National foreword

This British Standard is the UK implementation of ISO 22372:2025.

The UK participation in its preparation was entrusted to Technical Committee CAR/1, Continuity and Resilience.

A list of organizations represented on this committee can be obtained on request to its committee manager.

Contractual and legal considerations

This publication has been prepared in good faith, however no representation, warranty, assurance or undertaking (express or implied) is or will be made, and no responsibility or liability is or will be accepted by BSI in relation to the adequacy, accuracy, completeness or reasonableness of this publication. All and any such responsibility and liability is expressly disclaimed to the full extent permitted by the law.

This publication is provided as is, and is to be used at the recipient’s own risk.

The recipient is advised to consider seeking professional guidance with respect to its use of this publication.

This publication is not intended to constitute a contract. Users are responsible for its correct application.

Compliance with a British Standard cannot confer immunity from legal obligations.

This British Standard was published under the authority of the Standards Policy and Strategy Committee on 30 November 2025.

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of ISO document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).

ISO draws attention to the possibility that the implementation of this document may involve the use of (a) patent(s). ISO takes no position concerning the evidence, validity or applicability of any claimed patent rights in respect thereof. As of the date of publication of this document, ISO had not received notice of (a) patent(s) which may be required to implement this document. However, implementers are cautioned that this may not represent the latest information, which may be obtained from the patent database available at www.iso.org/patents. ISO shall not be held responsible for identifying any or all such patent rights.

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.

This document was prepared by Technical Committee ISO/TC 292, Security and resilience.

Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at www.iso.org/members.html.

Introduction

Infrastructure in this document refers to interdependent systems that deliver essential services to communities, cities, regions and nations. Infrastructure is the backbone of every society. Individuals depend on the effective and efficient operation of infrastructure to support businesses and deliver public services. For that reason, the provision, reliability, performance, continuous operation, safety, maintenance, and protection of infrastructure are national and local priorities around the world. Infrastructure, or components of it, can be critical or become critical over time.

Infrastructure resilience needs cooperative action by organizations. Changes to society and technology create significant challenges for delivering resilient essential services to the end user. The increase in scale, complexity and interconnectedness of infrastructure amplifies and propagates disruptive incidents. This can have a severe human and economic impact.

Investment, innovation and novel approaches are needed to update and establish infrastructure resilience. However, most current approaches to infrastructure planning, financing, design, development, operations and decommissioning do not fully take into account either the interdependence of infrastructure and services, or the increasingly complex nature of risk and the cascading impacts that a disruptive incident can have across infrastructure.

There is a need to address disruption-related risk amplified by increasing complexity, age, and interdependency within and across infrastructure. As infrastructure becomes more reliable, end users may lose the memory of coping with interruptions and become more reliant on it. Therefore, infrastructure resilience is increasingly important to society. To address significant change in societies’ characteristics (e.g. demographic change) and in the context of infrastructure (e.g. climate and technical change), a systematic approach is required to ensure infrastructure resilience.

This document aims to inform stakeholders on potential strategic and operational issues and assist in the development of an effective approach to infrastructure resilience. To help avoid conflict between and within organizations, the approach should include resilience principles that are aligned at all levels. Using a collaborative approach as recommended in this document, stakeholders can better understand their roles and responsibilities and create direct value through their work that contributes to the overall infrastructure resilience and inter-dependent infrastructure.

Stakeholders can be in the private and public sectors including but not limited to professional associations, donors, infrastructure operators, regulators, policy makers, investors and owners, designers and suppliers, service providers and international organizations including trading blocs.

This document sets out core principles for infrastructure resilience. The principles are informed by the United Nations Office for Disaster Risk Reduction’s (UNDRR) Principles for Resilient Infrastructure^[1^] which were developed in consultation with United Nations member states and experts. It provides guidelines to inform policies, strategies, and regulatory frameworks that are based on evidence of risks and the vulnerabilities of infrastructure. It aims to help decision-makers and provide options to improve infrastructure resilience against clear goals while strengthening governance and assurance.

This document is not intended to provide guidelines on emergency management and response, which are also important considerations in building infrastructure resilience. These guidelines cover all infrastructure and are not limited to critical infrastructure as defined by legal requirements such as the European Commission’s Directive on the resilience of critical entities.^[2^]

NOTE For information on emergency management and response, refer to ISO 22320.

1 Scope

This document provides guidelines for establishing, maintaining, monitoring and improving infrastructure resilience to help ensure the continuity and robustness of essential services.

It supports collaborative decision-making across many stakeholders in diverse organizations. It can be used for engaging stakeholders at all levels responsible for, or having influence on, infrastructure resilience matters.

This document is intended to be applicable to all types and sizes of organizations which have a role in infrastructure resilience.

2 Normative references

3 Terms and definitions

4 Framework

4.1 General

4.2 Objectives and responsibilities

4.3 Identifying and assessing capabilities of infrastructure

4.4 Setting priorities

4.5 Establishing a strategy and plan

5 Principles

5.1 General

5.2 Principle 1: Clearly defined accountabilities and shared responsibilities

5.3 Principle 2: Proactively protected

5.4 Principle 3: Environmentally integrated

5.5 Principle 4: Socially engaged

5.6 Principle 5: Adaptively transforming

5.7 Principle 6: Continually learning and improving

6 Operational processes

6.1 General

6.2 Plan: developing and sharing understanding

6.3 Plan: investing in infrastructure resilience

6.4 Do: devising and designing ways to improve infrastructure resilience

6.5 Do: implementing ways to improve infrastructure resilience

6.6 Check: testing ways to improve resilience

6.7 Check: monitoring infrastructure resilience

6.8 Act: improving practices, norms and management approaches

6.9 Act: maintaining operational infrastructure and its natural environment

Bibliography

BS ISO 22372:2025

Security and resilience — Community resilience — Guidelines for infrastructure resilience

Current

Published:

30 Nov 2025