ISO 22361:2022

International

v2022 (first edition)

6 domains

49 controls

ISO 22361:2022 is the ISO guidance on crisis management: the nature, characteristics and origins of crises; the seven principles of governance, strategy, risk management, decision-making, communication, ethics and learning; a capability built on a framework of leadership, structure, culture and competence and a process of anticipation, assessment, prevention and mitigation, preparedness, response, recovery and continual improvement; crisis leadership and the crisis leader's responsibilities; strategic decision-making under uncertainty; crisis communication from the pre-crisis plan to social media; and training, exercising, validation and learning.

Verified

ISO 22361:2022 is a compliance framework from International with 6 domains and 49 controls. The largest domains are Clause 5: Building a crisis management capability – ISO 22361:2022 (12 controls), Clause 4: Context, core concepts and principles – ISO 22361:2022 (11 controls), Clause 8: Crisis communication – ISO 22361:2022 (11 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard Blokdyk

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (6)

Clause 4: Context, core concepts and principles – ISO 22361:2022

11 controls

Controls in the Clause 4: Context, core concepts and principles – ISO 22361:2022 domain of ISO 22361:2022 — 11 controls
Code	Title	Description
iso-22361-2022::4.1	The nature of crises	Crises can be associated with highly complex issues whose full implications and nature are unclear at the time. Possible...
iso-22361-2022::4.2	Characteristics of a crisis	A crisis can be complex and challenging and can also give an organization the opportunity to demonstrate core values, ef...
iso-22361-2022::4.3	Potential origins of crises	Crises can be caused in a number of ways. The held opening names disruptive incidents with immediate and strategic impli...
iso-22361-2022::4.4	Readiness to respond and recover	The organization should decide in advance how it will mobilise its crisis management resources and activate the associat...
iso-22361-2022::4.5.2	Principle A: Governance	Crisis management depends on effective governance at every level of the organization. The capability rests on a clear un...
iso-22361-2022::4.5.3	Principle B: Strategy	Crisis management is a strategic capability. Building and maintaining it depends on leadership communicating the value a...
iso-22361-2022::4.5.4	Principle C: Risk management	The crisis management capability is dynamic and rests on effective risk management. Adaptive and timely crisis managemen...
iso-22361-2022::4.5.5	Principle D: Decision-making	Effective decision-making requires good information management, situational awareness and an understanding of the intere...
iso-22361-2022::4.5.6	Principle E: Communication	Crisis management requires effective communication. The organization should convey accurate, credible and up-to-date inf...
iso-22361-2022::4.5.7	Principle F: Ethics	An organization's response to a potential crisis is guided by its core values and ethical expectations. Demonstrating ap...
iso-22361-2022::4.5.8	Principle G: Learning	The organization's crisis management capability improves through learning within the organization. An organization learn...

Clause 5: Building a crisis management capability – ISO 22361:2022

12 controls

Controls in the Clause 5: Building a crisis management capability – ISO 22361:2022 domain of ISO 22361:2022 — 12 controls
Code	Title	Description
iso-22361-2022::5.1	General (building a crisis management capability)	A crisis management capability should include: the recognition of crisis situations; people able to analyse situations q...
iso-22361-2022::5.2.2	Leadership	Committed leadership is the first capability element: top management should own the crisis management capability, commun...
iso-22361-2022::5.2.3	Structure	The structural element comprises what the organization puts in place before a crisis so that the response can be led, di...
iso-22361-2022::5.2.4	Culture	A supportive culture, expressed in values, ethics and a code of conduct, is the third capability element: it supports th...
iso-22361-2022::5.2.5	Competence	Competent personnel, with the knowledge, skills, attitude and flexible thinking a crisis demands, are the fourth element...
iso-22361-2022::5.3.1	Anticipation	The organization should anticipate potential crises by establishing early-detection processes to identify potential cris...
iso-22361-2022::5.3.2	Assessment	The organization should assess potential crises by ensuring a well-understood and integrated relationship between risk m...
iso-22361-2022::5.3.3	Prevention and mitigation	Between assessing potential crises and preparing for them, the organization should act to prevent those it can and to mi...
iso-22361-2022::5.3.4	Preparedness	The organization should prepare for a crisis by establishing a crisis management plan that specifies which procedures an...
iso-22361-2022::5.3.5	Response	The response stage sets out general guidance for the crisis management team in action and a six-step response process, w...
iso-22361-2022::5.3.6	Recovery	Recovery should be planned and directed as a stage in its own right: the organization should decide when the crisis has...
iso-22361-2022::5.3.7	Continual improvement	The organization should treat continual improvement as a component of every capability element, not only a final stage o...

Clause 6: Crisis leadership – ISO 22361:2022

4 controls

Controls in the Clause 6: Crisis leadership – ISO 22361:2022 domain of ISO 22361:2022 — 4 controls
Code	Title	Description
iso-22361-2022::6.1.1	General (crisis leadership)	A crisis leader's first task is to stabilise the situation: inspire confidence and draw the best from everyone involved...
iso-22361-2022::6.1.2	Role and responsibility of the crisis leader(s)	The crisis leader or leaders should: a) ensure the teams and staffs are activated and working; b) chair the crisis manag...
iso-22361-2022::6.2.1	Crisis management responders	The organization should plan for the sustainability and well-being of the people who respond to a crisis: rostering and...
iso-22361-2022::6.2.2	Wider interested-party impact	The organization should consider the well-being of the interested parties the crisis affects beyond its own responders:...

Clause 7: Strategic crisis decision-making – ISO 22361:2022

5 controls

Controls in the Clause 7: Strategic crisis decision-making – ISO 22361:2022 domain of ISO 22361:2022 — 5 controls
Code	Title	Description
iso-22361-2022::7.1	General (strategic crisis decision-making)	At its core, crisis response is about taking decisions on the best available information and translating them into direc...
iso-22361-2022::7.2	Why decision-making can be challenging	Decision-making in a crisis is challenging because of the complexity, instability and uncertainty of the situation, time...
iso-22361-2022::7.3	Dilemmas, decision delay and decision avoidance	Crisis decisions are often dilemmas in which the apparent solutions are not right or wrong but better or worse, and ever...
iso-22361-2022::7.4	Decision-making issues	Issues that shape crisis decisions include the need to choose the least detrimental option where every option harms some...
iso-22361-2022::7.5	Effective crisis decision-making	Effective strategic decision-making follows a process: establish the situation (situational awareness of events, impacts...

Clause 8: Crisis communication – ISO 22361:2022

11 controls

Controls in the Clause 8: Crisis communication – ISO 22361:2022 domain of ISO 22361:2022 — 11 controls
Code	Title	Description
iso-22361-2022::8.1	General (crisis communication)	Effective communication is a key component of successful crisis management and an essential part of the organization's r...
iso-22361-2022::8.2	Pre-crisis preparation	The organization should prepare a crisis communication plan before any crisis. The plan should include: draft initial st...
iso-22361-2022::8.3	Managing relationships and reputation	The organization should manage its relationships with interested parties through the crisis to protect and, where possib...
iso-22361-2022::8.4.1	Communication team	The organization should establish a communication team within or alongside the crisis management structure, with defined...
iso-22361-2022::8.4.2	Spokespeople	The organization should designate and train its spokespeople in advance, with deputies, so that communication comes from...
iso-22361-2022::8.4.3	Media relations	The organization should engage the media proactively during a crisis to give an accurate account of the incident, protec...
iso-22361-2022::8.5	Crisis communication strategy	The organization should set a crisis communication strategy aligned to the CMT's strategic direction: the objectives of...
iso-22361-2022::8.6	Key principles and activities	Crisis communication should be accurate, credible and timely (principle E), consistent with the organization's values (p...
iso-22361-2022::8.7	Consistency of message	The organization should ensure that all its communications tell the same story: every person who communicates should car...
iso-22361-2022::8.8	Barriers to effective communication	The organization should identify and plan around the barriers to effective communication in a crisis: incomplete or chan...
iso-22361-2022::8.9	Social media	The organization should recognise both the dangers and the opportunities of social media in a crisis: it accelerates scr...

Clause 9: Training, validation and learning from crises – ISO 22361:2022

6 controls

Controls in the Clause 9: Training, validation and learning from crises – ISO 22361:2022 domain of ISO 22361:2022 — 6 controls
Code	Title	Description
iso-22361-2022::9.1	General (training, validation and learning)	The organization should build and maintain the competence of the people in its crisis management structure and validate...
iso-22361-2022::9.2	Developing competence	The organization should determine the competence each crisis role requires (knowledge, skills, attitude, flexible thinki...
iso-22361-2022::9.3	Training	The organization should train the people in crisis roles in the principles, the framework, the process, the plan and the...
iso-22361-2022::9.4	Exercising	The organization should exercise its crisis management capability regularly, using exercises of increasing complexity th...
iso-22361-2022::9.5	Validation	The organization should validate its crisis management capability: confirm through exercises, reviews and audits that th...
iso-22361-2022::9.6	Evaluating and learning	The organization should evaluate its performance after every exercise, incident and crisis, and learn from external even...

What is ISO 22361:2022 and who does it apply to?

ISO 22361:2022 is a compliance framework from International with 6 domains and 49 controls. ISO 22361:2022 is the ISO guidance on crisis management: the nature, characteristics and origins of crises; the seven principles of governance, strategy, risk management, decision-making, communication, ethics and learning; a capability built on a framework of leadership, structure, culture and competence and a process of anticipation, assessment, prevention and mitigation, preparedness, response, recovery and continual improvement; crisis leadership and the crisis leader's responsibilities; strategic decision-making under uncertainty; crisis communication from the pre-crisis plan to social media; and training, exercising, validation and learning. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does ISO 22361:2022 actually require?

ISO 22361:2022 has 49 controls organised across 6 domains. The largest domains are Clause 5: Building a crisis management capability – ISO 22361:2022 (12 controls), Clause 4: Context, core concepts and principles – ISO 22361:2022 (11 controls), Clause 8: Crisis communication – ISO 22361:2022 (11 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of ISO 22361:2022 do I already cover?

ISO 22361:2022 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I implement ISO 22361:2022?

Start your ISO 22361:2022 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO 22361:2022 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 49 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 704 frameworks.

Get Started Free →

Free forever — no credit card required