ISO 22361:2022

Overview

ISO 22361:2022 - Security and resilience - Crisis management - Guidelines provides practical guidance to help organizations plan, establish, maintain, review and continually improve a strategic crisis management capability. The standard explains core concepts, principles and a structured process to identify and manage crises, and is intended for top management with strategic responsibility as well as those operating under their direction. ISO 22361 supports organizational resilience by aligning governance, strategy, risk management, decision‑making and communications.

Key topics and technical requirements

ISO 22361 is organized around clear topical clauses and practical elements that organizations should consider when building crisis capability:

• Core concepts and principles: nature and characteristics of crises, potential origins, and principles such as governance, strategy, risk management, decision‑making, communication, ethics and learning.
• Building a crisis management capability: a framework covering leadership, structure, culture, competence and resources.
• Crisis management process: lifecycle activities including anticipation, assessment, prevention & mitigation, preparedness, response, recovery and continual improvement.
• Crisis leadership: leadership roles, core skills, responder well‑being and sustaining crisis response.
• Strategic crisis decision‑making: managing complexity, dilemmas, decision delays and effective decision techniques.
• Crisis communication: pre‑crisis preparation, messaging consistency, media & social media management, spokesperson roles and reputation management.
• Training, validation and learning: competence development, exercises, validation and post‑crisis evaluation to capture lessons learned.

ISO 22361 provides guidelines rather than prescriptive technical specifications; it outlines elements for consideration and structured approaches rather than mandatory measures.

Applications and who uses it

ISO 22361 is applicable to any organization seeking to strengthen crisis management and organizational resilience across public, private and non‑profit sectors. Typical uses:

• Informing executive leadership and boards on strategic crisis readiness.
• Designing or improving crisis management frameworks, policies and governance.
• Developing crisis communication strategies and media response plans.
• Structuring training programs, exercises and post‑incident learning processes.
• Integrating crisis capability with related disciplines (e.g., risk management, business continuity, emergency management).

Ideal users: top management, crisis managers, resilience officers, communications teams, security and emergency planners.

Related standards

ISO 22361 complements other resilience standards (for example, ISO 22301 on business continuity management) and can be integrated with organizational risk management and incident response frameworks to build a comprehensive security and resilience program.

Keywords: ISO 22361, crisis management, crisis communication, crisis leadership, organizational resilience, security and resilience, crisis decision‑making.