ISO 22396:2020

Overview - ISO 22396:2020 in brief

ISO 22396:2020, "Security and resilience - Community resilience - Guidelines for information exchange between organizations," provides methodological guidance for setting up, operating and maintaining structured information‑exchange arrangements. It focuses on principles, a framework and a process to help public and private organizations share operational, risk and resilience information (including sensitive information) in a trusted, secure and value‑creating way. The standard is deliberately non‑technical - it addresses governance, roles, procedures and legal considerations rather than IT implementation details.

Key topics and requirements

ISO 22396:2020 organizes guidance into three main parts and related elements:

• Principles - core guiding concepts such as:

  • Trust and willingness to exchange information
  • Value creation and mutual benefit
  • Information protection and classification
  • Structured, systematic processes, security and integrity
  • Commitment to share, support decision‑making and continual improvement

• Framework components - organizational elements to establish and sustain exchanges:

  • Leadership and top‑management commitment
  • Context analysis and stakeholder mapping
  • Design and establishment of governance, objectives and policies
  • Implementation, monitoring, review and continual improvement

• Process guidance - practical steps for operating exchanges:

  • Establishing needs and expressions of interest
  • Preparing participating organizations (internal and external readiness)
  • Defining exchange structure (purpose, membership, classification)
  • Operating and maintaining arrangements (meetings, platforms, information handling)
  • Monitoring, review and improvement cycles

• Mechanisms and examples - non‑technical tools such as classification schemes and the Traffic Light Protocol (TLP) (Annex A) to manage sensitivity and sharing limits.

Note: ISO 22300 (vocabulary) is referenced for key terms. Users must assess legal and jurisdictional requirements separately.

Practical applications - who uses it and why

ISO 22396:2020 is applicable to:

• Government agencies (emergency management, public safety)
• Critical infrastructure operators (utilities, transport, telecom)
• Private enterprises with interdependencies across supply chains
• Industry associations and community resilience groups
• NGOs and multi‑stakeholder partnerships

Typical uses:

• Designing cross‑sector information‑sharing partnerships to improve situational awareness
• Establishing secure channels and governance for sharing vulnerability or incident data
• Creating membership rules, classification and retention policies for collaborative platforms
• Improving decision‑making and resilience through reliable, timely shared intelligence

Related standards

• ISO 22300 - Security and resilience - Vocabulary (normative reference)
• Developed by ISO/TC 292 (Security and resilience)

ISO 22396:2020 is a practical, governance‑oriented standard for organizations that need to formalize information exchange to enhance community resilience, trust and operational decision‑making.