ISO/TS TECHNICAL SPECIFICATION 22375 First edition 2018-10 Security and resilience Guidelines for complexity assessment process Sécurite et resilience -Lignes directrices relatives au processus d'évaluation de la complexité Referencenumber IS0/TS22375:2018(E) so @IS02018 IS0/TS22375:2018(E) COPYRIGHTPROTECTEDDOCUMENT @ISO2018 All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either IsO at the address below orIso's memberbody in the countryof therequester. ISO copyright office CP 401 : Ch. de Blandonnet 8 CH-1214 Vernier, Geneva Phone:+41227490111 Fax:+4122749 09 47 Email: copyright@iso.org Website: www.iso.org Published in Switzerland ii @ IS0 2018 - All rights reserved IS0/TS22375:2018(E) Contents Page Foreword ..iv Introduction. ..V 1 Scope. 2 Normative references ..1 3 Terms and definitions .1 4 Principles .1 5 Preliminaryassessmentprocess. .2 5.1 General .2 5.2 Mandateandcommitment .2 5.3 Needsandexpectationsofinterestedparties .2 5.4 Embeddingcompetenceandawareness 2 6 Planning the assessment process. .3 6.1 General .3 6.2 Defining the scope. .3 6.3 Determiningtheobjectives. 3 6.4 Establishing the external context 4 6.5 Establishing theinternal context 4 6.6 Establishingresourcerequirements .4 6.6.1 General 4 6.6.2 Personnel .4 6.6.3 Procedure. .5 6.6.4 Method 5 6.6.5 Communication .5 6.6.6 Documentation. .5 7 Implementingtheassessmentprocess .6 7.1 General 7.2 Assessment process. .6 8 Monitoring and review .6 Annex A (informative) List of potential parameters that drive complexity .8 Annex B (informative) Examples of how to carry out the complexity assessment process ..12 Bibliography .28 @IS0 2018 -All rights reserved iii