ISO 22316 Maturity · Organisational Resilience Management
Your organisation’s resilience, mapped against ISO 22316 and turned into a roadmap.
9 themes, a 5-level scale. And the action that moves each level to the next.
The framework’s 9 themes, already written from L1 to L5. One company, one business unit, or 300 at once.
ISO 22316 Maturity · Organisational Resilience Management
9 themes, 5-level scale.
Nordhavn Industries
53 / 100
They measure their maturity with Datamensio
An example
This could be your situation.
Take one company as an example: three sites, three spreadsheets, no shared answer.
Nobody can consolidate.
Nordhavn Industries, 2,400 people in Hamburg, Lyon and Porto. A client asks where the group stands. Each site answers in its own spreadsheet, with its own scales.
Three weeks, a single base.
One ISO 22316:2017 assessment launched across all three sites at once, from the managers’ interview notes. The framework was already written, its 9 themes and levels L1 to L5 too.
Two costs avoided before being committed.
A score of 53 out of 100, with the gap concentrated on three themes. The AI companion spotted that two actions duplicated those of another audit. The committee report took one sentence to request.
What it saved them
- 3sites measured on the same base, instead of three questionnaires to reconcile
- 2duplicate actions caught before the spend
- 1committee report, with no manual rework
These figures are an example. They could be yours.
The standard imposes processes. Datamensio says where you stand.
01
The framework is already written
Themes, questions and levels L1 to L5, all written. You do not start from an empty spreadsheet.
02
The score lands the same day
Online, by self-assessment link or in interview. Theme by theme, comparable over time.
03
The gap becomes a costed plan
Every step up carries its action. The AI prioritises on expected effect, not on the order of the standard.
04
Progress can be demonstrated
Campaign after campaign, against your target and against your own past. That is what your board asks for.
The maturity scale
One level, the next, and the action that links the two.
It is this mechanism, a level, a level above, and the action linking the two, that turns a finding into a trajectory.
Do the lessons learned from disruptions and exercises lead to actual changes in the organisation?
- N1
No formal debriefing. Lessons remain in the memory of those present.
- N2
Reports are produced after major events. Identified actions are not tracked and their implementation depends on individual initiative.
- N3
Every disruption and every exercise leads to a debrief with assigned actions, a deadline and an owner. Tracking is carried out in committee.
- N4
Actions from debriefs are integrated into the organisation’s action plan, their closure is verified and their effect is measured during the next exercise.
- N5
Lessons are consolidated across entities, feed into the revision of arrangements and strategy, and changes in context trigger a documented reassessment.
Action to move from L2 to L3
Adopt a single debrief template comprising action, owner and deadline, apply it from the next disruption or exercise onward, and add review of these actions to the permanent agenda of the quarterly risk committee.
« With Datamensio, we meet our objectives far more efficiently. The ERDF inspection services and our supervising ministry particularly appreciated an approach that gives them reliable data. »
Director, CCI 94CCI Île-de-France
« We believe this is the most suitable solution to scale our transformation project and measure impact according to our needs. »
Maja SucekChief Operating Officer, Interreg Danube
Rarely on its own
Frameworks combine. Put several together to cover your business, or have the AI write yours.
Take your first measurementon ISO 22316.
What this framework covers
ISO 22316 deals with security and resilience, specifically an organisation’s ability to absorb disruption, adapt to it and continue operating. Published in 2017, it sets out no requirements but describes principles and a series of attributes: a shared vision and purpose, an understanding of internal and external context, leadership capable of deciding under uncertainty, a culture that supports resilience, shared information, available resources, coordination across management disciplines, and continuous improvement fed by experience. It is a steering framework, not a checklist.
This nature makes it a difficult subject to hold together. Resilience shows up on no single existing dashboard: it is spread across business continuity, risk management, security, human resources, supply chain and communication, each with its own governance. The questions that keep coming up are concrete. Who arbitrates when two disciplines propose contradictory responses? Did the decisions made during the last disruption actually change anything in the organisation, or did they stay in the minutes? Are critical dependencies, suppliers, systems, scarce skills, known beyond the teams that operate them?
One confusion comes up often: ISO 22316 and ISO 22301 do not cover the same ground. ISO 22301 sets requirements for a business continuity management system and can be certified. ISO 22316 broadens the frame to the organisation’s overall capability, beyond identified disruption scenarios, and cannot be certified. An organisation may have a proven continuity plan and still be fragile on coordination, culture or adaptation. The reverse is rarer, but it exists.
The maturity assessment answers a different question from an audit. An audit concludes with a gap or a compliance finding. The assessment places each attribute on a progressive scale, five levels built using the CMMI method, and points to the action that moves it up a level. The gap between the score achieved and the target directly generates the action plan, which the AI groups into a prioritised roadmap. Business units compare against each other and against their own previous assessment.
In Datamensio, the framework is ready to use and remains yours. You adjust the themes, the questions and the wording of the levels. The AI refines these levels, adapts the vocabulary to your sector, or builds a variant from your own documents: continuity policy, crisis debriefs, dependency mapping.
Reference standard: ISO 22316:2017
The themes assessed
Shared vision and purpose
Articulation of objectives and values, awareness among teams, consistency between leadership messaging and operational priorities, translation into arbitration decisions.
Understanding of context
Monitoring of the external environment, identification of critical dependencies, knowledge of interested parties, analysis of developments likely to affect operations.
Leadership and decision making
Ability to decide with incomplete information, delegation in degraded situations, clarity of mandates, leadership example, support given to exposed teams.
Culture of resilience
Expected and valued behaviours, handling of weak signals, right to raise concerns, place of error in debriefs, awareness raising for new joiners.
Information and knowledge sharing
Flow of information between entities, documentation of critical knowledge, dependency on key people, accessibility of data in degraded situations.
Availability of resources
Human, technical, financial and informational resources that can be mobilised, redundancies, versatility of skills, contractual commitments with critical suppliers.
Coordination of management disciplines
Alignment between continuity, risk, security, safety, quality, human resources and communication, common governance, resolution of conflicting arbitrations.
Adaptation to change
Ability to change ways of working, adjustment of priorities during disruption, management of transitions and return to normal operations.
Evaluation and continuous improvement
Resilience indicators, exercises and simulations, use of debriefs, tracking of successive assessments over time.
A short version of the framework is available for the online self-assessment.
Frequently asked questions
Is ISO 22316 certifiable?
No. It provides principles and attributes, with no auditable requirements. Certification for resilience falls under ISO 22301 for business continuity. The ISO 22316 assessment measures the maturity of your capabilities and prepares the ground; it does not issue anything.
What is the difference with ISO 22301?
ISO 22301 organises the response to identified disruption scenarios, with a certifiable management system. ISO 22316 covers the organisation’s overall capacity to adapt, including to unanticipated situations. The two assessments complement each other and can be consolidated into a cross-cutting roadmap.
What is the difference between a maturity assessment and an audit?
An audit concludes with a compliance finding or a gap. The assessment places each practice on a five-level scale and points to the action that moves it up a level. The gap against the target produces the action plan, costed in effort, timeline and impact on the score.
How long does the assessment take?
The short version is completed in a single session. The full version, run collaboratively with several contributors, typically takes one to two weeks: most of the time goes into gathering input from continuity, risk, human resources and operations.
Can the framework be adapted to our organisation?
Yes. You can change the questions, the wording of the levels and the themes, or start from a blank base. The AI refines the levels using the CMMI method and builds a variant from your internal documents. The framework remains your property.
How do you compare several entities against each other?
Each business unit is assessed against the same framework. Scores per theme can be compared across entities and against previous assessments. A cross-cutting roadmap consolidates the action plans from several assessments without duplicating shared actions.
Do you need business continuity expertise to answer?
The questions address governance, coordination and learning practices, not the technical content of plans. A risk director or a secretary general can answer them. Collaborative mode allows specialist questions to be assigned to the right contributor.
Where is the data hosted?
In France, with OVH, backed up with Scaleway. No transfer outside the European Union. The AI models used can be selected, including from European providers.