Cyber security management
Cyber security management protects the systems and information a core service needs, and it supplies the incident and dependency evidence that the resilience assessment in clause 6 uses.
This annex is informative. Annex A names the discipline and does not define it. A finding cannot rest on the annex alone. The guidance it supports is clause 5.8, and the evidence on this page is our interpretation of what that support looks like in practice.
What Annex A says
Annex A names cyber security management as a supporting discipline; it does not set controls or require a certification scheme. Within clause 5.8, its contribution is to identify the systems and information whose compromise would stop or degrade a core service, to reduce the likelihood and impact of that compromise, and to provide a response that is coordinated with continuity and crisis management. The discipline is not the same as resilience: a strong security control set can still leave a service dependent on one identity provider or one network path.
Why it matters
Security work is often measured by control coverage, while resilience is measured by the ability to keep a service running. The two can diverge. An organization can pass a security audit and still have no tested route to operate a core service without its primary system. The clause 5.8 coordination asks the security team to show its assumptions to the continuity and operations teams, and to hear theirs. The most useful resilience evidence is a short list of critical systems, the service dependency, the recovery path and the last test.
What good looks like
Map the critical systems to the core services. For each, record the dependency, the recovery or workaround, the time to restore and the owner. Test one workaround a year, not only the restore. Include the identity, network and cloud providers that sit beneath the systems. Share the dependency list with continuity and crisis leads. Review it when a system or supplier changes.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask which systems are critical to a core service and whether the workaround has been tested. Control coverage alone does not answer either question.
- Critical system map Systems, the core service they support and the recovery or workaround path
- Dependency record The providers and platforms beneath the critical systems, with the contract and exit route
- Test record The last restore or workaround test, the time taken and the issues found
- Incident lessons Security incidents that changed a service, a control or a dependency
Where it commonly fails
- Security is measured only by control coverage and never by service dependency.
- Critical systems are not mapped to core services, so priority is set by asset value.
- Cloud and identity providers are treated as invisible infrastructure.
What to do before the second edition
Ask the CISO and the continuity lead to produce the same critical system list independently. The disagreement is the coordination work under 5.8.
Read across
- 5.3 Understanding and influencing context
- 5.7 Availability of resources
- 5.8 Development and coordination of management disciplines
- 6.3.1 Methods and processes