ISO 22361:2022 Crisis Management Guidelines compliance software
Measure and strengthen your crisis management capability — leadership, decision-making, communication and learning — against ISO 22361 guidance.
What ISO 22361 requires
ISO 22361:2022 provides internationally agreed guidance on building a crisis management capability: the structures, leadership, strategic decision-making, communication and learning an organisation needs when events exceed normal incident response. Unlike ISO 22301 it is a guidance standard rather than a certifiable requirements standard.
The standard is aimed squarely at top management. Crises are characterised by uncertainty, time pressure and consequences that threaten strategy and reputation — conditions in which pre-agreed structures, trained leaders and disciplined decision logging determine outcomes.
GRCLens expresses the guidance as an assessable capability catalogue: each element of the standard becomes a statement the executive team can score, own and evidence, turning an abstract guideline into a measurable programme.
Who it applies to
- Boards and executive teams accountable for crisis response
- Organisations formalising a crisis management team (CMT) structure
- Entities whose regulators expect demonstrable crisis preparedness
- Organisations complementing ISO 22301 continuity arrangements with crisis capability
At a glance
- Issuing body: ISO — first edition 2022
- Nature: Guidance standard (not certifiable)
- Core themes: Principles, capability, leadership, decision-making, communication, learning
- Assessment basis: Capability statements scored and evidenced by the executive team
How GRCLens supports ISO 22361
ISO 22361 runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
Capability catalogue
The guidance is decomposed into 41 assessable statements across six domains — from activation thresholds and crisis facilities to decision logging and reputation recovery.
Executive-only dashboard
A single management view of crisis readiness. No operational work queue — the standard is a leadership discipline, and the dashboard reflects that.
Owners and evidence
Each capability statement carries an owner, status and dated evidence: exercise reports, decision logs, spokesperson training records.
Assurance workflow
Gaps identified in exercises or real events become owned items in the assurance register, tracked through remediation and second-party verification.
Bilingual operation
The catalogue operates in English and Arabic, so Gulf executive teams can assess crisis capability in their working language.
ISO 22361 frequently asked questions
Can we get certified against ISO 22361?
No. ISO 22361 is a guidance standard, not a requirements standard, so there is no accredited certification against it. Organisations use it to build and benchmark crisis management capability, which GRCLens turns into a scored, evidenced assessment.
How does ISO 22361 relate to business continuity?
Business continuity (ISO 22301) keeps priority activities running through disruption; crisis management (ISO 22361) equips leadership to direct the organisation when an event threatens strategy and reputation. Mature organisations run both, and GRCLens supports both on one platform.
Who should own the ISO 22361 assessment?
Top management. The standard addresses leadership structures, strategic decision-making and crisis communication, so GRCLens presents it with an executive dashboard and assigns capability statements to senior owners.
What evidence demonstrates crisis capability?
Typical evidence includes the crisis management plan, CMT terms of reference, activation criteria, exercise and training records, decision logs from exercises or real events, and post-crisis review reports — all attachable to the relevant statement in GRCLens.
One platform, many obligations
Talk to us about ISO 22361
Security Solution Consultants provides Crisis management advisory services alongside the platform, so you can combine tooling with hands-on expertise.
Contact us