Jordan · Certification
ISO 22301 certification in Jordan
Achieve ISO 22301 certification in Jordan with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Accredited certification
- Dubai office team
- Effivity software included
- Academy training included
Who asks for ISO 22301 in Jordan
Clients include
ISO 22301 certification in Jordan at a glance
In Jordan, ISO 22301 is asked for by buyers and schemes rather than required by law. The drivers below show where the pressure comes from.
A power cut, a ransomware attack or a flooded data room tests a Jordanian bank or hosting provider long before an auditor does. The Central Bank of Jordan lists its Instructions on Business Continuity Planning no. (27/2006) among the national regulations covered by its cybersecurity framework, its 2018 cyber risk instructions include response and recovery duties, and the Cyber Security Law No. (16) of 2019 defines cyber security to include restoring operations and continuity. None of these names ISO 22301, so certification is a choice that proves continuity arrangements are analysed, tested and improved rather than filed. Hospitals, airports, port operators and outsourcing providers face the same logic from customers. An accredited body issues the certificate, and the origin of its accreditation should be checked. Sterling's Dubai office runs business impact analysis, recovery strategies, exercises and the internal audit, with Effivity and Sterling Academy included with the engagement.
Who needs ISO 22301 in Jordan, and what happens without it
In Jordan the question rarely comes from a law. It comes from the buyer, the regulator or the partner that wants proof before it signs. These are the organisations that get asked.
- Banks, payment firms and financial institutionsThe Central Bank lists its 2006 business continuity planning instructions among the regulations entities must follow, and its framework has a section on disaster recovery and business continuity planning.
- Critical infrastructure operatorsThe Cyber Security Law defines cyber security to include the ability to restore operations and continuity, and the National Cyber Security Center publishes controls for critical infrastructure.
- Outsourcing, hosting and data centre providersCustomers ask providers to prove recovery arrangements for the services they run.
- Hospitals, airports and port operatorsInterruption affects safety and revenue, so continuity planning is a management priority and a customer expectation.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the ISO 22301 readiness checkISO 22301 requirements in Jordan
Strip away the vocabulary and ISO 22301 requires a company to prove six things about how it keeps operating when something goes wrong.
In Jordan these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: ISO 22301 explained →
How to get ISO 22301 certified in Jordan
One team from the Dubai office carries the work from scoping to certificate. Clients across Jordan are served from Sterling's Dubai office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against ISO 22301 and the Jordanian requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before the certification body arrives.
- Certification body stage 1 and stage 2, then surveillanceAn accredited body audits and decides. Sterling supports the audits and the three-year cycle.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does ISO 22301 certification take in Jordan?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Jordan these are the factors that set the timeline.
- Number of critical services, sites and dependencies in scope
- Depth of the business impact analysis and recovery strategies
- Time to run exercises and an internal audit
- Certification body scheduling around Eid and the Sunday to Thursday working week
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does ISO 22301 certification cost in Jordan?
The cost has two parts: the consulting work to build and prove the system, and the certification body’s audit fees, which are quoted separately. In Jordan these factors move both.
- Number of sites, services and staff in scope
- Testing and exercise effort
- Certification body audit fees, quoted separately from consulting
- Alternate site or recovery technology costs outside the project
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
ISO 22301 consultants and certification bodies in Jordan
Two different organisations are involved. A consultant helps you build the system and prove it works; an accredited certification body then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers ISO 22301 and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Jordan are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive ISO 22301 in Jordan (4)
| Instrument | How it treats the standard |
|---|---|
| Central Bank of Jordan Instructions on Business Continuity Planning no. (27/2006) | Listed The Bank's cybersecurity framework includes the 2006 instructions among national regulations entities must comply with; the framework also has a section on disaster recovery and business continuity planning, and neither names ISO 22301. |
| Central Bank of Jordan Instructions of Cyber Risks Resilience (2018) | Context Include a chapter on emergency cyber event response and recovery; they do not name ISO 22301. |
| Cyber Security Law No. (16) of 2019 | Context Defines cyber security as measures that include the ability to restore the work and continuity of systems, networks and critical infrastructure. |
| Jordan Accreditation System – Accreditation Unit (JAS-AU) and the recognition arrangement's member list | Accreditation The arrangement's member list dated 31 December 2025 shows JAS-AU with a product certification scope and no management systems scope, so the accreditation behind a ISO 22301 certificate must be checked; this is not a mandate. |
Accreditation, audit language and remote audits in Jordan
Use a certification body accredited for ISO 22301 by an accreditation body within the international mutual recognition arrangements (Global ACI — Global Accreditation Cooperation Incorporated, formerly the IAF MLA); check that the accreditation scope covers the standard and your sector. The arrangement's member list dated 31 December 2025 shows Jordan's accreditation unit, JAS-AU, with a product certification scope and no management systems scope, so ask which accreditation body stands behind the certificate. The accredited certification body decides, not Sterling. Edition and transition details: ISO 22301 hub →
Audit language
Arabic and English are both used in audits and documents; agree the audit language, any interpreter and the language of controlled documents with the certification body at application, and say early if interviews will run in Arabic.
Remote and on-site
Remote audit elements are at the certification body's discretion under its accreditation rules; plants, warehouses and operational sites are normally visited on-site.
ISO 22301 in Jordan: questions clients ask
Which Central Bank texts cover business continuity for Jordanian banks?
The Bank's cybersecurity framework lists its Instructions on Business Continuity Planning no. (27/2006) among the national regulations entities must follow, and it has a section on disaster recovery and business continuity planning. Neither names ISO 22301. Read the current instructions for your licence type with the Bank before designing the continuity programme.
Does ISO 22301 meet the Central Bank's cyber response and recovery expectations?
It supports them but does not replace them. The 2018 cyber instructions include a chapter on emergency cyber event response and recovery, while ISO 22301 covers impact analysis, strategies, plans and exercises across all disruptions. Map the Bank's requirements into your management system so one exercise cycle serves both, then confirm the result with the Bank.
How does business continuity differ from IT disaster recovery for a Jordanian organisation?
Disaster recovery restores technology; business continuity keeps the organisation's critical services running through any disruption, including loss of premises, staff, suppliers or utilities. ISO 22301 starts from a business impact analysis, sets recovery priorities and tests plans, and the IT recovery plan is one of its inputs. Banks and hosting firms usually need both.
Who certifies a Jordanian organisation to ISO 22301?
An accredited certification body, never Sterling or a regulator. The end-of-2025 national listing records Jordan's accreditation unit under product certification only, so ask each candidate where its accreditation originates, whether the scope names business continuity management, and which comparable financial or infrastructure clients it has audited.
More on ISO 22301 for Jordanian organisations
Other standards Jordanian businesses ask Sterling for
Organisations in Jordan often combine ISO 22301 with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Dubai office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Central Bank of Jordan Instructions on Business Continuity Planning no. (27/2006) — cbj.gov.jo (accessed 11 Oct 2026)
- Central Bank of Jordan Instructions of Cyber Risks Resilience (2018) — cbj.gov.jo (accessed 11 Oct 2026)
- Cyber Security Law No. (16) of 2019 — ncsc.jo (accessed 11 Oct 2026)
- Jordan Accreditation System – Accreditation Unit (JAS-AU) and the recognition arrangement's member list — ilac.org; iaf.nu (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Dubai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
uae@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice