ISO 22342:2023

Overview - ISO 22342:2023 (Security plan development)

ISO 22342:2023 provides guidance for developing and maintaining a security plan for organizations of any type, size or sector. The standard describes how to integrate protective security into organizational risk management, allocate responsibilities, and apply controls to protect assets against malicious acts. It supports an adaptive, agile approach that can be integrated into existing management systems and aligned with an organization’s mission and objectives.

Key topics and technical requirements

ISO 22342:2023 focuses on practical components needed to create an effective security plan. Major topics include:

• Governance

  • Define security objectives, scope and boundaries of the security plan.
  • Establish leadership, roles, accountabilities and responsibilities.
  • Identify legal, regulatory and contractual obligations.
  • Set up communication, documented information, reporting, evaluation and continuous improvement.

• Management of risk

  • Align security planning with risk management processes (referenced to ISO 31000).
  • Define risk scope, context and criteria; conduct risk assessment, treatment and acceptance of residual risk.
  • Ensure communication, consultation, monitoring, review and recordkeeping for security risks.

• Security controls

  • Select appropriate levels of protection and operational controls (technical and human-related).
  • Prepare procedures, contingency planning for low-likelihood/unforeseen events, and timelines for security activities.

• Security controls process

  • Process for selecting, implementing, testing, evaluating and monitoring controls.
  • Methods to determine effectiveness and to adjust measures through iterative review.

Note: ISO 22342:2023 gives guidance but does not prescribe specific criteria for when to implement particular prevention/protection measures and does not apply to services delivered by private security companies.

Practical applications - who should use it

ISO 22342 is intended for any organization that wants to standardize the development and maintenance of a security plan. Typical users include:

• Security managers and risk managers
• C-suite and board members responsible for governance and resilience
• Compliance and continuity professionals
• Facilities and operations managers
• Consultants and advisors developing organizational security frameworks

Practical uses: designing enterprise security plans, integrating protective security into management systems, developing contingency planning, and establishing governance and reporting frameworks to manage security risk.

Related standards

• ISO 31000 - Risk management - Guidelines (alignment of risk processes)
• ISO 22300 - Security and resilience - Vocabulary (definitions)
• ISO 28000:2022 - Supply chain/security plan content referenced

Keywords: ISO 22342:2023, security plan, protective security, security planning, risk management, security controls, governance, organizational security, contingency planning.