One page per clause
The guidance in our words, the evidence a reviewer asks for, the common gaps and what to do before the second edition lands.
Open the register20 disciplines, all informative
Annex A names the management disciplines that can support the coordination required by clause 5.8, from asset management to strategic planning. It does not define them or set controls for them. Each page says so, because an assessment finding has to rest on a clause, not on a list. Use the pages to see how a discipline contributes, and the clause to decide what to require.
20 disciplinesInformativeSupports clause 5.8
Why the label matters. If someone tells you that Annex A requires a particular discipline or control, ask which normative clause does. ISO 22316 is guidance throughout, and Annex A is a sample list, not a requirement set. The discipline can be the best explanation of clause 5.8 without adding an obligation.
Asset and continuity
| Item | Discipline | The contribution in one line |
|---|---|---|
| A.1 | Asset management | Asset management shows which physical and intangible assets a core service depends on, so the resource and single-point-of-failure work in 5.7 rests on a real inventory rather than an assumption. |
| A.2 | Business continuity management | Business continuity management supplies the recovery plans, the impact analysis and the exercise discipline that make the resource decisions in 5.7 testable rather than theoretical. |
| A.3 | Crisis management | Crisis management gives the organization a practised way to take command, decide and communicate when the normal structure is overloaded, which is the leadership and change capability described in 5.4 and 5.10. |
Security and safety
| Item | Discipline | The contribution in one line |
|---|---|---|
| A.4 | Cyber security management | Cyber security management protects the systems and information a core service needs, and it supplies the incident and dependency evidence that the resilience assessment in clause 6 uses. |
| A.5 | Communications management | Communications management turns a decision into something staff, customers and authorities can act on, which supports the shared purpose in 5.2 and the reporting duty in 6.4. |
| A.6 | Emergency management | Emergency management protects life, property and the environment in the immediate response, and it gives the crisis team a stable base from which to manage the longer disruption. |
| A.7 | Environmental management | Environmental management identifies the environmental conditions and obligations that can disrupt a core service, and it connects the external context in 5.3 to a practical response. |
| A.12 | Health and safety management | Health and safety management protects people from harm, and it provides the hazard, competence and consultation evidence that a resilience assessment needs for the people dimension. |
| A.14 | Information security management | Information security management protects the confidentiality, integrity and availability of the information a core service and a resilience claim depend on. |
| A.16 | Physical security management | Physical security management protects the people, premises and access a core service needs, and it connects the site controls to the wider security and emergency arrangements. |
People, information and resources
| Item | Discipline | The contribution in one line |
|---|---|---|
| A.8 | Facilities management | Facilities management keeps the premises, utilities and access a core service needs, and it supplies the physical single points of failure that the resource review in 5.7 must address. |
| A.9 | Financial control | Financial control supplies the liquidity, the spending authority and the cost visibility that let the organization act in a disruption, and it tests whether the resilience plan is affordable. |
| A.10 | Fraud control | Fraud control protects the organization's resources and integrity, and it is most tested when a disruption weakens the controls that normally prevent and detect fraud. |
| A.13 | Human resources management | Human resources management supplies the skills, capacity and support that the resource and leadership attributes depend on, including the ability to redeploy people and to keep them able to work. |
| A.15 | Information, communications and technology | Information, communications and technology provides the systems, networks and data that most core services run on, and it supplies the recovery and dependency evidence the resilience assessment needs. |
Governance and planning
| Item | Discipline | The contribution in one line |
|---|---|---|
| A.11 | Governance | Governance gives resilience its mandate, its accountability and its route to the board, which is the foundation described in 4.2 and the leadership attribute in 5.4. |
| A.17 | Quality management | Quality management supplies the process discipline, the measurement habit and the corrective action loop that the continual improvement attribute in 5.9 depends on. |
| A.18 | Risk management | Risk management supplies the method for identifying and treating uncertainty, and it connects the context, resource and change work to a decision about what to do. |
| A.19 | Supply chain management | Supply chain management identifies and reduces the external dependencies that can stop a core service, and it supplies the visibility that the resource review in 5.7 needs. |
| A.20 | Strategic planning | Strategic planning sets the objectives and the change agenda that give the resilience attributes their direction, and it is the forum where the context and change work in 5.3 and 5.10 becomes a decision. |
THE RULES THIS IS BUILT FROM
Read from the real rules, not invented
Every clause answer on this site points to the official clause behind it, so you can check any line yourself. The register holds 41 records, 174 evidence lines and 123 common failure lines. The revision dates come from the ISO record, one national member body record and one reseller record. The clause substance comes from ISO 22316:2017, the published edition in force.
21 CLAUSE RECORDS
20 DISCIPLINES
Annex A, clearly labelled
Annex A is informative and names twenty management disciplines. Each page says so, because a finding cannot rest on guidance alone.
Open the annexONE STAGE RECORD
No invented date
Stage 50.00 is recorded on 6 July 2026. The planning date is an estimate and is labelled wherever it appears.
Read the recordThe FDIS text is not public and is not reproduced. The clause record covers the 2017 edition. No clause-level change in the FDIS is claimed. Where the public record is silent, the page says so.