General
Performance measures should suit the sector, the criteria senior leaders set and the prevailing culture. Most organizations already hold data that can inform the assessment, and top management should set the objectives, criteria, thresholds and reporting arrangements.
What clause 6.2.1 says
The clause makes evaluation a management responsibility. It notes that the measures depend on the sector, the criteria chosen by top management and the culture, and that existing management information, internal audit reports, business reviews and project reporting can be sources. It then lists what top management should do: determine the resilience objectives, develop measurement criteria, monitor overall maturity and performance, decide what to evaluate and how, set the thresholds for acceptable output, decide how the evaluation fits existing monitoring, and establish how results are analysed and reported. The list is a governance checklist. It keeps the evaluation from becoming a data project run by analysts with no mandate.
Why it matters
The clause answers a practical question: where do the criteria come from? They come from the objectives top management sets, not from a vendor's maturity model. That does not make benchmarking useless. It makes benchmarking subordinate. The thresholds are the most consequential choice. A threshold that is set to whatever the organization currently achieves will never trigger action. A threshold set without regard to the objective will trigger the wrong action. The clause asks top management to make that choice explicitly and to own it.
What good looks like
Hold a session with top management to set the resilience objectives, the criteria and the thresholds. Record each threshold and the reason. Map the criteria to existing data sources, so the evaluation does not create a parallel reporting line. Decide how the output will be analysed and who will receive it. Review the thresholds when the objectives change. If top management will not set a threshold, record that the evaluation is advisory only.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask who set the thresholds and what happens when one is breached. If the answer is that the programme team chose them, the governance is weaker than the clause expects.
- Objectives and criteria The resilience objectives, the criteria and the owner for each
- Threshold decision Each threshold, the reason for it and the consequence of missing it
- Data source map The existing management information, audit and review data used, with the gaps
- Reporting arrangement How results are analysed, who receives them and what they are asked to decide
Where it commonly fails
- The criteria are copied from a vendor model and not connected to the objectives.
- Thresholds are set at current performance, so no result is ever unacceptable.
- The evaluation duplicates data that the organization already reports elsewhere.
What to do before the second edition
Ask top management to write down the one resilience outcome they would not trade away. Build the first criterion and threshold around it. A single owned threshold is worth more than a page of borrowed ones.