>>
<<
ISO 22342:2023(en)
ISO - Cover page
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Security planning
5 Components of the security plan
 5.1 General
 5.2 Governance
  5.2.1 General
  5.2.2 Security objectives
  5.2.3 Scope of the security plan
  5.2.4 Leadership
  5.2.5 Legal and regulatory
  5.2.6 Roles, accountabilities and responsibilities
  5.2.7 Communication
  5.2.8 Documented information
  5.2.9 Reporting
  5.2.10 Evaluation
  5.2.11 Continuous improvement
 5.3 Management of risk
  5.3.1 General
  5.3.2 Security risk scope, context and criteria
  5.3.3 Assessment
  5.3.4 Treatment
  5.3.5 Acceptance level for residual security risk
  5.3.6 Communication and consultation
  5.3.7 Monitoring and review
  5.3.8 Documentation management and recording
 5.4 Security controls
  5.4.1 General
  5.4.2 Levels of protection
  5.4.3 Procedures for security controls
  5.4.4 Operational level controls and treatments
  5.4.5 Contingency planning for low likelihood and unforeseen situations
  5.4.6 Timelines for security activities
 5.5 Security controls process
  5.5.1 General
  5.5.2 Selection
  5.5.3 Implementation, testing and evaluation
  5.5.4 Monitoring activities
  5.5.5 Determining effectiveness
Bibliography
30mm
20mm
15mm
15mm
10mm
17mm

International

Standard

ISO 22342
Security and resilience — Protective security — Guidelines for the development of a security plan for an organization
Sécurité et résilience — Sûreté préventive — Lignes directrices pour l'élaboration d'un plan de sûreté destiné à un organisme
Reference number
ISO 22342:2023(en)
First edition
2023-04
30mm
20mm
15mm
15mm
10mm
17mm
30mm
20mm
15mm
15mm
10mm
17mm

ContentsPage

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of ISO document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
ISO draws attention to the possibility that the implementation of this document may involve the use of (a) patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a) patent(s) which may be required to implement this document. However, implementers are cautioned that this may not represent the latest information, which may be obtained from the patent database available at www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 292, Security and resilience.
Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at www.iso.org/members.html.

Introduction

All organizations seek to manage security risks in their environment to ensure appropriate protection levels of their assets, to preserve the interests of interested parties and to achieve their objectives.
Organizations sometimes need to establish and maintain a structured approach to security.
The purpose of a security plan is to ensure that all the appropriate actions and controls are in place to protect the organization from threats to its security.
This document gives guidance on the implementation of a security plan whose structure includes the guidance for protective security architecture. Thus, the security plan can be effectively integrated into an existing management system.
Integrating the organization’s risk management processes into the security plan model supports proper management of security. The security plan is designed to allocate accountability and responsibility, and to guide the application of controls to protect the organization from security risks.
A planned approach that is adaptive and agile makes it possible to provide solutions to unplanned situations. Security threats are dynamic and often unforeseen; therefore, this document introduces both technical and human-related elements for an adaptive and agile planned approach.
The intent of the document is to provide the fundamental elements necessary to improve and sustain the protection of an organization.
30mm
20mm
15mm
15mm
10mm
17mm

International StandardISO 22342:2023(en)
Security and resilience — Protective security — Guidelines for the development of a security plan for an organization

1Scope

This document gives guidance on developing and maintaining security plans. The security plan describes how an organization establishes effective security planning and how it can integrate security within organizational risk management practices.
This document is applicable to all organizations regardless of type, size and nature, whether in the private, public or not-for-profit sectors, that wish to develop effective security plans in a consistent manner.
This document is applicable to any organization intending to implement measures designed to protect their assets against malicious acts and mitigate their associated risks.
This document does not provide specific criteria for identifying the need to implement or enhance prevention and protection measures against malicious acts. It does not apply to services and operations delivered by private security companies.

2Normative references

The following documents are referred to in the text in such a way that some or all of their content constitutes requirements of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.
ISO 22300, Security and resilience — Vocabulary
ISO 31000, Risk management — Guidelines

3Terms and definitions

For the purposes of this document, the terms and definitions given in ISO 22300, ISO 31000 and the following apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
ISO Online browsing platform: available at https://www.iso.org/obp
IEC Electropedia: available at https://www.electropedia.org/
3.1
need-to-know
need to access specific information based on a business or operational requirement, involving an active process of determining the security level of information and who has the right to access the information
30mm
20mm
15mm
15mm
10mm
17mm

Bibliography
[1]
ISO 22316, Security and resilience — Organizational resilience — Principles and attributes
[2]
ISO 28000:2022, Security and resilience — Security management systems — Requirements
30mm
20mm
15mm
15mm
10mm
17mm
ICS 13.310; 03.100.01
Price based on 11 pages
iso.org