Dejan Kosutic If you are a business continuity practitioner in the U.S., you’re probably wondering which standard to apply – NFPA 1600 or ISO 22301. After all, they are both business continuity standards, and they both have very significant backgrounds – U.S. government agencies seem to love NFPA 1600, and ISO 22301 is an international standard accepted worldwide.
Quick overview
NFPA 1600 is officially titled as “Standard on Disaster/Emergency Management and Business Continuity Programs” and was initially published by the National Fire Protection Association in 1995. It was revised a couple of times since then, and has reached a scope that is much wider than its publisher’s name would suggest – it was endorsed by the 9/11 Commission, it was adopted by the U.S. Department of Homeland Security as a best practice, and it received designation and certification as anti-terrorism technology under the SAFETY Act.
On the other hand, ISO 22301 (officially called “Societal security — Business continuity management systems — Requirements) began its “career” as the British BS 25999 standard in 2006/2007, and in 2012 it became an internationally accepted standard published by the International Organization for Standardization. This means that, unlike NFPA 1600, which is primarily a local U.S. standard, ISO 22301 is recognized in most countries as the main business continuity standard or framework.
The funny thing is, NFPA 1600 is much longer (66 pages), but it’s free, whereas ISO 22301 is shorter (32 pages) and it is rather expensive, as are all the other ISO standards.
What does NFPA 1600 have that ISO 22301 doesn’t?
Here are a few examples of a couple of requirements that do not exist in ISO 22301, or where NFPA 1600 is much more detailed:
- 4.3 Program committee – there is no such requirement in ISO 22301.
- 4.6 Finance and Administration – the requirements in ISO 22301 are not so specific.
- 5.2 Risk assessment – the requirements are much more precise than in ISO 22301 – e.g. they define hazards (threats), vulnerabilities and impacts in greater detail.
- 5.4.2 Resource needs assessment – the specification is more detailed than in ISO 22301.
- The requirements in 6.4 Crisis communication and Public Information, and 6.5 Warning, Notifications, and Communications are basically the same as in ISO 22301, but here they are more logically structured.
- 6.7.1.1 Emergency Operations Centers (EOCs) – that does not exist in ISO 22301.
- 6.7.7 and 6.7.8 Resource management in Incident management are much more detailed than in ISO 22301.
- 6.10 Employee Assistance and Support – here it is much more detailed than in ISO 22301.
- 8.3 Design of Exercises and Tests – again, much more detailed than in ISO 22301.
- Annex A – although it is not mandatory for implementation, it provides a large amount of useful guidelines (much like ISO 22313 does for ISO 22301). For example:
- recovery strategies
- methods for exercising and testing
- catalogues of hazards
- questions to include in the business impact analysis
All in all, NFPA 1600 is much more detailed and it is probably easier to implement business continuity without using some additional literature; since many requirements are more comprehensive than in ISO 22301, it is probably better suited for mid-sized and larger organizations.
What does ISO 22301 have that NFPA 1600 doesn’t?
Here’s where ISO 22301 places more emphasis:
- 4.2.1 Interested parties and their requirements – the requirements are more precise than in NFPA 1600.
- 4.3.2 Scope – the requirements are much more precise in ISO 22301.
- 7.5 Documented information – again, much more precise requirements than in NFPA 1600.
- 8.2.2 Business impact analysis – NFPA 1600 does not recognize the Maximum Acceptable Outage (MAO) as a step before the Recovery Time Objective (RTO).
- 8.3 Business continuity strategy – although NFPA does require strategy to be developed, this is not specified in a separate chapter or section; neither is it a separate step in a process. In ISO 22301 the strategy has much greater significance.
- 9.1 Monitoring, measurement, analysis and evaluation – ISO 22301 is much more demanding here.
- 9.2 Internal audit – basically, NFPA 1600 has no such requirement (at least, not in the main part of the standard, though there are some guidelines in Annex A).
- 9.3 Management review – there are no detailed requirements in NFPA 1600, and no requirements for top-level management involvement.
- 10.1 Corrective actions – NFPA doesn’t have such detailed requirements.
It seems to me that ISO 22301 is more flexible, and therefore more easily implemented in organizations of all sizes; it places much more emphasis on management issues, so it is probably easier to communicate to top management.
Which one to implement?
Perhaps this is the wrong question. What I didn’t say before is that these standards are similar in at least 90% of the requirements; and they complement each other very well – what NFPA 1600 has and ISO 22301 doesn’t fits perfectly into ISO 22301 – and vice versa.
Therefore, why not implement both? If you are a U.S. company, your client or regulator is likely to ask you for NFPA 1600; but if you are operating in an international market as well, sooner or later ISO 22301 will become a necessity.
I admit I’m biased here, but I would suggest starting the implementation with ISO 22301 and adding a couple of things from NFPA 1600 that are missing in ISO. You’ll get two for one with almost no extra effort.
This article is an excerpt from the book Becoming Resilient: The Definitive Guide to ISO 22301 Implementation. Click here to see what’s included in the book…
Click here to download the free Checklist of ISO 22301 Mandatory Documentation.
