ISO 22361: ISO 22361 – Tutorial (about 60 minutes)

ISO 22361 is the international guidance standard on crisis management: how an organization builds a strategic capability to anticipate, prepare for, respond to and learn from crises that threaten its survival, its reputation or the people who depend on it. Boards, executives, resilience, continuity, risk, security and communications professionals in organizations of every size and sector use it to set up crisis teams, plans and training that work when routine procedures are no longer enough. After this tutorial you will be able to explain what makes a crisis different from an incident, describe the structure of the standard, and design, test and improve a crisis management capability for a real organization.

Free tutorial · about 60 minutes · 7 lessons · 4 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: The current edition is ISO 22361:2022, Security and resilience — Crisis management — Guidelines, the first edition, published in October 2022 by ISO technical committee ISO/TC 292 (Security and resilience). It has been adopted in Europe as EN ISO 22361:2022 (for example BS EN ISO 22361:2022 in the United Kingdom, published by BSI in November 2022). National catalogues list it as current, and no newer edition or published revision project was found. ISO reviews every standard at least every five years, so the first systematic review of this edition falls due around 2027; check the ISO catalogue entry for any change in status. Verified 2026-10-29 on the AFNOR, BSI Knowledge and Bahrain national standards catalogue entries for ISO 22361:2022 and EN ISO 22361:2022 (the ISO.org page itself refused automated access on that date).

Who this is for: executives and board members who will lead or sponsor crisis response; business continuity, resilience, risk, security, cyber, facilities, health and safety and HR managers who are asked to "set up crisis management"; communications and legal staff who sit on crisis teams; engineers and site reliability teams whose major incidents can turn into organizational crises; and auditors and consultants who need a structured way to review crisis arrangements.

Prerequisites: none. A general picture of how an organization is governed (board, top management, departments, suppliers, customers, regulators) helps. Every crisis management term is explained when it first appears. If you already know ISO 22301 (business continuity) or ISO 22316 (organizational resilience), many ideas will feel familiar, but that knowledge is not required.

By the end of this tutorial:

You will be able to explain what ISO 22361 is for, who it is aimed at and why crisis management is treated as a strategic discipline distinct from incident response and business continuity.
You will be able to define the core vocabulary, including crisis, crisis management capability, crisis team, situational awareness, escalation, dilemma and validation.
You will be able to describe the structure of ISO 22361:2022 and say what each of its main clauses covers.
You will be able to design the main elements of a crisis management capability: roles, activation, information flow, plans, facilities and communication.
You will be able to explain why ISO 22361 cannot be certified against and describe credible ways to evaluate and improve crisis readiness instead.
You will be able to apply the guidance to a realistic organization, from preparation through response to post-crisis learning.
You will be able to relate ISO 22361 to ISO 22301, ISO 22320, ISO 22316, ISO 31000 and ISO 22398.

Lesson 1 – Origins, purpose and scope

Why a crisis management standard was needed

Most organizations are reasonably good at handling the problems they expect. A data centre fails over to a second site, a warehouse fire triggers an evacuation drill that people have practised, a supplier shortage is covered by safety stock. These are incidents: disruptive, sometimes serious, but understood well enough that a procedure, a plan or an experienced manager can deal with them.

Some events are different. A product is suspected of harming customers. A ransomware attack locks every system at once and the attackers threaten to publish stolen data. A senior leader is accused of serious misconduct. A pandemic closes borders for months. A video of an employee mistreating a customer reaches millions of people overnight. In these situations there is no script. Facts are unclear, the situation keeps changing, many stakeholders demand answers at the same time, and the decisions taken in the first hours can decide whether the organization keeps the trust of its customers, staff, regulators and investors. The organization's survival, or at least its reputation and licence to operate, is at stake. That is a crisis.

Experience from many public and private crises shows a repeating pattern. Organizations that struggle usually did not lack technical plans. They lacked a clear way to recognise that a crisis was developing, a senior team that knew its role, reliable information reaching that team, a way to make difficult decisions under pressure, and a way to communicate quickly and honestly. They also often failed to learn afterwards, so the same weaknesses showed up in the next crisis.

National guidance existed before ISO 22361. In the United Kingdom, for example, BSI published crisis management guidance as PAS 200 in 2011 and then as the British Standard BS 11200 in 2014; BSI withdrew BS 11200 in November 2022, the month it published the European adoption of ISO 22361. The international committee for security and resilience, ISO/TC 292, developed ISO 22361 to give a single, globally agreed description of good crisis management practice. BSI describes the result as reflecting the consensus of businesses and academics on how the idea of "crisis" has evolved over the last decade.

What the standard is for

In its own scope, ISO 22361 says it gives guidance for organizations to plan, establish, maintain, review and continually improve a strategic crisis management capability. Three ideas in that sentence matter.

Guidance, not requirements. The document recommends; it does not impose. It uses "should" rather than "shall", which is why there is nothing to certify an organization against (Lesson 5).
Capability, not just a plan. A plan on a shelf is not enough. Capability means people who know their roles, the authority to act, information, facilities, practised routines and a culture that supports them.
Strategic. Crisis management happens at the top of the organization. It is about protecting the organization as a whole, its purpose, values, reputation and long-term viability, not about fixing the immediate technical problem, which other teams handle.

Who it is for and where it applies

The standard applies to any organization, public or private, large or small, in any sector. It is written mainly for top management with strategic responsibility for crisis management, and for the people who work under their direction to prepare and support the crisis team. It recognises that crisis management is interdependent with related disciplines (for example business continuity, emergency and incident management, risk management and security), but it treats crisis management as a distinct discipline with its own purpose.

That last point is one of the most important lessons of the standard. Many organizations assume that their business continuity programme "covers" crises. Business continuity is essential, but it is designed around disruptions that can be analysed in advance: which activities are critical, how fast they must be recovered, what resources are needed. Crises are often unexpected in kind, not only in timing, and they raise questions of values, trust and strategy that a recovery plan cannot answer. Figure 1 shows how the parts of the standard fit together.

Figure 1 – The structure of ISO 22361:2022, from foundations and concepts to building, using and improving a crisis management capability.

Lesson 2 – Key concepts and vocabulary

Crisis management has its own vocabulary, and teams that use the same words consistently make faster decisions. ISO 22361 relies on the security and resilience vocabulary maintained in ISO 22300 together with its own terms. The explanations below are plain-language descriptions written for this tutorial, not the official definitions; check the standard for the exact wording.

Crisis – a situation far outside normal operations that threatens an organization or a community so seriously that only a strategic, flexible and fast response can protect its survival and integrity. The key signals are novelty, uncertainty, high stakes and time pressure.
Incident – an event that disrupts or could disrupt normal activities. Most incidents are handled by established procedures and never become crises; some escalate.
Emergency – a sudden, urgent situation, usually involving immediate danger to life, health, property or the environment, which calls for immediate action by responders. An emergency can be part of a crisis, but a crisis can also exist with no physical emergency at all.
Crisis management – the coordinated activities that an organization uses to anticipate, prepare for, respond to and recover from crises, and to learn from them, led at a strategic level.
Crisis management capability – the combination of people, roles, authority, processes, information, facilities, plans, training and culture that lets an organization manage crises effectively. Building it is the subject of clause 5.
Crisis team – the small group of senior people, with supporting specialists, that takes strategic decisions during a crisis. Organizations use names such as crisis management team, executive crisis team or strategic team.
Top management – the person or group who directs and controls the organization at the highest level. In crisis management they own the capability and usually lead or empower the crisis team.
Escalation – passing a situation upward to a higher level of management when it exceeds what the current level can or should handle. Activation is the formal decision to bring the crisis team together.
Situational awareness – an up-to-date understanding of what is happening, what it means for the organization and how it may develop. A common operating picture is a shared summary of that understanding that everyone on the team works from.
Stakeholder – any person or organization that can affect, be affected by, or believe itself affected by the crisis or the response: staff, customers, victims and their families, regulators, investors, suppliers, media, local communities.
Dilemma – a decision in which every available option has serious downsides, often because values or interests conflict (for example, speed versus certainty, transparency versus legal exposure). Crisis teams spend much of their time on dilemmas, not on technical problems.
Crisis communication – the exchange of information with stakeholders during a crisis: listening as well as informing, inside and outside the organization. It is covered in clause 8.
Validation – activities that check whether the capability will actually work, such as exercises, tests and reviews. An exercise is a planned activity in which people practise and evaluate their roles against a simulated scenario.
Post-crisis review – a structured look back at how the organization prepared for and handled a crisis. A lesson identified is an observation from that review; it becomes a lesson learned only when it has changed how the organization works.

Crisis versus incident: why the difference matters

Telling a crisis apart from a serious incident is not academic. If an organization treats a crisis as an incident, it keeps the problem at the operational level, where staff try to fix the immediate cause while the strategic questions go unanswered: who speaks for us, what do we owe affected people, what do we tell regulators, do we suspend a product line? If it treats every incident as a crisis, senior leaders are pulled away from their work constantly and lose credibility, and the true crisis may arrive when everyone is tired of false alarms.

A useful practical test asks a few questions. Is the situation outside what our plans and procedures anticipate? Is it highly uncertain or changing quickly? Could it seriously damage our reputation, finances, legal position, people or ability to continue? Does it require decisions that only top management can or should take? Are many stakeholders likely to demand answers? The more "yes" answers, the more likely it is a crisis.

Sudden and slow-burning crises

Crisis practitioners commonly distinguish between sudden crises, which arrive with little warning (an explosion, a cyber attack, a death on site), and smouldering or slow-burning crises, which build gradually from problems that were known or knowable (a quality defect that is quietly tolerated, a culture of harassment, unpaid tax, a failing major project). Smouldering crises are frequently the more damaging because, when they become public, stakeholders ask "how long did you know?" Good crisis management therefore includes watching for weak signals and creating ways for bad news to reach leaders early.

Lesson 3 – Structure of the standard

ISO 22361:2022 is a short guidance document (36 pages in the ISO edition). It does not follow the ISO Harmonized Structure used by management-system standards such as ISO 22301 or ISO 9001 (with clauses 4 to 10 on context, leadership, planning, support, operation, evaluation and improvement), because it is not a management-system requirements standard. Instead its clauses follow the logic of the subject itself. The summary below paraphrases each clause's purpose.

Clause	Title (short form)	What it is about
1	Scope	Guidance on planning, establishing, maintaining, reviewing and improving a strategic crisis management capability for any organization, aimed at top management.
2	Normative references	Documents needed to apply the standard, notably the security and resilience vocabulary.
3	Terms and definitions	The terms used in the document.
4	Context, core concepts, principles and challenges	What crises are, how they differ from other disruptions, the principles that should guide crisis management, and why crises are so hard to manage.
5	Developing an organization's crisis management capability	How to build the capability: structure, roles, responsibilities, plans, processes, resources and the links to other disciplines.
6	Crisis leadership	What is expected of the people who lead during a crisis, and the qualities and behaviours that help.
7	Decision-making challenges and complexities facing a crisis team in action	Why decisions are hard in a crisis and how teams can make better ones under uncertainty and pressure.
8	Crisis communication	Communicating with stakeholders inside and outside the organization before, during and after a crisis.
9	Training, validation and learning from crises	Building competence, checking that the capability works, and turning experience into improvement.

Clause 4: understanding crises

Clause 4 sets the foundation. It explains the context in which crises happen and the concepts the rest of the document builds on, then sets out a list of principles for crisis management and describes the challenges that make crises hard to handle. Read the principles in the standard itself. Across the standard, several ideas recur, and it helps to understand them in your own words:

Crisis management is a responsibility of top management and part of good governance, not a task delegated to a specialist and forgotten.
Crises are uncertain and dynamic, so the response must be flexible and adaptive rather than a rigid script.
The organization's purpose and values should guide decisions, especially when the rules run out; ethical behaviour matters as much as speed.
Crisis management works with, and coordinates, the other disciplines of protection and recovery instead of replacing them.
Communication and stakeholder trust are central, not an afterthought.
The organization should keep learning, from its own crises, its exercises and the crises of others.

The challenges described in clause 4 reflect what makes crises special: incomplete and conflicting information, time pressure, intense outside attention, the need to coordinate many parties, emotional strain on the people involved, and the fact that the crisis may be one nobody imagined.

Clause 5: developing the capability

Clause 5 is the practical core for people who are setting up crisis management. It covers how the organization decides what its crisis management capability needs to be, who is responsible, how the crisis team is formed and supported, how the capability connects to incident management, business continuity, emergency response and communications, and what plans, procedures, information systems and facilities it needs. Lesson 4 turns this into concrete steps.

Clauses 6 and 7: leading and deciding

Clause 6 focuses on crisis leadership. Leading in a crisis differs from leading in normal times: leaders must make sense of a confusing situation, set clear strategic aims, take visible responsibility, show care for affected people, keep the team functioning and look beyond the immediate response to the recovery. Clause 7 looks at the crisis team in action, and at why decision-making is so difficult: ambiguous information, pressure to act, cognitive biases, group dynamics, fatigue and dilemmas with no good answer. It encourages structured ways of working that keep the team focused on the right questions.

Clauses 8 and 9: communicating and improving

Clause 8 deals with crisis communication: identifying stakeholders, preparing in advance, communicating quickly, accurately and consistently, using spokespeople well and including internal audiences. Clause 9 closes the loop with training, validation and learning: how to build competence, how to exercise and test the capability, and how to review real crises and exercises so that lessons change practice. As Figure 1 shows, clause 9 feeds back into clause 5, which is how the capability "continually improves".

Lesson 4 – How it works in practice

ISO 22361 does not prescribe a fixed method, but its clauses translate naturally into a programme that most organizations can follow. This lesson describes that programme in steps, then looks at what happens when a crisis occurs. Figure 2 summarises the capability lifecycle.

Figure 2 – A crisis management capability lifecycle: commit, design, prepare, train, validate, respond, review and improve.

Step 1: commitment and scope

Crisis management starts with top management. The board and executive team agree that the organization needs a crisis management capability, decide who owns it, and set its scope: the whole group or particular regions, which subsidiaries and joint ventures, and how it connects to partners. A senior sponsor and a practical coordinator (often in the resilience, risk or continuity function) are named. Without this commitment, the capability tends to exist only on paper.

Step 2: understand the context

The organization looks at what could cause a crisis for it. Existing risk registers, business impact analyses, threat assessments, regulatory obligations and past incidents are useful inputs, but the aim is not to list every scenario. It is to understand the kinds of situations that could threaten the organization's viability or integrity, the stakeholders who would be affected, and the strengths and weaknesses of current arrangements. A good test is to ask senior leaders: "What would keep you awake at night?"

Step 3: design the structure

Most organizations use three levels of response. The strategic level (the crisis team) protects the organization as a whole and sets direction. The tactical level turns strategy into coordinated plans across functions or sites. The operational level does the hands-on work: fixing systems, caring for people, running the plant. Some sectors call these gold, silver and bronze. ISO 22361 is concerned mainly with the strategic level and its links to the others.

Design decisions at this step include:

Membership of the crisis team. Typically a team leader (often the chief executive or a delegated senior executive), heads of key functions such as operations, communications, legal, HR, finance and technology, and a small support cell. Keep the core small; bring in specialists as needed.
Roles. Besides the leader, effective teams name a coordinator or facilitator who runs the meeting rhythm, an information manager who maintains the shared picture, and a loggist who records decisions and their reasons. Each role has trained deputies, because crises happen during holidays and at night.
Escalation and activation. Clear but flexible criteria for when an incident is escalated to the crisis team, who can activate it, and how quickly. Criteria should invite judgement ("if in doubt, escalate") rather than rely only on numeric thresholds.
Authority. What the crisis team may decide without further approval, including spending, public statements, product withdrawals or shutting sites.
Interfaces. How the crisis team works with incident response teams, business continuity teams, emergency services, insurers, regulators, partners and, for groups, local crisis teams in other countries.

Step 4: plans, information and facilities

The crisis management plan should be short and usable under stress. It describes how the team is activated and contacted, roles and checklists, the meeting structure, how information flows, communication arrangements and key contacts. It deliberately avoids long scenario scripts, because real crises rarely match them. Supporting material can include stakeholder maps, pre-approved holding statements, legal and regulatory notification requirements, and decision-support templates.

The team also needs a place to work. That can be a physical crisis room with screens and secure phone lines, a virtual room on a collaboration platform, or both, with backup options in case the main systems are the ones affected (for example during a cyber attack). Information management deserves particular attention: how reports from the front line reach the team, how they are checked, and how the common operating picture is kept current.

Step 5: training and competence

People who will sit on the crisis team, their deputies and support staff need training that suits their role: understanding the plan and their responsibilities, practising decision-making and communication, learning how biases affect judgement, and becoming comfortable with the tools. Spokespeople need media training. Competence is built over time, not in a single briefing.

Step 6: validation

Validation checks whether the capability will work. It ranges from simple checks (does the call-out list work at 3 a.m.?) through discussion-based exercises such as tabletop workshops, to full simulations where the team responds in real time to a developing scenario with simulated media and stakeholder pressure. Exercises should have clear objectives, should be challenging but fair, and should be evaluated so that weaknesses are captured. ISO 22398 gives general guidance on planning and running exercises.

What happens when a crisis occurs

Figure 3 shows the typical path of a situation from normal operations to crisis and back.

Figure 3 – How a situation moves from normal operations through incident, assessment and crisis to recovery and learning.

Once activated, the crisis team usually follows a rhythm of short, structured meetings. Each meeting starts with a situation update from the shared picture, confirms or revises the strategic aims, identifies the key issues and dilemmas, decides on actions and communications, assigns owners and sets the time of the next meeting. Between meetings, team members lead their functions and gather information. Figure 4 illustrates this decision cycle.

Figure 4 – The crisis team decision cycle, repeated at each meeting as the situation evolves.

Lesson 5 – Assessment, certification and compliance

Why there is no ISO 22361 certificate

Accredited certification means an independent body checks an organization against requirements and issues a certificate if it conforms. ISO 22361 contains recommendations only. It tells you what good crisis management looks like, but it leaves the organization free to decide how to achieve it, so there is no defined set of requirements to audit against. As a result, there is no accredited certification of an organization's crisis management system to ISO 22361, and any claim of being "ISO 22361 certified" should be treated with care. An organization can honestly say that it has aligned its crisis management with ISO 22361 or that its arrangements were reviewed against the guidance.

Training providers offer courses on ISO 22361, some with their own personal certificates. These recognise an individual's knowledge; they say nothing about whether an organization's capability is effective.

Where certification does exist

Organizations that want a certificate in this area usually look at ISO 22301, the requirements standard for business continuity management systems, which is certifiable by accredited bodies. ISO 22301 includes requirements on response structures, warning and communication as part of business continuity plans and procedures, so a certified business continuity management system covers some of the ground. It does not, however, cover the full strategic scope of crisis leadership, dilemmas and reputation that ISO 22361 describes. Many organizations therefore use ISO 22301 for certification and ISO 22361 as guidance for the strategic layer on top.

In some sectors regulators expect crisis management arrangements, for example under operational resilience rules for financial services, health service emergency preparedness requirements or critical infrastructure laws. ISO 22361 does not replace those obligations, but it is a useful reference for meeting them and explaining them.

How to evaluate crisis readiness credibly

Even without certification, organizations need to know whether their capability is good enough. Credible approaches include:

Gap analysis against the guidance. Walk through clauses 4 to 9 and record, with evidence, how the organization addresses each topic. Evidence matters more than opinions: names on rosters, records of exercises, logs from real activations.
Evaluated exercises. A well-designed exercise with trained observers and clear objectives is the strongest evidence of whether people can actually do what the plan says.
Post-crisis and post-incident reviews. Real activations, including near misses that were nearly escalated, show how the capability behaves under genuine pressure.
Internal audit. Internal auditors can review whether arrangements exist, are current and are tested, and whether lessons are followed through.
Independent review. An external reviewer can benchmark the capability against the guidance and against peers, as long as the review is evidence-based.
Maturity assessment. Some organizations rate each area (leadership, structure, information, communication, training, learning) on a simple maturity scale of their own design. ISO 22361 does not define maturity levels, so any such scale must be explained as the organization's own.

Results should go to top management, because they own the capability, and should lead to a prioritised improvement plan with owners and dates.

Lesson 6 – Worked example

This example follows a fictional company through the guidance. Kestrel Foods is a family-owned producer of chilled ready meals with 1,800 employees, three factories in two countries, and supply contracts with four large supermarket chains. It has a certified food safety management system and a business continuity plan for each factory, but no organization-wide crisis management arrangements.

Commitment and context

After a competitor suffers a damaging product recall, Kestrel's board asks the chief executive to put proper crisis arrangements in place. The chief executive appoints the chief operating officer as executive sponsor and the head of quality and risk as crisis management coordinator, and asks them to align the work with ISO 22361.

The coordinator interviews each executive and reviews the risk register, insurance policies, regulatory duties and the last five years of incidents. The executives' main fears are a contamination event that harms consumers, a cyber attack that halts production and ordering, a major fire, the sudden loss of a key retailer contract, and a serious allegation about working conditions at a supplier. The coordinator notes that the factory plans are good at restarting production but say nothing about who decides on a recall, who speaks to the media, or how the company would talk to consumers who had been harmed.

Designing the capability

Kestrel designs a three-level structure. Each factory keeps its incident team. A group tactical team, led by the operations director, coordinates across sites. A strategic crisis team, led by the chief executive with the chief operating officer as deputy, includes the heads of quality, communications, legal, HR, finance and IT, and is supported by the coordinator acting as facilitator, an information manager and a trained loggist. Each role has a named deputy.

Escalation criteria are written as questions, not just thresholds: any suspected risk to consumer health, any event likely to attract national media, any event that may require notifying a regulator, any loss of a whole site or of core systems, and any situation that a director feels "may be bigger than it looks". Any director, and the duty quality manager at night, may activate the team.

The crisis plan is twelve pages long. It contains the activation procedure, role cards, a meeting agenda, the decision log template, a stakeholder map (consumers, retailers, food safety authorities, employees, unions, local communities, insurers, banks and media), pre-drafted holding statements for a product withdrawal and a cyber incident, and the contact details of a specialist public relations firm and outside lawyers. A meeting room in head office is equipped as the crisis room, and an alternative virtual room is set up on a separate collaboration service that does not depend on the company's own network.

Training and validation

The crisis team and deputies attend a half-day workshop on the plan and on decision-making under pressure, followed by a tabletop exercise about a suspected contamination. The exercise reveals three weaknesses: nobody knows who holds the authority to tell retailers to remove stock, the information manager has no way to collect batch data from the factories quickly, and the team spends most of its time discussing technical cleaning procedures rather than strategic questions. The coordinator records these as lessons identified, assigns owners, and the plan, authorities and data procedures are updated. Six months later a more demanding simulation, with role players acting as journalists, retailers and an angry parent, shows clear improvement.

The real crisis

Eighteen months after the programme began, a hospital reports that three elderly patients who ate a Kestrel product have fallen ill with a food-borne infection. Laboratory confirmation will take days. The duty quality manager hears about it at 9 p.m. on a Friday and activates the crisis team.

At the first meeting, held in the virtual room within an hour, the information manager presents what is known and, just as importantly, what is unknown. The team agrees its strategic aims: protect consumers first, act transparently with the authorities, support the people affected, protect the employees and keep the confidence of retailers. With those aims written on the shared screen, the main dilemma becomes clearer. Waiting for laboratory results would avoid an unnecessary recall of a popular product; acting now would protect consumers but might prove to be a costly overreaction. Guided by its first aim, the team decides on a precautionary withdrawal of the affected batches, notifies the food safety authority that evening and records the reasoning in the decision log.

The communications lead adapts the pre-drafted holding statement, has it checked by legal, and the chief executive records a short video message that expresses concern for the patients, explains what the company is doing and tells consumers how to identify and return the product. Employees receive the same information before it goes public, and retailer contacts are called personally. A dedicated consumer phone line is opened. The team meets every three hours over the weekend; the facilitator keeps each meeting to thirty minutes and makes sure deputies rotate in so that nobody goes without sleep.

Five days later laboratory results confirm that the infection came from an ingredient supplied by a third party. Kestrel expands the withdrawal to two more products using the same ingredient, works with the authorities and the supplier, and moves into recovery, led by the tactical team, while the crisis team stands down to a daily check-in.

Learning

Four weeks later the coordinator runs a post-crisis review with all team members, the factories, the communications agency and two retailer contacts. It confirms what worked (fast activation, clear aims, early transparency) and identifies what did not: supplier ingredient tracing took too long, the consumer phone line was overwhelmed on the first morning, and the decision log missed some decisions made in side conversations. Each lesson is given an owner and a date. Three months later the board's audit committee checks that the changes have been made, and the next exercise tests the improved supplier tracing. Kestrel now treats these as lessons learned rather than lessons identified, because its way of working has actually changed.

Lesson 7 – Relationship to other standards and frameworks

ISO 22361 is one of a family of security and resilience standards from ISO/TC 292. Understanding the neighbours helps you avoid duplication and gaps.

Standard	Type	Main focus	How it relates to ISO 22361
ISO 22301:2019 Business continuity management systems — Requirements	Requirements, certifiable	A management system to keep delivering prioritised products and services during disruption and recover them in time.	Provides the continuity plans and recovery capability that a crisis team relies on. ISO 22361 adds the strategic layer for novel, high-stakes situations.
ISO 22320:2018 Emergency management — Guidelines for incident management	Guidance	Principles and structures for managing incidents, including command and control, coordination and cooperation among responding organizations.	Covers the tactical and operational response to incidents; ISO 22361 covers strategic decisions about the organization as a whole.
ISO 22316:2017 Organizational resilience — Principles and attributes	Guidance	The overall ability of an organization to absorb and adapt in a changing environment.	Crisis management capability is one contributor to organizational resilience; ISO 22316 provides the broader picture.
ISO 31000:2018 Risk management — Guidelines	Guidance	Principles, framework and process for managing risk across an organization.	Risk assessment informs what could cause a crisis; crisis management deals with situations that risk treatment did not prevent or foresee.
ISO 22398 Guidelines for exercises	Guidance	Planning, conducting and evaluating exercises.	Supports the validation activities described in clause 9 of ISO 22361.
ISO 22300 Security and resilience — Vocabulary	Vocabulary	Shared terms for the TC 292 family.	Provides terminology used across ISO 22361 and its neighbours.

Crisis management, business continuity and incident management

Think of three overlapping capabilities. Incident management (ISO 22320 and sector practices such as IT incident response) handles the immediate event: stopping the fire, isolating the infected servers, treating the injured. Business continuity (ISO 22301) keeps or restores the organization's priority activities to agreed levels within agreed times. Crisis management (ISO 22361) protects the organization as a whole, deciding on strategy, values, reputation and stakeholder relationships when the situation is new and the stakes are high. In a serious event all three run at once and must be connected through clear interfaces, which is why ISO 22361 stresses coordination with related disciplines.

Using ISO 22361 alongside other frameworks

Organizations with an ISO 22301 or ISO/IEC 27001 management system can use ISO 22361 to strengthen the parts of those systems that deal with response structure, escalation and communication, and can bring crisis exercises into the same internal audit and management review cycle. In the public sector, crisis management often sits alongside national emergency planning frameworks; ISO 22361 helps an agency organize its own strategic response while working within those wider arrangements. Information security incident standards such as the ISO/IEC 27035 series, and sector-specific operational resilience regulations, address particular types of event; ISO 22361 provides the common strategic approach that sits above them.

Common pitfalls and best practices

Common pitfalls

Treating the business continuity plan as the crisis plan. Recovery plans answer "how do we restore activities?" but not "what should we do, say and stand for?" Crises need both.
Thick scenario manuals. Long plans written for specific scenarios are rarely read and do not fit the crisis that actually happens. Short, flexible plans with clear roles work better.
Escalating too late. Teams wait for certainty or fear "crying wolf", and the organization loses the first, most valuable hours. Smouldering issues are ignored until they become public.
Getting stuck in the detail. Senior executives drift into solving technical problems that the incident teams should handle, while nobody addresses strategy, stakeholders or dilemmas.
Communicating late or inconsistently. Silence, defensive messages or different stories from different parts of the organization destroy trust faster than the event itself.
No decision log. Without a record of what was decided and why, the team repeats discussions, and later reviews, inquiries or courts cannot see the reasoning.
Exercises designed to succeed. Easy, scripted exercises give false confidence and hide the weaknesses that a real crisis will find.
Lessons identified but never learned. Reports are written after each crisis or exercise, but actions are not owned or followed up, so the same problems recur.

Best practices

Make top management own it. The board and executives sponsor the capability, take part in exercises and review its results.
Agree strategic aims early in every crisis. A short set of aims grounded in the organization's purpose and values guides every later decision and message.
Design for flexibility. Use clear roles, a simple meeting rhythm and judgement-based escalation criteria rather than rigid scripts.
Invest in information management. A dedicated information manager, a shared picture that separates facts from assumptions, and fast routes for bad news to reach leaders.
Prepare communication in advance. Stakeholder maps, trained spokespeople, holding statements and channels to employees first.
Exercise realistically and regularly. Progress from tabletop sessions to demanding simulations with real pressure, and include deputies and partners.
Look after the team. Plan for rotation, rest and wellbeing; tired teams make poor decisions.
Close the learning loop. Assign owners and dates for every lesson, check completion at management level and test the changes in the next exercise.

Summary and key takeaways

ISO 22361:2022 is the current, first-edition international guidance on crisis management from ISO/TC 292, adopted in Europe as EN ISO 22361:2022.
A crisis is an abnormal, uncertain and high-stakes situation that threatens the organization and needs a strategic, adaptive and timely response; it is different from an incident that procedures can handle.
The standard is aimed at top management and treats crisis management as a strategic discipline that coordinates with, but is distinct from, emergency, incident, continuity and risk management.
Its main clauses cover context and principles (4), building the capability (5), leadership (6), decision-making in action (7), communication (8) and training, validation and learning (9).
A capability means people, roles, authority, escalation criteria, information, facilities, short plans and practised routines, not just a document.
Crisis teams spend most of their effort on dilemmas and stakeholder trust; clear strategic aims, structured meetings and a decision log help them decide well under pressure.
ISO 22361 is guidance, so organizations cannot be certified against it; readiness is shown through evaluated exercises, reviews, internal audit and post-crisis learning.
Learning is the final and most neglected step: a lesson counts only when it has changed the way the organization works.

Reflection questions

Think of a recent event in your organization or industry. Using the practical test in Lesson 2, was it an incident or a crisis, and at what moment should it have been escalated?
Who would sit on your organization's crisis team today, who would deputise for each of them at 3 a.m. on a holiday, and what decisions could they take without further approval?
Which of your organization's stakeholders would you find hardest to communicate with honestly during a crisis, and what could you prepare now to make it easier?
Describe a dilemma your crisis team could face in which two of your organization's values pull in different directions. How would agreed strategic aims help you decide?
Look at the last exercise or post-incident review you know of. Which lessons were truly learned, which were only identified, and what would it take to close the gap?