Enterprise resilience certification follows a broadly similar path whichever scheme an organisation chooses: agree the scope, complete a structured self-assessment, assemble evidence, sit the assessment, close the findings, and then keep the thing alive. Below is what each of those stages actually involves, and where organisations most often come unstuck.
Certification begins with an argument about scope, and it is worth having that argument properly. An organisation has to decide which legal entities, sites, business units and systems are inside the boundary. Scoping the whole group sounds impressive and usually produces a shallow assessment; scoping one division produces a mark that says less but means more. Assessors will ask why the boundary sits where it does, and “that is where the evidence was easiest to collect” is a legitimate answer only if the resulting mark is described honestly.
Expect to agree the standard being applied, the domains in scope, the evidence formats accepted, and how long the mark will be valid. Two years is common; anything longer without a surveillance check should make a buyer suspicious.
Most schemes run a workshop that walks the organisation through the framework, then hand over a structured self-assessment. This is not a formality. The self-assessment is where an organisation discovers, usually with some discomfort, that its business impact analysis is four years old, that nobody can say who owns the crisis communications plan, or that the recovery time objective for a critical system was set by someone who has since left.
Good practice is to complete the self-assessment honestly and early, then use the gap between the self-score and the assessed score as a measure of how well the organisation actually knows itself. A large gap is not a failure; a large gap that surprises the executive team is.
The evidence pack is the heart of it. Typical requests include the current business impact analysis, dependency maps, recovery objectives with the rationale behind them, the last two exercise reports and the actions arising, incident post-mortems, the contact data refresh process and its most recent run, third-party risk assessments for critical suppliers, and the governance record showing what the board was told and when.
What separates a strong pack from a weak one is almost never volume. It is whether documents show change over time. A plan revised after an exercise, with the reason for the revision recorded, is worth more than fifty pages that have never been touched.
The assessment itself is usually a mix of document review and interviews, typically over one to three weeks depending on scope. Interviews reach beyond the resilience team on purpose: a plan that only the business continuity manager understands is not a capability. Assessors will often ask a site manager, an on-call engineer or an HR lead to describe what they would do, and compare that against what the plan says.
Some schemes include an observed exercise. Where they do, it is the single most informative part of the process, and it is worth choosing a scheme that includes one even though it costs more.
The output is a scored report with findings ranked by severity, benchmarked against comparable organisations where the scheme has enough data to do so credibly. Most organisations receive at least some findings that must be closed before the mark is awarded; a scheme where nobody is asked to remediate is not assessing hard enough to be useful.
Once awarded, the mark comes with rules about how it may be displayed — which entities it covers, the valid dates, and where it may and may not appear. Those rules matter, because a mark used outside its scope misleads customers and devalues the scheme for everyone holding it legitimately.
Resilience decays. Staff turn over, systems are replaced, suppliers change, and a plan that was accurate in March is quietly wrong by November. Serious schemes therefore require an annual check-in or a surveillance assessment, and re-certification on a fixed cycle. Treat the certification cycle as the forcing function it is: it is often the only reason exercise findings get closed at all.
What this page is not. This site does not run assessments and does not issue certifications. The steps above describe how enterprise resilience certification schemes generally work, so that an organisation can compare the schemes available to it and ask better questions of the bodies that do issue them.
