Four markets

The regulatory and framework context, in market order

The standard is guidance. The obligations around it are not. For each market the frameworks were chosen by a scan of the held library, not from a fixed list. The order is the United States, the European Union, the United Kingdom and Australia. Where a market's regime is not held, the page names it and does not state its duties.

The scan used the buyer's activity and data: organizational resilience, business continuity, operational resilience, critical infrastructure, cyber risk and incident reporting. The chosen frameworks are the ones that genuinely apply to this buyer, not every framework that mentions resilience.

United States

The NIST framework is the primary federal reference. The contingency guide and NFPA 1600 supply the operational detail that the resilience guidance leaves to the disciplines.

Framework held	Status	Controls	Why it matters to this buyer
NIST Cybersecurity Framework 2.0	Voluntary framework	106	The federal framework for managing cyber risk. Its govern, identify, protect, detect, respond and recover functions overlap the resilience attributes and the evaluation work.
NIST SP 800-34 Rev. 1, Contingency Planning Guide	Federal guidance	8	The contingency planning guidance for federal information systems. It supplies the recovery and testing detail behind the resource and continuity work.
NFPA 1600, Continuity, Emergency and Crisis Management	Voluntary standard	142	A widely used continuity, emergency and crisis management standard. It gives a programme structure for the disciplines in clause 5.8.

European Union

NIS2 and DORA are the sector regimes that turn resilience expectations into enforceable duties for many buyers. The GDPR is the data law around the record.

Framework held	Status	Controls	Why it matters to this buyer
NIS2 Directive (EU) 2022/2555	Binding regulation	28	The cyber risk management and reporting directive for essential and important entities. It makes governance, business continuity and incident reporting duties explicit.
DORA, Regulation (EU) 2022/2554	Binding regulation	26	The digital operational resilience regime for financial entities. It covers ICT risk, incident management, testing and third-party dependency.
GDPR, Regulation (EU) 2016/679	Binding regulation	41	The data protection baseline. It governs the personal data and the records that a resilience programme may rely on.

United Kingdom

The operational resilience framework is the most direct UK duty for financial buyers. The NCSC framework supplies the outcome-based language that public and critical-infrastructure buyers use.

Framework held	Status	Controls	Why it matters to this buyer
UK GDPR	Binding regulation	44	The retained data protection regulation. It governs the personal data used in the resilience record and in incident reporting.
FCA/PRA Operational Resilience Framework	Binding regulation	22	The UK operational resilience regime for financial firms. It requires important business services, impact tolerances and tested recovery.
NCSC Cyber Assessment Framework	Government framework	41	The UK framework for the cyber resilience of critical services. It supplies outcome-based expectations that overlap the resilience evaluation.

Australia

CPS 230 is the most direct resilience duty for APRA-regulated buyers, and the SOCI Act covers critical infrastructure. The Privacy Act sets the data baseline.

Framework held	Status	Controls	Why it matters to this buyer
Security of Critical Infrastructure Act 2018 (SOCI)	Binding regulation	32	The critical infrastructure regime. It imposes risk management, incident reporting and, for some assets, resilience obligations.
APRA CPS 230 Operational Risk Management	Binding regulation	44	The prudential standard for operational risk. It requires critical operations, service providers and business continuity to be managed and tested.
Privacy Act 1988 (Cth)	Binding regulation	8	The federal privacy act. It governs the personal information the organization holds and must protect through a disruption.

How to read this page. The standard gives the resilience guidance. These frameworks give the legal and regulatory context. A clause answer on this site is not a statement of any of these laws, and a control count is the size of the held record, not a score. Read the framework page before relying on a duty.

THE RULES THIS IS BUILT FROM

Read from the real rules, not invented

Every clause answer on this site points to the official clause behind it, so you can check any line yourself. The register holds 41 records, 174 evidence lines and 123 common failure lines. The revision dates come from the ISO record, one national member body record and one reseller record. The clause substance comes from ISO 22316:2017, the published edition in force.

21 CLAUSE RECORDS

One page per clause

The guidance in our words, the evidence a reviewer asks for, the common gaps and what to do before the second edition lands.

Open the register

20 DISCIPLINES

Annex A, clearly labelled

Annex A is informative and names twenty management disciplines. Each page says so, because a finding cannot rest on guidance alone.

Open the annex

ONE STAGE RECORD

No invented date

Stage 50.00 is recorded on 6 July 2026. The planning date is an estimate and is labelled wherever it appears.

Read the record

The FDIS text is not public and is not reproduced. The clause record covers the 2017 edition. No clause-level change in the FDIS is claimed. Where the public record is silent, the page says so.