ISO/TS 22317:2021: every control, and what you already have

72 controls 125 frameworks share controls with it International (ISO/TC 292); adopted as PD ISO/TS 22317 (UK) and by other national bodies verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
ASD Strategies to Mitigate Cyber Security Incidents	5	measure it →
ASIS SPC.1-2009	5	measure it →
FFIEC IT Examination Handbook	5	measure it →
ISO 22316	5	measure it →
ISO/IEC 27031:2011	5	measure it →
ISO/TS 22318:2021	5	measure it →
Monetary Authority of Singapore Technology Risk Management Guidelines	5	measure it →
Nevada Gaming Control Board Cybersecurity Requirements	5	measure it →
NFPA 1600	5	measure it →
NIS2 Directive Implementing Acts	5	measure it →
Oman National Cybersecurity Framework	5	measure it →
Open Banking Security	5	measure it →

Every control

Code	Control	Also in
`ISO22317-01`	Business continuity policy	0
`ISO22317-02`	BCM program scope and objectives	0
`ISO22317-03`	Resource allocation for BCM	0
`ISO22317-04`	BCM roles and responsibilities	0
`ISO22317-05`	Management commitment to BCM	2
`ISO22317-06`	Business impact analysis methodology	1
`ISO22317-07`	Critical activity identification	0
`ISO22317-08`	Recovery time and point objectives	69
`ISO22317-09`	Resource requirements assessment	1
`ISO22317-10`	Interdependency mapping	0
`ISO22317-11`	Continuity strategy development	27
`ISO22317-12`	Recovery strategy for critical activities	69
`ISO22317-13`	Alternate site and resource planning	0
`ISO22317-14`	Supply chain continuity	77
`ISO22317-15`	Communication strategy during disruption	40
`ISO22317-16`	Exercise program development	0
`ISO22317-17`	Tabletop and simulation exercises	0
`ISO22317-18`	Full-scale testing procedures	0
`ISO22317-19`	Post-exercise review and improvement	0
`ISO22317-20`	Plan maintenance and update	0
`ISO22317-4.1`	BIA Programme Establishment	0
`ISO22317-4.2`	BIA Methodology and Approach	0
`ISO22317-5.1`	Prioritized Activities Identification	0
`ISO22317-5.2`	Impact Categories and Tolerances	0
`ISO22317-5.3`	Maximum Tolerable Period of Disruption (MTPD)	0
`ISO22317-5.4`	Recovery Time Objective (RTO)	0
`ISO22317-5.5`	Recovery Point Objective (RPO)	0
`ISO22317-5.6`	Minimum Business Continuity Objective (MBCO)	0
`ISO22317-5.7`	Resource Requirements Analysis	1
`ISO22317-5.8`	Interdependencies and Single Points of Failure	0
`ISO22317-6.1`	BIA Data Collection	0
`ISO22317-6.2`	BIA Validation and Sign Off	0
`ISO22317-7.1`	BIA Outputs Reporting	0
`ISO22317-7.2`	Linking BIA to Continuity Strategy	0
`ISO22317-8.1`	BIA Maintenance and Refresh	0
`ISO22317-8.2`	BIA Programme Assurance	0
`4`	4 Prerequisites	0
`4.2`	4.2 Context and scope	0
`4.2.1`	4.2.1 Context	0
`4.2.2`	4.2.2 Scope	0
`4.3`	4.3 Roles and responsibilities	0
`4.3.2`	4.3.2 BIA leader	0
`4.3.3`	4.3.3 Activity owners	0
`4.4`	4.4 Commitment	0
`5`	5 The BIA process	0
`5.1`	5.1 Fundamentals	0
`5.2`	5.2 Plan BIA	0
`5.3`	5.3 Agree approach for undertaking BIA process	0
`5.3.1`	5.3.1 Understand impacts	0
`5.3.2`	5.3.2 Define impact types and criteria	0
`5.3.3`	5.3.3 Define time frames	0
`5.3.4`	5.3.4 Define methodology	0
`5.4`	5.4 Determine products and services' priorities with top management	0
`5.4.3`	5.4.3 Product and service priority determination	0
`5.5`	5.5 Determine the prioritized activities	0
`5.5.3`	5.5.3 Identify activities	0
`5.5.4`	5.5.4 Set RTO for the activities	0
`5.5.5`	5.5.5 Define the prioritized activities	0
`5.6`	5.6 Identify resources and other dependencies	0
`5.6.1`	5.6.1 Identify resource and other dependency requirements	0
`5.6.2`	5.6.2 Resource requirements	0
`5.7`	5.7 Analyse and consolidate BIA results	0
`5.8`	5.8 Obtain top management approval for BIA results	0
`6`	6 Review BIA	0
`6.1`	6.1 Review BIA process and methodology	0
`6.2`	6.2 Review BIA results	0
`A`	Annex A BIA within the BCMS of ISO 22301:2019 (informative)	0
`B`	Annex B BIA information collection methods (informative)	0
`C`	Annex C Other uses for the BIA process (informative)	0
`D`	Annex D Examples for performing a BIA (informative)	0
`STANDARD`	ISO/TS 22317:2021: the specification, its scope and what is held	0
`STATUS`	Edition status: the 2021 second edition is current; the framework renamed from 'ISO 22317' and its version corrected from 2015	0

Tell me when ISO/TS 22317:2021 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Internal audit reports on BIA
Peer review or external assurance reports
Improvement action log
compliance assessment reports
regulatory inventory
corrective action plans
Acquisition workflow with C-SCRM gates
Requirements templates with C-SCRM clauses
Source selection evaluation criteria
Award documentation

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

No independent assurance named by 5 frameworks
Templates outdated named by 3 frameworks

What this page is

A control-level reference for ISO/TS 22317:2021, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition