ISO 22398:2013
ISO 22398:2013 is the ISO guidance on exercises: how an organization plans, conducts and improves an exercise programme (needs analysis, base of support, aim and objectives, the programme manager, implementation, performance and programme monitoring, review) and each exercise project within it (foundation, performance objectives, team, risk, communication, resources, design, the nine exercise types and the discussion-based and operations-based methods, scenarios of events, incidents and injects; run-through, start-up briefing, launch, conduct and termination; debrief and after-action review), and how evaluation, the after-action report and management review with corrective action close the loop.
ISO 22398:2013 is a compliance framework from International with 3 domains and 33 controls. The largest domains are Clause 5: Planning, conducting and improving exercise projects – ISO 22398:2013 (20 controls), Clause 4: Planning, conducting and improving an exercise programme – ISO 22398:2013 (9 controls), Clause 6: Continual improvement – ISO 22398:2013 (4 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (3)
Clause 4: Planning, conducting and improving an exercise programme – ISO 22398:2013
| Code | Title |
|---|---|
| iso-22398-2013::4.1 | General (exercise programme) |
| iso-22398-2013::4.2.1 | Establishing the need for an exercise programme |
| iso-22398-2013::4.2.2 | Establishing the base of support for an exercise programme |
| iso-22398-2013::4.2.3 | Establishing the exercise programme aim and objectives |
| iso-22398-2013::4.2.4 | Roles and responsibilities of the exercise programme manager |
| iso-22398-2013::4.3.1 | Implementing the exercise programme |
| iso-22398-2013::4.3.2 | Monitoring exercise performance |
| iso-22398-2013::4.3.3 | Monitoring the exercise programme |
| iso-22398-2013::4.4 | Reviewing and improving the exercise programme |
Clause 5: Planning, conducting and improving exercise projects – ISO 22398:2013
| Code | Title |
|---|---|
| iso-22398-2013::5.1 | General (exercise projects) |
| iso-22398-2013::5.2.10 | Resources |
| iso-22398-2013::5.2.11 | Design and development |
| iso-22398-2013::5.2.12 | Exercise types |
| iso-22398-2013::5.2.13 | Exercise methods |
| iso-22398-2013::5.2.14 | Scenario creation |
| iso-22398-2013::5.2.2 | Establishing the foundation of the exercise project |
| iso-22398-2013::5.2.3 | Establishing the aim and performance objectives |
| iso-22398-2013::5.2.4 | Team management |
| iso-22398-2013::5.2.5 | Risk management |
| iso-22398-2013::5.2.6 | Environmental considerations |
| iso-22398-2013::5.2.7 | Gender and diversity considerations |
| iso-22398-2013::5.2.8 | Logistical considerations |
| iso-22398-2013::5.2.9 | Exercise communication |
| iso-22398-2013::5.3.1 | Exercise run-through |
| iso-22398-2013::5.3.2 | Start-up briefing |
| iso-22398-2013::5.3.3 | Launch |
| iso-22398-2013::5.3.4 | Conducting the exercise |
| iso-22398-2013::5.3.5 | Termination |
| iso-22398-2013::5.4 | Improving (exercise project) |
Clause 6: Continual improvement – ISO 22398:2013
| Code | Title |
|---|---|
| iso-22398-2013::6.1 | General (continual improvement) |
| iso-22398-2013::6.2 | Evaluation |
| iso-22398-2013::6.2.2.7 | Presenting the after-action report |
| iso-22398-2013::6.3 | Management review and corrective action |
What is ISO 22398:2013 and who does it apply to?
ISO 22398:2013 is a compliance framework from International with 3 domains and 33 controls. ISO 22398:2013 is the ISO guidance on exercises: how an organization plans, conducts and improves an exercise programme (needs analysis, base of support, aim and objectives, the programme manager, implementation, performance and programme monitoring, review) and each exercise project within it (foundation, performance objectives, team, risk, communication, resources, design, the nine exercise types and the discussion-based and operations-based methods, scenarios of events, incidents and injects; run-through, start-up briefing, launch, conduct and termination; debrief and after-action review), and how evaluation, the after-action report and management review with corrective action close the loop. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does ISO 22398:2013 actually require?
ISO 22398:2013 has 33 controls organised across 3 domains. The largest domains are Clause 5: Planning, conducting and improving exercise projects – ISO 22398:2013 (20 controls), Clause 4: Planning, conducting and improving an exercise programme – ISO 22398:2013 (9 controls), Clause 6: Continual improvement – ISO 22398:2013 (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of ISO 22398:2013 do I already cover?
ISO 22398:2013 does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement ISO 22398:2013?
Start your ISO 22398:2013 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO 22398:2013 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 33 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 704 frameworks.
Get Started Free →Free forever — no credit card required