ISO 22317
What is ISO 22317?
Guidelines for business impact analysis. It comprises 25 controls organised across 4 domains, published by ISO/IEC, and applies in International.
How ISO 22317 maps to other frameworks
All 25 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.
See the control mappings →The 4 domains ISO 22317 groups its controls into
Frameworks that share controls with ISO 22317
Each of these has at least one control mapped to a control in ISO 22317. The number is how many ISO 22317 controls are shared, counted from the mapping graph.
PSD2 SCA
5 shared controlsOSFI B-13
5 shared controlsOpen Banking Security
5 shared controlsOman National Cybersecurity Framework
5 shared controlsNIS2 Directive Implementing Acts
5 shared controlsNevada Gaming Control Board Cybersecurity Requirements
5 shared controlsMonetary Authority of Singapore Technology Risk Management Guidelines
5 shared controlsPCI SSF
5 shared controlsWhere ISO 22317 overlaps with the standards you already hold
Where to get trained on ISO 22317
One course in the catalogue covers ISO 22317 directly. Each is self-paced, includes the downloadable toolkit and the implementation playbook, and carries a certificate of completion.
Training more than one person? Ten seats of any course is $1,490 on a single licence, against $199 a seat bought one at a time.
What an auditor will ask you for
All 36 ISO 22317 controls, each with what it requires, the artefacts an auditor will ask you for, and where it commonly fails. Free to read, nothing to fill in.
Read the ISO 22317 evidence request listWhat ISO 22317 means in your sector
What ISO 22317 means for your job
Questions people ask about ISO 22317
What is ISO 22317?
How many controls does ISO 22317 have?
Where does ISO 22317 apply?
What frameworks does ISO 22317 map to?
How do I get started with ISO 22317 compliance?
Query ISO 22317 programmatically
ISO 22317, its 25 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
ISO 22317 API reference and MCP config →What ISO 22317 requires, control by control
Each page carries the requirement text for one ISO 22317 control and what an assessor expects to see as evidence.
- 05 Management commitment to BCM
- 06 Business impact analysis methodology
- 08 Recovery time and point objectives
- 09 Resource requirements assessment
- 11 Continuity strategy development
- 12 Recovery strategy for critical activities
- 14 Supply chain continuity
- 15 Communication strategy during disruption
- 5-7 Resource Requirements Analysis
How ready are you for ISO 22317?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.