ISO 22320:2018: every control, and what you already have

91 controls 248 frameworks share controls with it International (ISO/TC 292); adopted as BS ISO, DIN ISO, SS ISO (Singapore, 2022), SSB ISO, GTC ISO (Panama) and GB/T (China) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
Annex 11 to EU GMP	7	measure it →
FFIEC IT Examination Handbook	7	measure it →
ISO 28001:2007 Supply Chain Security Management	7	measure it →
ISO/IEC 23894:2023	7	measure it →
Monetary Authority of Singapore Technology Risk Management Guidelines	7	measure it →
MTCS (Singapore)	7	measure it →
NIST Cybersecurity Framework 2.0	7	measure it →
NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security	7	measure it →
Open Banking Security	7	measure it →
OSFI B-13	7	measure it →
PCI P2PE	7	measure it →
PCI PIN Security	7	measure it →

Every control

Code	Control	Also in
`ISO-22320-4.2`	Ethics	0
`ISO-22320-4.3`	Risk-based approach	75
`ISO-22320-4.4`	Information sharing	0
`ISO-22320-4.5`	Safety	0
`ISO-22320-4.6`	Flexibility and adaptability	0
`ISO-22320-4.7`	Human and cultural factors	1
`ISO-22320-4.8`	Continual improvement	16
`ISO-22320-5.1`	General process requirements	135
`ISO-22320-5.2`	Incident management process	136
`ISO-22320-5.3`	Incident management structure (command)	135
`ISO-22320-5.4`	Roles and responsibilities	137
`ISO-22320-5.5`	Resource management	0
`ISO-22320-6.1`	General cooperation requirements	0
`ISO-22320-6.2`	Collaboration and coordination	0
`ISO-22320-6.3`	Communication protocols	13
`ISO-22320-6.4`	Joint direction	0
`ISO-22320-A`	Annex A: Collaboration and communication guidance	0
`ISO-22320-B`	Annex B: Incident management plan structure	109
`ISO-22320-C`	Annex C: Incident management task examples	109
`ISO22320-10.1`	Post Incident Review and Lessons Learned	0
`ISO22320-10.2`	Continual Improvement of Incident Management	0
`ISO22320-4.1`	Incident Management Policy	0
`ISO22320-4.2`	Roles, Responsibilities, and Authorities	12
`ISO22320-5.1`	Command Function	0
`ISO22320-5.2`	Control Function	0
`ISO22320-5.3`	Coordination Function	0
`ISO22320-6.1`	Incident Command System Structure	0
`ISO22320-6.2`	Common Terminology and Plain Language	0
`ISO22320-6.3`	Incident Action Planning	0
`ISO22320-7.1`	Operational Information Management	0
`ISO22320-7.2`	Communication Systems and Interoperability	13
`ISO22320-7.3`	Situational Awareness and Common Operating Picture	0
`ISO22320-8.1`	Cooperation with External Agencies	0
`ISO22320-8.2`	Multi Agency Coordination	0
`ISO22320-9.1`	Human Factors and Welfare	0
`ISO22320-9.2`	Training, Exercising, and Competence	0
`4`	4 Principles of incident management	0
`5`	5 Incident management	0
`5.1`	5.1 Incident management: general	0
`5.2`	5.2 Incident management process	0
`5.2.1`	5.2.1 Incident management process	0
`5.2.2`	5.2.2 Different perspectives	0
`5.2.3`	5.2.3 Understanding the importance of time	0
`5.2.4`	5.2.4 Being proactive	0
`5.3`	5.3 Incident management structure	0
`5.3.1`	5.3.1 Incident management structure	0
`5.3.2`	5.3.2 Roles and responsibilities	0
`5.3.3`	5.3.3 Incident management tasks	0
`5.3.4`	5.3.4 Incident management resources	0
`6`	6 Working together	0
`6.1`	6.1 Working together: general	0
`6.2`	6.2 Prerequisites for achieving coordination and cooperation	0
`6.2.1`	6.2.1 Sharing the same incident management process	0
`6.2.2`	6.2.2 Seeing the whole picture	0
`6.2.3`	6.2.3 Common operational picture	0
`6.2.4`	6.2.4 Establishing communication	0
`6.2.5`	6.2.5 Establishing joint decisions	0
`6.3`	6.3 Developing and implementing methods for working together	0
`6.3.1`	6.3.1 Developing and implementing methods for working together: general	0
`6.3.2`	6.3.2 Agreements	0
`6.3.3`	6.3.3 Technical equipment	0
`A`	A Additional guidance on working together (informative)	0
`A.1`	A.1 Seeing the whole picture (comprehensive perspective)	0
`A.2`	A.2 Setting different perspectives	0
`A.3`	A.3 Developing and implementing methods for working together (trust)	0
`A.4`	A.4 Developing and implementing coordination (time)	0
`A.5`	A.5 Communication	0
`B`	B Additional guidance on incident management structure (informative)	0
`B.1`	B.1 Incident management structure: general	0
`B.2`	B.2 Chain of command and unity of command	0
`B.3`	B.3 Joint or unified command	0
`B.4`	B.4 Span of control	0
`B.5`	B.5 Designated incident facilities	0
`B.6`	B.6 Resource management	0
`C`	C Examples of incident management tasks (informative)	0
`C.1`	C.1 Incident command	0
`C.10`	C.10 Finance and administration	0
`C.11`	C.11 Intelligence and investigations	0
`C.2`	C.2 Public information	0
`C.3`	C.3 Liaison officer	0
`C.4`	C.4 Expert advisor or consultant	0
`C.5`	C.5 Operations planning and lead	0
`C.6`	C.6 Operational picture	0
`C.7`	C.7 Logistics	0
`C.8`	C.8 Personnel	0
`C.9`	C.9 Information and communication technology support	0
`D`	D Incident management planning (informative)	0
`D.1`	D.1 Incident management planning: general	0
`D.2`	D.2 Plan elements	0
`STANDARD`	ISO 22320:2018: the standard, its scope and what is held	0
`STATUS`	Edition status: the 2018 second edition is current; 2011 was a requirements standard	0

Tell me when ISO 22320:2018 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Governance framework doc
Board charter
RACI matrix
access control matrix
RBAC documentation
access review reports

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

No periodic review named by 6 frameworks

What this page is

A control-level reference for ISO 22320:2018, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition