ISO 22397:2014

Overview

ISO 22397:2014 - "Societal security - Guidelines for establishing partnering arrangements" provides practical guidance for organisations that need to form partnerships to manage events affecting societal security. The standard describes principles and a structured process to plan, develop, implement and review partnering arrangements between public, private and not‑for‑profit entities. It is applicable to any organisation, regardless of size or sector, and supports interoperability, continuity of operations and coordinated prevention, preparedness, response and recovery.

Key topics and requirements

ISO 22397 focuses on the lifecycle of a partnering arrangement and includes the following technical topics and requirements:

• Planning the arrangement

  • Define the purpose and mutual benefits.
  • Identify and evaluate potential partners (monitoring potential partners over time).
  • Initiate dialogue and assess partner capabilities and constraints.

• Developing the arrangement

  • Set priorities and scope consistent with risk profile.
  • Conduct a risk assessment (aligned with ISO 31000:2009) to identify vulnerabilities, risk sources and resource needs.
  • Define objectives, classify tasks and list required resources (personnel, equipment, communications, crisis centres, logistics).
  • Specify roles, responsibilities and levels of authority.
  • Establish relationship rules, dispute resolution and decision‑making leaders.
  • Agree communication, consultation, training and exercise needs.

• Implementation

  • Apply partnering principles such as compliance with legislation, accountability and respect for cultural/legal diversity.
  • Select appropriate contractual tools (contracts, MoUs, mutual aid and operational agreements, supply agreements).

• Review

  • Monitor performance, conduct exercises, and update the arrangement based on lessons learned (Annex C provides a review checklist).

The standard also includes informative annexes on generating relationship rules, potential obstacles and review checklists.

Practical applications and who would use it

ISO 22397 is useful for organisations involved in crisis management, business continuity and critical infrastructure protection, including:

• Emergency planners and risk managers
• Public authorities and local government agencies
• Private sector continuity and resilience teams
• Not‑for‑profit relief organisations and community groups
• Utilities, transport operators and supply‑chain partners

Typical uses include drafting memoranda of understanding (MoUs), mutual aid agreements, operational coordination agreements, and cross‑sector response arrangements to improve interoperability and shared response capabilities.

Related standards

• ISO 22300 - Societal security: Terminology
• ISO 31000:2009 - Risk management: Principles and guidelines

Note: ISO 22397 complements legal and regulatory requirements but does not replace them; organisations are advised to seek legal counsel before entering formal partnering agreements.