ISO 22320 implementation for incident response that stays coordinated under pressure.

What it is

What is ISO 22320 and what is it used for?

ISO 22320 is the ISO guideline for incident management, written by the emergency management subcommittee of ISO/TC 292, Security and resilience. It describes how to direct the response once an incident is under way: the principles a response should follow, the process of gathering information, deciding and acting against the clock, the structure of roles, tasks and resources, and the arrangements that let several organisations respond as one.

In practice it is used to test and strengthen the emergency response plan, the site or corporate incident team and the handover to public emergency services. A continuity plan tells you what must resume and when; ISO 22320 is about the hours in which people are still containing the event, protecting life and deciding who does what.

Current edition. ISO 22320:2018, published in November 2018, is the second edition. It replaced ISO 22320:2011, which was framed as requirements for incident response and has been withdrawn; the 2018 text was technically revised and issued as guidelines. ISO confirmed the 2018 edition in March 2024 after its systematic review, and no revision is listed.

Who it is for

Who needs ISO 22320?

The guideline applies to any organisation involved in responding to incidents, whatever their type and scale. Nobody is obliged to adopt it, which is exactly why it helps to know what is prompting the question. Clients usually arrive from one of four directions:

• A customer or insurer asks how you handle incidents. Due diligence questionnaires increasingly ask who takes charge, how escalation works and when the plan was last exercised. ISO 22320 gives a recognised reference for the answer.
• A tender or concession names incident management. Airports, ports, utilities, venues and facilities contracts often ask the operator to show a structured response capability and joint working with public agencies.
• A regulator or local authority expects coordinated response. Hazardous sites, healthcare and critical infrastructure operators are asked to demonstrate that their arrangements mesh with public emergency services. The guideline helps you build that interface; the legal duties themselves come from your regulator.
• A group wants one way of responding across companies. Subsidiaries with different plans, titles and contact routes struggle when an incident crosses sites or borders. A common structure lets people step into roles they recognise.

Guidance

What does ISO 22320 cover?

ISO 22320 contains recommendations rather than requirements. After the scope, normative references and terms, its guidance sits in three clauses, supported by four informative annexes. The list below maps them in plain language at title level; during the programme your arrangements are compared with the full text of the 2018 edition.

• Clause 4 Principles: ethics, unity of command, working together, an all-hazards approach, risk management, preparedness, information sharing, safety, flexibility, human and cultural factors, and continual improvement.
• Clause 5 Incident management process: seeing the incident from different perspectives, understanding the importance of time and acting proactively rather than waiting for events.
• Clause 5 Incident management structure: roles and responsibilities, the tasks the response must cover and the management of resources.
• Clause 6 Working together: the prerequisites for coordination and cooperation between organisations, and how methods for joint working are developed and put into use.
• Annexes A to D: further guidance on working together and on structure, examples of incident management tasks, and incident management planning.

Putting it into practice

How do you implement ISO 22320?

There is no audit at the end of this route, so the discipline has to come from the work itself. Sterling runs it in five steps and measures success by how the response performs in an exercise.

1. 01
   Agree the incidents and partners in scope.Sites, credible hazards, the organisations you would respond alongside and the obligations already placed on you.
2. 02
   Gap analysis: compare current arrangements with the guidelines.Plans, team structures, call-out lists, protocols and past incident logs reviewed against each principle and clause; what works is kept.
3. 03
   Design the structure and the joint working.Roles, deputies, tasks, resources and information flows written into a plan people can follow, with agreed interfaces to emergency services and partners.
4. 04
   Train and exercise.Role briefings, then scenario exercises from table-top to live, each with a report and actions owned and dated.
5. 05
   Review, embed and extend.Lessons from exercises and real events feed the plan; where a certificate is wanted, the response capability becomes part of an ISO 22301 system assessed by an accredited certification body.

Check the route before you sign. ISO 22320 sets out guidance, so there is nothing an accredited certification body can certify against it. If someone offers an "ISO 22320 certificate", ask which standard it is issued against and which accreditation body covers that scope, then confirm the answer on the accreditation body's own register. The certification buyer's checklist

Cost

How much does ISO 22320 implementation cost?

A single office with a sound evacuation plan needs far less than a multi-site operator handling hazardous materials alongside port authorities and fire services. The fee follows the work, and the proposal shows every part of it.

Timeline

How long does ISO 22320 implementation take?

Pace depends on how quickly incident team members can attend workshops, how many partners must agree protocols and when an exercise can be scheduled without disrupting operations. As an estimate, an organisation with existing emergency plans typically needs two to four months to reach a tested structure; the exercise calendar, not the writing, usually sets the date.

Your engagement

What your ISO 22320 engagement includes

Sterling does not certify, and no one issues an ISO 22320 certificate; what we deliver is a response capability aligned with the guidelines and the evidence to show it. Under Sterling OS™ you choose the level of support: Design™, a guided route in which our consultant leads the workshops and your team writes and owns the plan, or Drive™, a managed route in which Sterling prepares the deliverables for your approval. They are alternatives, not stages. Sustain™ follows, with periodic exercises and plan reviews, and Automate™ is Effivity, where the plan and its records run.

• Scope and gap analysis

  Against every principle and clause of the 2018 edition, with a prioritised action list.

• Incident management plan

  Structure, role cards, activation, escalation and resource arrangements, on Sterling templates adapted to your sites.

• Joint working protocols

  Interfaces with emergency services, landlords, contractors and group companies, drafted for their agreement.

• Training and exercises

  Role briefings and scenario exercises with written reports, plus complimentary awareness training through Sterling Academy.

• Effivity workspace

  Plans, actions and records kept current, included with the engagement at no additional cost.

• Management review

  A findings summary for leadership and the decisions still needed on resources.

Where certification is wanted, it comes from an accredited certification body against a certifiable standard such as ISO 22301.

Often combined with

Standards organisations pair with ISO 22320

• AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
• COSO ERMCOSO ERM implementation and requirements: the five components and 20 principles of the 2017 framework, why no certificate exists, route, cost and timeline.
• COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
• FCPA and UK Bribery ActFCPA and UK Bribery Act compliance: the requirements, six principles and DOJ expectations, and how Sterling builds a proportionate anti-bribery programme.
• ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
• ISO 22313 · ISO/TS 22317 · ISO/TS 22318ISO 22313 and ISO 22317 / 22318 guidance explained: applying ISO 22301, business impact analysis and supplier continuity.