Overview
ISO/TS 22318:2021 - Security and resilience: Guidelines for supply chain continuity management provides practical guidance on applying the principles of business continuity (as set out in ISO 22301 and ISO 22313) to supplier relationships. The technical specification helps organizations develop and document a supply chain continuity management (SCCM) strategy to protect business activities from supply chain disruption. It is generic and applicable to all organizations and to suppliers of products, services and resources both upstream and downstream.
Key topics
- Integration with BCMS: Guidance on prerequisites from the business continuity management system (BCMS), including top management commitment, roles, resources and performance evaluation.
- Supply chain model and criticality: How to map upstream/downstream links, supplier tiers (Tier 1, Tier 2+), and identify priority suppliers via Business Impact Analysis (BIA).
- Risk and continuity analysis: Continuity requirements, risk assessment and risk ownership across the supply chain.
- Strategy options: Four broad options for managing supplier continuity risks (reduce dependency; rely on the organization’s BC strategies; rely on the supplier’s BC strategies; accept/retain risk as an informed decision).
- Supplier assessment and contractual controls: Assessing suppliers’ continuity compliance and embedding continuity requirements into contracts.
- Maintenance and improvement: Performance evaluation, maintenance, review, and continual improvement of SCCM.
- Practical tools: Annexes with example questions for suppliers, managing supplier disruptions, and joint exercises.
Practical applications
ISO/TS 22318:2021 is designed for organizations that depend on timely delivery of resources (materials, ICT, logistics, services, utilities, finance, labour). Typical practical uses:
- Designing supplier continuity clauses in procurement contracts and SLAs.
- Prioritizing suppliers based on BIA-derived criticality and recovery time objectives.
- Conducting supplier continuity assessments and audits.
- Coordinating joint continuity exercises with key suppliers.
- Establishing governance, roles and performance metrics for SCCM within a BCMS.
Who should use it
- Business continuity and resilience managers
- Supply chain and procurement leaders
- Risk and compliance officers
- Operations and logistics managers
- Senior management responsible for resilience strategy
Related standards
- ISO 22301 (BCMS - Requirements)
- ISO 22313 (BCMS - Guidance)
- ISO 22300 (Vocabulary)
- ISO 28000 family (supply chain security management) - complementary for security-focused supply chain resilience
By following ISO/TS 22318:2021, organizations can strengthen supply chain resilience, reduce disruption risk, and align supplier management with established business continuity practices.