ISO 22361 is the international standard for crisis management, and it is the one we build crisis programs around. It is also widely misunderstood. ISO 22361 is a set of guidelines, not a list of requirements, and nobody hands you a certificate for it. Its value is not compliance. Its value is a proven structure for building a team that can make hard decisions fast when the plan runs out.
As I put it on Managing Uncertainty, Episode 310, “We typically build crisis programs that follow the ISO 22361 standard for crisis management.” Here is what the standard actually says, how to implement it without building a binder nobody reads, and where implementations usually go wrong.
| Old View | New View |
| ISO 22361 is a compliance checklist | ISO 22361 is a blueprint for a capability |
| Write a plan for every scenario | Build one way to escalate, decide, and communicate for every crisis |
| The crisis plan is the deliverable | Trained leaders making good decisions are the deliverable |
| Get certified to prove readiness | Exercise to prove readiness; the standard is guidance |
| Crisis management belongs to the crisis team | Crisis management starts with top management and the board |
What is ISO 22361?
ISO 22361:2022, Security and resilience: Crisis management: Guidelines, is the first edition of the international crisis management standard. ISO published it in October 2022 through its technical committee on security and resilience, ISO/TC 292. It runs 36 pages.
In ISO’s words, it “provides guidance on crisis management to help organizations plan, establish, maintain, review and continually improve” a strategic crisis management capability. It covers six areas:
- Context, core concepts, and principles
- Building a crisis management capability
- Crisis leadership
- Strategic decision-making by the crisis team
- Crisis communication
- Training, validation, and learning from crises
The audience matters. ISO 22361 is written for top management with strategic responsibility for crisis management, and for the people who work under their direction. It is not a document for the crisis manager to implement alone.
It also replaced two earlier documents. As Hilary Estall explains in her review of ISO 22361 for Continuity Central, it superseded BS 11200:2014 and PD CEN/TS 17091:2018, both now withdrawn. If your program was built on BS 11200, it is time to recheck it against the current standard.
A crisis is not a big incident
The most useful thing ISO 22361 does is draw a hard line between an incident and a crisis. It defines a crisis as an “abnormal or extraordinary event or situation that threatens an organization or community and requires a strategic, adaptive and timely response in order to preserve its viability and integrity.”
An incident is something your existing plans and procedures can handle. A crisis is something that threatens the organization itself, draws scrutiny, and may go beyond anything your plans anticipated. That distinction drives everything else: who gets called, who decides, and how fast.
Most organizations blur this line. Their “crisis plan” is really an incident plan, and their executives get pulled into events the operating teams should own. Getting the definitions right, and tying them to clear severity levels and activation triggers, is the first real implementation step.
The principles behind ISO 22361
The standard rests on a set of principles. Estall’s review summarizes them this way:
- Governance. Clear structures, roles, responsibilities, and competence.
- Strategy. Leadership, clear objectives, and allocated resources.
- Risk management. Awareness of risk and the ability to assess and respond.
- Decision-making. Decisions based on sound information.
- Communication. Accurate, credible, and timely information to the people who need it.
- Ethics. A response driven by the organization’s values.
- Learning. Exercises, training, and learning from experience.
Notice what is missing: a requirement to write a thick plan. Five of the seven principles are about people, decisions, and judgment. That is the right emphasis.
ISO 22361 is guidance, not a certification
This trips up a lot of buyers. ISO 22301, the business continuity standard, sets requirements for a management system, and organizations can be certified against it. ISO 22361 is guidelines. It tells you what good looks like. It does not give an auditor a list of requirements to certify you against.
That is a feature, not a weakness. You can apply ISO 22361 to a 200-person company and a global health system without pretending they need the same program. Bryghtpath doesn’t build line-by-line gap lists against a standard. We respect the standard and apply it to how your organization actually works, then document where and why we adapted it.
If someone offers to certify your organization to ISO 22361, ask what exactly they are certifying against.
How to implement ISO 22361: seven steps
Here is how we implement ISO 22361 with clients. It follows our four-step process: Diagnose. Design. Deliver. Evolve.
1. Assess where you stand today
Start with an honest baseline. Compare your current program, plans, team structure, and exercise record against the standard, and score it. Our Resiliency Diagnosis® does this against ISO 22361 (along with ISO 22301 and other standards) and produces a maturity score and a prioritized roadmap. If you want to run the assessment yourself, our ISO 22361 Maturity Model is an Excel-based tool built on the standard.
The point of the assessment is not the score. It is knowing which three or four gaps to close first.
2. Define crisis, severity levels, and triggers
Write down what counts as a crisis in your organization, how it differs from an incident, and what triggers escalation. Keep severity levels consistent across the organization. When IT’s Severity 1 and the crisis team’s Level 1 mean different things, someone has to yield, and the middle of an event is the wrong time to decide who.
3. Put top management in charge and write down decision rights
ISO 22361 puts governance first for a reason. Name an executive sponsor. Decide what the crisis team decides, what is reserved to executives (major spend, reputational strategy, external messaging), and what is reserved to the board.
Somebody has to run the response. Split the role: an incident leader who runs the process, and a responsible executive who makes or confirms the big decisions. The incident leader does not need to be the most senior person in the room.
Boards have a role too, but it is oversight, not operations. In Episode 310, I described it this way: standards like ISO 22361 “emphasize governance as a cornerstone of effective crisis leadership.” The board makes sure a tested framework exists; it does not decide which systems to shut down.
4. Build a framework, not a binder
Build one consistent way to escalate, convene, decide, and communicate, and use it for every crisis. Cyber, weather, product, misconduct: the type changes, the process does not. Then add short scenario annexes (role checklists, assessment questions, and strategies) on top.
The standard agrees. Estall notes that ISO 22361’s guidance on the crisis management plan says it should not include specific scenarios. A focused crisis management plan that leaders can use on a phone beats a 200-page binder every time.
Build crisis communication into the same framework. ISO 22361 treats communication as a principle, not an afterthought: holding statements, approved channels, spokespeople, and a clear flow of information inside the team and out.
5. Train your leaders before you exercise them
Training comes before exercises. On Episode 308, I put it plainly: “our standards, like ISO 22361, call out leadership competence as a critical piece of crisis readiness.” Without that foundation, “exercises create false lessons. You think your plan is broken when really your people were just never trained.”
Executive training does not have to be a half-day class. Thirty to sixty minutes on the framework, their role in decision-making, the communication cadence, and your risk tolerances is often enough.
6. Exercise decisions, not scripts
ISO 22361 emphasizes validation and learning. The best validation is an exercise that forces your executives to make real decisions with incomplete information and live with them. Our guide to crisis management exercises covers how to design them, and you should rotate who leads so you build bench strength rather than depending on one person.
7. Learn and improve
Every exercise and every real event should end with a hot wash and an After-Action Report (AAR) that reads like a work plan, with owners and dates. That is the “continually improve” in ISO’s own description of the standard. Our after-action process shows how to run it so the lessons actually get fixed.
What ISO 22361 looks like in practice
A major healthcare system in the southwestern United States came to us with hospital-level emergency management in place but no system-wide program. Together we built a System Emergency Management Program aligned with ISO 22361 and Joint Commission requirements.
The work started with governance: a strategy that brought business continuity, system emergency management, and hospital emergency management under one framework, plus a resilience steering committee. From there came the framework and plan, templates, checklists, and training, then an exercise strategy with tabletop exercises and a lessons-learned process. The program ended with a handoff to the in-house team, with maturity scoring tools so they could keep measuring progress on their own.
That sequence (governance, framework, training, exercises, learning) is ISO 22361 implemented.
Common mistakes when implementing ISO 22361
- Treating it as a compliance project. A program built to pass a review is not a program built to work. Compliance is not resilience.
- Writing a plan for every scenario. You will face something you never planned for. A framework handles it; a stack of scenario plans doesn’t.
- Running separate crisis teams. One team for cyber and another for everything else gives your CEO two uncoordinated updates and no clear role.
- Skipping training. Executives who don’t know the framework spend the first half hour of an exercise arguing about the process instead of deciding.
- Leaving the board out. The standard puts top management and governance at the center. Brief your board and, once the program is mature enough, bring them into an exercise.
- Treating it as a one-time project. Crisis capability decays quietly. Leaders change, teams turn over, and muscle memory fades unless you keep training and exercising.
How ISO 22361 fits with other standards
ISO 22361 works alongside ISO 22301. Business continuity keeps critical processes running; crisis management handles the strategic decisions when an event threatens the organization itself. Your crisis framework should connect to your BC program, not duplicate it. The standards section of our Ultimate Guide to Crisis Management covers how they fit together.
It also complements the Incident Command System (ICS) and FEMA’s approach to emergency management. ICS was built to coordinate public agencies at the scene. ISO 22361 is built for an organization’s strategic response. Hospitals and utilities often use both: ICS-aligned structures for operations, and an ISO 22361-style crisis team for the decisions that affect the whole enterprise.
ISO 22361 won’t make your crisis team good. Training, practice, and honest learning will. The standard tells you what good looks like, and that is the right place to start.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Crisis Management.
- Score yourself against the standard. Our ISO 22361 Maturity Model lets your team assess its crisis management program clause by clause.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your crisis management program with us.
