Kenya · Certification
ISO 22301 certification in Kenya
Achieve ISO 22301 certification in Kenya with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Accredited certification
- Nairobi office team
- Effivity software included
- Academy training included
Who asks for ISO 22301 in Kenya
Clients include
ISO 22301 certification in Kenya at a glance
In Kenya, ISO 22301 is asked for by buyers and schemes rather than required by law. The drivers below show where the pressure comes from.
Continuity planning appears in Kenyan financial supervision as a duty to define, document and test, rather than as a named standard. The Central Bank of Kenya's Guidance Note on Cybersecurity defines business continuity management for institutions licensed under the Banking Act, its September 2026 draft Risk Management Guidelines expect documented and regularly tested continuity arrangements, and payment service providers must report material service interruptions under the National Payment System Regulations, 2014. Owners of critical information infrastructure also answer to NC4 under the Computer Misuse and Cybercrimes Act, 2018. The Kenya Accreditation Service lists competence requirements for business continuity certification but not ISO 22301 among its African Accreditation Cooperation sub-scopes, so ask each body which accreditation backs its certificates. Certificates come from accredited certification bodies, never from Sterling. Sterling's Nairobi office runs impact analysis and exercises on-site or remotely, with Effivity and Sterling Academy included and 20+ years of practice.
Who needs ISO 22301 in Kenya, and what happens without it
In Kenya the question rarely comes from a law. It comes from the buyer, the regulator or the partner that wants proof before it signs. These are the organisations that get asked.
- Banks and licensed financial institutionsThe CBK's guidance note defines business continuity management, and its draft risk guidelines expect documented, regularly tested continuity arrangements for ICT interruptions.
- Payment service providers and mobile money platformsMaterial service interruptions are reportable to the CBK, which makes recovery capability a regulatory topic.
- Owners of critical information infrastructureNC4 reviews compliance and audit reports on designated infrastructure, where continuity of service is central.
- Data centres, telecoms and logistics operatorsCustomers ask for tested recovery arrangements before they place critical workloads.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the ISO 22301 readiness checkISO 22301 requirements in Kenya
Strip away the vocabulary and ISO 22301 requires a company to prove six things about how it keeps operating when something goes wrong.
In Kenya these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: ISO 22301 explained →
How to get ISO 22301 certified in Kenya
One team from the Nairobi office carries the work from scoping to certificate. Clients across Kenya are served from Sterling's Nairobi office, on-site where the work needs it and remotely otherwise.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against ISO 22301 and the Kenyan requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before the certification body arrives.
- Certification body stage 1 and stage 2, then surveillanceAn accredited body audits and decides. Sterling supports the audits and the three-year cycle.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does ISO 22301 certification take in Kenya?
There is no standard duration: it depends on your scope and on how much of the system already runs. In Kenya these are the factors that set the timeline.
- Critical services, sites and dependencies in scope
- Maturity of business impact analysis, risk assessment and recovery strategies
- Testing history and ability to evidence exercises
- Certification body scheduling and customer expectations
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does ISO 22301 certification cost in Kenya?
The cost has two parts: the consulting work to build and prove the system, and the certification body’s audit fees, which are quoted separately. In Kenya these factors move both.
- Number of sites, services and staff in scope
- Recovery site, backup and tooling investments
- Certification body audit fees quoted separately from consulting
- Exercises and plan documentation remediation
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
ISO 22301 consultants and certification bodies in Kenya
Two different organisations are involved. A consultant helps you build the system and prove it works; an accredited certification body then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers ISO 22301 and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in Kenya are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive ISO 22301 in Kenya (4)
| Instrument | How it treats the standard |
|---|---|
| CBK Guidance Note on Cybersecurity (August 2017) | Does not name ISO 22301 Defines business continuity, business continuity management and business continuity plans for institutions licensed under the Banking Act. |
| CBK draft Risk Management Guidelines (September 2026) | Does not name ISO 22301 The draft expects documented continuity strategies, plans for communicating and regularly testing them and arrangements that fit the institution's nature, scale and complexity; it is a draft and not yet in force. |
| National Payment System Regulations, 2014 | Does not name ISO 22301 Payment service providers report material service interruptions and major security breaches to the CBK. |
| KENAS certification scheme | Scheme rule KENAS's certification scheme page lists competence requirements for auditing and certification of business continuity management systems (ISO/IEC TS 17021-6); the AFRAC certificate does not list ISO 22301 as a sub-scope. |
Accreditation, audit language and remote audits in Kenya
Choose a certification body accredited for this standard by the Kenya Accreditation Service (KENAS) or by an accreditation body within the international mutual recognition arrangements (Global ACI — Global Accreditation Cooperation Incorporated, formerly the IAF MLA); check that the accreditation scope covers the standard and your sector. KENAS's certification scheme page lists competence requirements for business continuity management system certification, but ISO 22301 is not shown among the sub-scopes on its AFRAC certificate, so ask each body which accreditation backs its certificates and confirm that your regulator or customer accepts it. Edition and transition details: ISO 22301 hub →
Audit language
Kiswahili and English are the official languages and English is the usual language of business records, standards and tenders; interviews on the shop floor or with suppliers may run in Kiswahili or another local language. Agree the audit language, any interpreter and the language of controlled documents with the certification body at application.
Remote and on-site
Audits review business impact analyses, plans and exercise records, and may witness an exercise; interviews and document review can be remote at the certification body's discretion, while operations rooms are normally visited.
ISO 22301 in Kenya: questions clients ask
Does the CBK require ISO 22301 for banks?
No ISO standard is named. The CBK's Guidance Note on Cybersecurity defines business continuity management for licensed institutions, and its September 2026 draft risk guidelines expect documented, regularly tested continuity arrangements. The draft is not yet in force. Confirm what applies to your licence with the CBK.
Must payment service providers report service interruptions?
Yes, under the National Payment System Regulations, 2014 payment service providers report material service interruptions and major security breaches to the CBK, and the regulations name no continuity standard. A tested continuity plan helps you meet that duty. Ask the CBK how it expects the reports to reach it.
Is ISO 22301 listed in KENAS's AFRAC sub-scopes?
No. KENAS's certification scheme page lists competence requirements for business continuity management system certification, but ISO 22301 is not among the sub-scopes on its AFRAC certificate. Ask the body which accreditation backs its certificates, and check that your regulator or customer accepts it before you start.
What shapes the effort of ISO 22301 in Kenya?
Start with the critical services, sites and dependencies you place in scope. Business impact analysis, risk assessment and recovery strategies must be mature, and you need to show exercises you have run. Certification body scheduling and customer expectations then fix the timetable, so plan an exercise before the audit.
More on ISO 22301 for Kenyan organisations
Other standards Kenyan businesses ask Sterling for
Organisations in Kenya often combine ISO 22301 with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Nairobi office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- CBK Guidance Note on Cybersecurity (August 2017) — centralbank.go.ke (accessed 11 Oct 2026)
- CBK draft Risk Management Guidelines (September 2026) — centralbank.go.ke (accessed 11 Oct 2026)
- National Payment System Regulations, 2014 — centralbank.go.ke (accessed 11 Oct 2026)
- KENAS certification scheme — kenas.go.ke (accessed 11 Oct 2026)
- Kenya Accreditation Service (KENAS) — kenas.go.ke; ilac.org (accessed 11 Oct 2026)
Talk to a consultant
Plan your certification with the Nairobi team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Nairobi office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice