Information, communications and technology
Information, communications and technology provides the systems, networks and data that most core services run on, and it supplies the recovery and dependency evidence the resilience assessment needs.
This annex is informative. Annex A names the discipline and does not define it. A finding cannot rest on the annex alone. The guidance it supports is clause 5.8, and the evidence on this page is our interpretation of what that support looks like in practice.
What Annex A says
Annex A lists information, communications and technology as a supporting discipline; the standard does not define its scope. Within 5.8, the contribution is the design, operation and recovery of the technology estate: applications, networks, data, identity, cloud services and the communications that link them. The resilience question is which technology a core service depends on, how long it can be unavailable, and what the organization can do meanwhile. The discipline is broader than cyber security: a system can be secure and still have no tested recovery.
Why it matters
Technology resilience is often reduced to a disaster recovery plan and a backup. The harder questions are dependency and workaround. A core service may depend on an identity provider, a payment platform or a data feed that sits outside the recovery plan. The organization may be able to restore a server and still not be able to serve a customer. The clause 5.8 coordination asks technology to show its assumptions to the service owners and to test the workaround, not only the restore.
What good looks like
Map each core service to its applications, data, identity, network and providers. Record the recovery time and the workaround for each. Test a restore and a workaround separately. Include the third parties and the exit route. Review the map when a system, a platform or a contract changes. Share the critical dependencies with continuity and crisis leads.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask how long a core service can run without its main system and whether the workaround has been tested. A backup policy does not answer either question.
- Service to technology map Each core service and the applications, data, identity and network it needs
- Recovery objectives The recovery time and point for each critical system, agreed with the service owner
- Test record The last restore and workaround tests, the time taken and the issues
- Provider dependency The third parties and platforms beneath the estate, with the contract and exit route
Where it commonly fails
- Disaster recovery covers servers but not the service the customer sees.
- Third-party platforms and identity providers are outside the recovery plan.
- A restore is tested but a workaround is not.
What to do before the second edition
Pick the service that would hurt most and ask technology to run it for a day without its primary system. The workaround you improvise is the plan you need to write.
Read across
- 5.3 Understanding and influencing context
- 5.7 Availability of resources
- 5.8 Development and coordination of management disciplines
- 6.3.1 Methods and processes
← A.14 Information security managementA.16 Physical security management →