Normative references
The only normative reference is ISO 22300, the terminology standard. The 2017 edition does not make any other document mandatory, and it does not incorporate a management system standard by reference.
What clause 2 says
The clause fixes the vocabulary. ISO 22300 supplies the terms and definitions that the resilience standards share, so a reader moving between business continuity, risk, security and resilience meets the same words. The clause matters less for what it requires than for what it prevents: a programme that invents its own definitions cannot compare its evidence with a supplier, an auditor or another part of the group. The absence of other normative references is also informative. ISO 22316 does not require an ISO 22301 management system, an ISO 31000 risk process or an ISO 27001 control set, although each can contribute. The guidance stands on its own, and an organization may use it without adopting any of those schemes.
Why it matters
A shared vocabulary is a small control with a large effect. It lets a board paper, a supplier questionnaire and an audit finding use the same word for the same thing. It also stops a programme from importing a definition that carries a hidden obligation, such as treating a risk appetite as a resilience threshold. The clause does not ask for a glossary project. It asks the organization to use the standard's terms and to be deliberate where it departs from them.
What good looks like
Keep one terminology sheet for the programme, anchored to ISO 22300 and extended only where the organization needs a local term. Mark local terms as local. When a supplier or an assessor uses a different word for the same idea, record the equivalence rather than arguing about vocabulary. Review the sheet when a related standard is revised. The sheet is small, but it is the cheapest way to keep a group-wide programme coherent.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will check whether the programme uses the standard's terms consistently, particularly organizational resilience, interested party and organizational culture. A document that uses resilience as a synonym for business continuity will be read as unclear about the outcome it is trying to achieve.
- Terminology sheet The defined terms in use, each tied to ISO 22300 and any local extension marked as local
- Reference list The editions of related standards the programme actually uses, with the date each was checked
- Equivalence note Where a supplier or regulator uses a different term, the equivalence and the agreed meaning
Where it commonly fails
- Resilience, business continuity and risk are used interchangeably.
- The terminology sheet is out of date against the current edition of ISO 22300.
- Local terms are presented as if they were the standard's terms.
What to do before the second edition
Ask each discipline lead to return the terms they use for the same five ideas. Reconcile the returns into one sheet and have the programme lead approve it. Put the sheet where the assessment templates can reach it.