISO 22301:2019, or see how we approach it on our ISO 22301 business continuity management system page.

The Disruptions Nairobi Businesses Already Know Too Well

None of these scenarios are hypothetical. Most businesses in the city have lived through at least two of them in the past few years:

• Power outages and voltage swings, from brief trips to the nationwide blackouts that have left the whole country dark for hours.
• Flash flooding during the long rains, which in 2024 cut off roads and estates across the city for days.
• Protests and CBD closures that can shut offices and shops with only a few hours’ notice.
• Outages on mobile money, banking platforms and cloud services that half the economy now leans on.
• Supply chain delays, whether that’s a fuel shortage, congestion at the Port of Mombasa or one important supplier suddenly going quiet.
• Cyber attacks and ransomware, which no longer target only the big banks.

The pattern after each event tends to repeat. Firms that had thought through the scenario were back in business within hours. The rest improvised, and some never fully recovered their customers.

Improvising isn’t always a disaster, to be fair. But it depends heavily on who happens to be in the office that day, and that’s a risky foundation for business continuity in Nairobi, where the next disruption is rarely far away. A structured system takes the luck out of it.

Why Certification Matters More Than a Plan in a Drawer

Plenty of Nairobi companies have a continuity plan. Far fewer could tell you when it was last tested, or who owns it now that the person who wrote it has moved on. Certification fixes that, because an independent auditor has to see the system working, not just read about it.

It Opens Doors to Bigger Contracts

Banks, government agencies, multinationals and international organisations based around Gigiri often ask suppliers to show how they’d keep services running during a disruption. An ISO 22301 certificate answers that question in a single line of a tender response.

It Helps With Regulator Expectations

Financial institutions supervised by the Central Bank of Kenya are expected to maintain business continuity arrangements, and insurers, pension schemes and telecoms face similar scrutiny. ISO 22301 gives you a recognised framework to meet those expectations, rather than building something from scratch.

It Makes Recovery Faster and Calmer

• Staff know their roles before an incident, not during it.
• Recovery priorities are agreed in advance, so nobody argues about what to restore first.
• Customers get clear, early communication instead of silence.
• Downtime costs fall, and some insurers look more kindly on organisations that can evidence their risk controls.

Informal Continuity Plans vs ISO 22301 Certification

Here’s how a typical homegrown plan compares with a certified BCMS once you look past the paperwork:

Which Nairobi Organisations Benefit Most

The standard is written to fit any organisation, whatever its size or sector. That said, some businesses in the city feel the pressure sooner than others:

• Banks, SACCOs and microfinance lenders, where an hour offline means frustrated members and regulator questions.
• Fintechs and payment providers whose customers expect services to work around the clock.
• BPOs, call centres and data centres serving overseas clients with strict uptime clauses.
• Hospitals, clinics and diagnostic labs, where downtime affects patients directly.
• Logistics firms along Mombasa Road and around JKIA, and manufacturers in Industrial Area.
• NGOs and suppliers to international organisations, many of which now ask for continuity evidence during procurement.

Smaller firms shouldn’t rule it out either. A 40-person company doesn’t need the same scope as a tier-one bank, and a good consultant will size the system to match.

What the Road to ISO 22301 Certification Looks Like

Every project is slightly different, but most follow a similar sequence:

1. A gap analysis to see how your current arrangements compare with the standard.
2. A business impact analysis and risk assessment focused on your real operations.
3. Continuity strategies and written plans, built around the risks that matter to you.
4. Staff training and at least one exercise to test the plans.
5. An internal audit and management review to confirm the system is working.
6. The external certification audit, carried out in two stages by an accredited certification body.

If the audit side feels unfamiliar, our guide to ISO certification audit stages explains what happens in Stage 1 and Stage 2. It’s also worth reading our checklist of documents required for ISO certification before you start, since good preparation shortens the timeline.

Budget is usually the next question, and our breakdown of ISO certification cost in Kenya covers the main factors that push the figure up or down.

It Works Alongside Standards You May Already Hold

ISO 22301 shares the same high-level structure as ISO 9001 quality management and ISO 27001 information security. If you already hold one of those, your document control, internal audits and management reviews carry straight over.

The overlap with information security is especially close. Backups, incident response and supplier controls all sit in both standards, which is why many Nairobi firms roll the two into one integrated system instead of running them side by side.

Frequently Asked Questions

How long does ISO 22301 certification take?

Most organisations take around four to six months from gap analysis to the certification audit. Firms that already run an ISO management system often move faster.

Is ISO 22301 mandatory in Kenya?

No, certification is voluntary. However, regulators, tender boards and large clients increasingly expect evidence of continuity planning, and the certificate is the simplest way to provide it.

Do we need a consultant?

You can do it yourself, but experienced help usually saves time and avoids rework. Our article on why hiring ISO consultants can speed up certification explains where outside support makes the biggest difference.

Final Thoughts

Blackouts, floods and system outages aren’t going away, so the real question is how quickly your organisation bounces back. ISO 22301 turns business continuity in Nairobi from a well-meant document into a tested system that clients, regulators and your own staff can rely on.

• It forces you to decide what matters most before a crisis, not during one.
• It gives clients and tender boards independent proof that you can deliver.
• It fits neatly beside ISO 9001 and ISO 27001 if you already hold them.

For more background on the discipline itself, see this overview of business continuity planning.