Overview - ISO 22396:2020 in brief
ISO 22396:2020, "Security and resilience - Community resilience - Guidelines for information exchange between organizations," provides methodological guidance for setting up, operating and maintaining structured information‑exchange arrangements. It focuses on principles, a framework and a process to help public and private organizations share operational, risk and resilience information (including sensitive information) in a trusted, secure and value‑creating way. The standard is deliberately non‑technical - it addresses governance, roles, procedures and legal considerations rather than IT implementation details.
Key topics and requirements
ISO 22396:2020 organizes guidance into three main parts and related elements:
-
Principles - core guiding concepts such as:
- Trust and willingness to exchange information
- Value creation and mutual benefit
- Information protection and classification
- Structured, systematic processes, security and integrity
- Commitment to share, support decision‑making and continual improvement
-
Framework components - organizational elements to establish and sustain exchanges:
- Leadership and top‑management commitment
- Context analysis and stakeholder mapping
- Design and establishment of governance, objectives and policies
- Implementation, monitoring, review and continual improvement
-
Process guidance - practical steps for operating exchanges:
- Establishing needs and expressions of interest
- Preparing participating organizations (internal and external readiness)
- Defining exchange structure (purpose, membership, classification)
- Operating and maintaining arrangements (meetings, platforms, information handling)
- Monitoring, review and improvement cycles
-
Mechanisms and examples - non‑technical tools such as classification schemes and the Traffic Light Protocol (TLP) (Annex A) to manage sensitivity and sharing limits.
Note: ISO 22300 (vocabulary) is referenced for key terms. Users must assess legal and jurisdictional requirements separately.
Practical applications - who uses it and why
ISO 22396:2020 is applicable to:
- Government agencies (emergency management, public safety)
- Critical infrastructure operators (utilities, transport, telecom)
- Private enterprises with interdependencies across supply chains
- Industry associations and community resilience groups
- NGOs and multi‑stakeholder partnerships
Typical uses:
- Designing cross‑sector information‑sharing partnerships to improve situational awareness
- Establishing secure channels and governance for sharing vulnerability or incident data
- Creating membership rules, classification and retention policies for collaborative platforms
- Improving decision‑making and resilience through reliable, timely shared intelligence
Related standards
- ISO 22300 - Security and resilience - Vocabulary (normative reference)
- Developed by ISO/TC 292 (Security and resilience)
ISO 22396:2020 is a practical, governance‑oriented standard for organizations that need to formalize information exchange to enhance community resilience, trust and operational decision‑making.
Open preview (PDF)Security and resilience — Community resilience — Guidelines for information exchange between organizations
