ISO 22316 Organisational Resilience: Connect Strategy, Security and Continuity

Organisational resilience is not a new label for business continuity, cybersecurity or crisis management. It is the organisation’s ability to absorb change, adapt and continue pursuing its objectives through uncertainty. ISO 22316 provides principles and attributes that help leaders develop that capability across disciplines.

ISO/IEC 27001 and ISO 22301 remain important building blocks. The first governs information-security risk; the second governs continuity of prioritised activities during disruption. Neither alone covers every condition that makes an organisation resilient, such as strategic adaptability, leadership behaviour, culture, innovation and coordinated decision-making.

Organisational resilience is broader than individual management systems. This guide turns that principle into an operating model with evidence and ownership.

What ISO 22316 is—and is not

The official ISO 22316 page describes guidance for enhancing organisational resilience. It applies to organisations of any size or type and supports long-term adaptation in a changing environment.

ISO 22316 is guidance, not a requirements standard designed for accredited certification. Organisations should not claim to be “ISO 22316 certified” as if it were equivalent to ISO 27001 certification. They can use its principles to assess, design and improve resilience.

It also does not replace:

• enterprise risk management;
• an information security management system;
• a business continuity management system;
• emergency, crisis or incident management;
• safety, financial or supply-chain governance;
• sector-specific law and regulatory requirements.

Its value is in connecting these capabilities around shared purpose, awareness and adaptation.

Start from organisational objectives

Resilience has no meaning without something the organisation intends to preserve or achieve. Begin with critical outcomes: essential services, patient safety, market commitments, public responsibilities, financial stability, trust and strategic goals.

For each outcome, identify:

• the acceptable level of service under stress;
• time-sensitive dependencies and decision points;
• information and technology needed;
• people, facilities, suppliers and funding;
• regulatory and stakeholder expectations;
• conditions that would require adaptation rather than restoration.

This avoids equating resilience with returning every system to its old state. Sometimes the correct response is to change the operating model, retire a service or reallocate capacity.

The organisational context evidence guide shows how external and internal issues should influence scope, risk and objectives rather than remain a static list.

Connect three complementary views

View	Core question	Typical evidence
ISO 27001	How are information-security risks governed and treated?	Scope, risk decisions, selected controls, monitoring, audit and improvement
ISO 22301	How will prioritised activities continue and recover through disruption?	Business impact analysis, strategies, plans, exercises and recovery records
ISO 22316	What organisational qualities enable anticipation, adaptation and renewal?	Leadership decisions, shared awareness, coordinated capabilities and learning

The ISO 22301 overview focuses on protecting against, reducing the likelihood of and recovering from disruption. Our guide to strengthening ISO 27001 with ISO 22301 explains how their risk and recovery views connect.

Build resilience through owned capabilities

Shared situational awareness

Leaders need a current view of threats, vulnerabilities, operational stress, customer effects and dependency health. Combine relevant intelligence from security operations, continuity, suppliers, finance, workforce and service teams.

Evidence should show sources, thresholds, escalation, decision recipients and actions. A dashboard that nobody uses is not awareness.

Leadership and distributed authority

Resilient organisations establish direction before disruption and delegate decisions to appropriate levels. Define thresholds for escalation, crisis authority, risk acceptance, emergency spending and alternative operation.

Exercise records should show whether decisions were timely and whether teams waited unnecessarily for unavailable leaders.

Culture and learning

People need confidence to report weak signals, challenge assumptions and adapt within safe boundaries. Near misses, incidents, failed changes, supplier warnings and exercise observations should become improvement inputs.

Measure whether actions change controls, plans, training or investment—not simply whether reports were closed.

Diverse and redundant capability

Resilience may require alternate suppliers, cross-trained staff, multiple communication routes, geographic separation or manual fallback. Redundancy should be justified by impact and tested. Two suppliers using the same subservice or region may create the appearance of diversity without reducing risk.

Coordinated disciplines

Cybersecurity, continuity, crisis management, safety, privacy, facilities and communications should use compatible escalation and decision structures. They need not merge, but interfaces should be designed and exercised.

A practical resilience assessment

Choose one important service and trace a severe but credible scenario. For example, a ransomware event disrupts identity, collaboration and a critical supplier while public reporting obligations are active.

Assess five layers:

1. Anticipation: Was the dependency and combined scenario understood?
2. Absorption: Which safeguards and capacity contained immediate harm?
3. Response: Were authority, communication and priorities clear?
4. Adaptation: Could the organisation deliver an acceptable alternative?
5. Learning: Did evidence lead to verified improvement?

Use the ISO 27001 risk score calculator to support consistent likelihood and impact discussion, while retaining the organisation’s own criteria and broader resilience judgment.

Evidence for an audit or management evaluation

Organisational resilience is often weakened by aspirational statements. Look for evidence of connected action:

• strategic decisions that consider disruption and adaptation;
• cross-functional ownership for critical outcomes;
• dependency maps validated by service owners;
• investment decisions tied to resilience gaps;
• exercises that involve realistic resource constraints;
• alternative arrangements tested with users and suppliers;
• lessons carried into risk, controls and strategy;
• management review decisions with owners and due dates.

The management review evidence guide provides a useful method for turning inputs into accountable decisions.

Pass, partial and fail examples

Pass: the organisation can explain its critical outcomes, sees cross-functional dependencies, delegates decisions, tests adaptation and verifies improvements. Security and continuity evidence supports one coherent service view.

Partial: strong plans and controls exist, but each discipline uses separate assumptions and escalation. Exercises restore systems yet do not test workforce, supplier or strategic adaptation.

Fail: resilience is a slogan, critical outcomes are undefined, dependency knowledge sits with individuals, and repeated events produce the same weaknesses.

Questions leaders should answer

• Which outcomes must remain viable under sustained disruption?
• Where are single points of dependency hidden across suppliers, people or regions?
• What early indicators would change a strategic decision?
• Who may accept degraded operation, and for how long?
• Which capabilities are genuinely diverse rather than differently branded?
• When did an exercise last change investment, architecture or supplier strategy?
• How are lessons shared across management systems?
• What evidence shows the change was effective?

Avoid creating a resilience silo

A separate resilience office can coordinate, but operational ownership must remain with leaders and service owners. Use existing risk, continuity, security, performance and review mechanisms wherever they work. Add a new forum only when it resolves a clear coordination gap.

Set a small number of cross-functional measures. Examples include the percentage of critical services with validated dependency maps, actions overdue after exercises, time to reach an authorised decision, and concentration risks without an approved response. Pair each measure with a threshold, owner and required decision.

Review measures alongside incidents, near misses and strategic changes. A positive trend should be supported by evidence, while a missed threshold should lead to analysis and action. Avoid reducing resilience to one maturity score: different services can require different levels of capability, and an aggregate number can hide a critical weakness.

ISO 22316 is most useful as a lens across the organisation: purpose, awareness, adaptability, coordinated disciplines, leadership and learning. ISO 27001 and ISO 22301 then provide auditable management systems for two essential capability areas. The outcome is not another badge; it is an organisation better able to make sound decisions before, during and after change.