ISO/TS 22318:2021: every control, and what you already have

76 controls 125 frameworks share controls with it International (ISO/TC 292); adopted as PD ISO/TS 22318 (UK) and by other national bodies verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
ASD Strategies to Mitigate Cyber Security Incidents	5	measure it →
ASIS SPC.1-2009	5	measure it →
FFIEC IT Examination Handbook	5	measure it →
ISO 22316	5	measure it →
ISO/IEC 27031:2011	5	measure it →
ISO/TS 22317:2021	5	measure it →
Monetary Authority of Singapore Technology Risk Management Guidelines	5	measure it →
Nevada Gaming Control Board Cybersecurity Requirements	5	measure it →
NFPA 1600	5	measure it →
NIS2 Directive Implementing Acts	5	measure it →
Oman National Cybersecurity Framework	5	measure it →
Open Banking Security	5	measure it →

Every control

Code	Control	Also in
`ISO22318-01`	Business continuity policy	0
`ISO22318-02`	BCM program scope and objectives	0
`ISO22318-03`	Resource allocation for BCM	0
`ISO22318-04`	BCM roles and responsibilities	0
`ISO22318-05`	Management commitment to BCM	2
`ISO22318-06`	Business impact analysis methodology	1
`ISO22318-07`	Critical activity identification	0
`ISO22318-08`	Recovery time and point objectives	69
`ISO22318-09`	Resource requirements assessment	1
`ISO22318-10`	Interdependency mapping	0
`ISO22318-11`	Continuity strategy development	0
`ISO22318-12`	Recovery strategy for critical activities	69
`ISO22318-13`	Alternate site and resource planning	27
`ISO22318-14`	Supply chain continuity	77
`ISO22318-15`	Communication strategy during disruption	40
`ISO22318-16`	Exercise program development	0
`ISO22318-17`	Tabletop and simulation exercises	0
`ISO22318-18`	Full-scale testing procedures	0
`ISO22318-19`	Post-exercise review and improvement	0
`ISO22318-20`	Plan maintenance and update	0
`ISO22318-4.1`	Supply Chain Continuity Programme	0
`ISO22318-4.2`	Supply Chain Risk Appetite	0
`ISO22318-5.1`	Supplier Identification and Mapping	0
`ISO22318-5.2`	Supplier Criticality Assessment	0
`ISO22318-5.3`	Supplier Dependency Analysis	0
`ISO22318-5.4`	Supplier Continuity Requirements	0
`ISO22318-5.5`	Supplier Due Diligence	0
`ISO22318-6.1`	Supply Chain Continuity Strategies	0
`ISO22318-6.2`	Alternative Supplier Arrangements	0
`ISO22318-6.3`	Inventory and Buffer Stock Strategy	0
`ISO22318-7.1`	Supplier Continuity Plans	0
`ISO22318-7.2`	Communication and Coordination	13
`ISO22318-8.1`	Supplier Continuity Exercising	0
`ISO22318-8.2`	Supplier Performance Monitoring	0
`ISO22318-9.1`	Concentration and Systemic Risk Review	0
`ISO22318-9.2`	Continual Improvement of Supply Chain Continuity	0
`4`	4 The value of supply chain continuity management	0
`4.1`	4.1 The supply chain	0
`4.1.1`	4.1.1 The supply chain: general	0
`4.1.2`	4.1.2 Supply chain model	0
`4.2`	4.2 Supply chain continuity management	0
`4.2.1`	4.2.1 Supply chain continuity management: general	0
`4.2.2`	4.2.2 Embedding SCCM	0
`4.2.3`	4.2.3 Benefits and opportunities	0
`4.3`	4.3 Risk ownership	0
`4.4`	4.4 SCCM ownership	0
`5`	5 BCMS prerequisites for SCCM	0
`5.2`	5.2 Obtain top management commitment	0
`5.2.1`	5.2.1 Accountability and responsibility	0
`5.2.2`	5.2.2 Resources for managing SCCM	0
`5.2.3`	5.2.3 SCCM framework	0
`5.2.4`	5.2.4 Performance evaluation programme	0
`5.3`	5.3 Promulgate business continuity principles throughout the supply chain	0
`5.4`	5.4 Analyse continuity requirements and assess risk	0
`5.4.2`	5.4.2 Continuity requirements	0
`5.4.3`	5.4.3 Risk assessment	0
`6`	6 Effective SCCM	0
`6.2`	6.2 Identify strategies and solutions	0
`6.2.2`	6.2.2 Option 1: Reduce dependency and impact	0
`6.2.3`	6.2.3 Option 2: Rely on the organization's business continuity strategies and solutions	0
`6.2.4`	6.2.4 Option 3: Rely on the supplier's business continuity strategies and solutions	0
`6.2.5`	6.2.5 Option 4: Do nothing and retain the risk by informed decision	0
`6.3`	6.3 Assess suppliers' continuity compliance	0
`6.4`	6.4 Establish contractual obligations	0
`6.4.2`	6.4.2 Principles to establish the continuity requirements in the contract	0
`6.4.3`	6.4.3 Continuity requirements	0
`6.5`	6.5 Review and update	0
`7`	7 Maintenance, performance and continual improvement	0
`7.2`	7.2 Maintenance	0
`7.3`	7.3 Performance evaluation	0
`7.4`	7.4 Continual improvement	0
`A`	Annex A Example of general questions to be sent to priority suppliers (informative)	0
`B`	Annex B Managing priority suppliers' disruptions (informative)	0
`C`	Annex C Examples of joint exercises with suppliers (informative)	0
`STANDARD`	ISO/TS 22318:2021: the specification, its scope and what is held	0
`STATUS`	Edition status: the 2021 second edition is current; the framework renamed from 'ISO 22318'	0

Tell me when ISO/TS 22318:2021 files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Lessons learned register
Improvement plan
Lessons register
Process updates
Training updates
Metrics dashboard

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

Lessons not actioned named by 6 frameworks

What this page is

A control-level reference for ISO/TS 22318:2021, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition