Editing Business continuity planning (section)

=={{anchor|published standards}} Standards==
===ISO Standards ===
There are many standards that are available to support business continuity planning and management.<ref name="Tierney">{{cite journal |last1=Tierney |first1=Kathleen |title=Disaster Governance: Social, Political, and Economic Dimensions |journal=Annual Review of Environment and Resources |date=21 November 2012 |volume=37 |issue=1 |pages=341–363 |doi=10.1146/annurev-environ-020911-095618 |s2cid=154422711 |language=en |issn=1543-5938|doi-access=free }}</ref><ref name="Partridge">{{cite book |last1=Partridge |first1=Kevin G.   |date= 2011 |last2=Young |first2=Lisa R. |title=CERT® Resilience Management Model (RMM) v1.1: Code of Practice Crosswalk Commercial Version 1.1 |url=https://apps.dtic.mil/sti/pdfs/ADA585451.pdf |publisher=Carnegie Mellon University |location=Pittsburgh, PA |access-date=5 January 2023}}</ref> 
The [[International Organization for Standardization]] (ISO) has for example developed a whole series of standards on Business continuity management systems <ref>{{Cite web|url=https://www.iso.org/committee/5259148/x/catalogue/p/1/u/0/w/0/d/0|title=ISO - ISO/TC 292 - Security and resilience |website=International Organization for Standardization}}</ref> under responsibility of technical committee [[ISO/TC 292]]: 

* [[ISO 22300]]:2021 Security and resilience – Vocabulary  (Replaces [[ISO 22300]]:2018 Security and resilience - Vocabulary and  [[ISO 22300]]:2012 Security and resilience - Vocabulary.)<ref>{{Cite web|url=https://www.iso.org/cms/render/live/en/sites/isoorg/contents/data/standard/06/84/68436.html|title=ISO 22300:2018|website=ISO|date=12 July 2019 }}</ref> 
* [[ISO 22301]]:2019 Security and resilience – Business continuity management systems – Requirements  (Replaces [[ISO 22301]]:2012.)<ref>{{Cite web|url=https://www.iso.org/cms/render/live/en/sites/isoorg/contents/data/standard/07/51/75106.html|title=ISO 22301:2019|website=ISO|date=5 June 2023 }}</ref>
* [[ISO 22313]]:2020 Security and resilience – Business continuity management systems – Guidance on the use of ISO 22301 (Replaces  [[ISO 22313]]:2012 Security and resilience - Business continuity management systems - Guidance on the use of ISO 22301.)<ref>{{Cite web|url=https://www.iso.org/cms/render/live/en/sites/isoorg/contents/data/standard/07/51/75107.html|title=ISO 22313:2020|website=ISO}}</ref>

* [[ISO/TS 22317]]:2021 Security and resilience – Business continuity management systems – Guidelines for business impact analysis - (Replaces ISO/TS 22315:2015 Societal security – Business continuity management systems – Guidelines for business impact analysis.)<ref>{{Cite web|url=https://www.iso.org/standard/79000.html|title=Iso/Ts 22317:2021}}</ref>
* [[ISO/TS 22318]]:2021 Security and resilience – Business continuity management systems – Guidelines for supply chain continuity (Replaces ISO/TS 22318:2015 Societal security — Business continuity management systems — Guidelines for supply chain continuity.)<ref>{{Cite web|url=https://www.iso.org/standard/79001.html|title=Iso/Ts 22318:2021}}</ref>
* [[ISO/TS 22330]]:2018 Security and resilience – Business continuity management systems – Guidelines for people aspects on business continuity (Current as of 2022.)<ref>{{Cite web|url=https://www.iso.org/cms/render/live/en/sites/isoorg/contents/data/standard/05/00/50067.html|title=ISO/TS 22330:2018|website=ISO|date=12 July 2019 }}</ref>
* [[ISO/TS 22331]]:2018 Security and resilience – Business continuity management systems – Guidelines for business continuity strategy - (Current as of 2022.)<ref>{{Cite web|url=https://www.iso.org/cms/render/live/en/sites/isoorg/contents/data/standard/05/00/50068.html|title=ISO/TS 22331:2018|website=ISO}}</ref> 
* [[ISO/TS 22332]]:2021 Security and resilience – Business continuity management systems – Guidelines for developing business continuity plans and procedures (Current as of 2022.)<ref>{{Cite web|url=https://www.iso.org/standard/50069.html|title=Iso/Ts 22332:2021}}</ref>
* [[ISO/IEC/TS 17021-6]]:2014 Conformity assessment – Requirements for bodies providing audit and certification of management systems – Part 6: Competence requirements for auditing and certification of business continuity management systems.<ref>{{Cite web|url=https://www.iso.org/cms/render/live/en/sites/isoorg/contents/data/standard/06/49/64956.html|title=ISO/IEC TS 17021-6:2014|website=ISO}}</ref>

* ISO/IEC 24762:2008 Information technology — Security techniques — Guidelines for information and communications technology disaster recovery services (withdrawn)<ref>{{cite web |title=ISO/IEC 24762:2008 |url=https://www.iso.org/standard/41532.html |website=ISO |date=6 March 2008 |access-date=5 January 2023 |language=en}}</ref>
* ISO/IEC 27001:2022 [[Information security]], cybersecurity and privacy protection — Information security management systems — Requirements. (Replaces ISO/IEC 27001:2013 Information technology — Security techniques — Information security management systems — Requirements.)<ref>{{cite web |title=ISO/IEC 27001:2022 |url=https://www.iso.org/standard/82875.html |website=ISO |access-date=5 January 2023 |language=en}}</ref>
* ISO/IEC 27002:2022 Information security, cybersecurity and privacy protection — Information security controls. (Replaces ISO/IEC 27002:2013 Information technology — Security techniques — Code of practice for information security controls.)<ref>{{cite web |title=ISO/IEC 27002:2022 |url=https://www.iso.org/standard/75652.html |website=ISO |access-date=5 January 2023 |language=en}}</ref>
* [[ISO/IEC 27031]]:2011 Information technology – Security techniques – Guidelines for information and communication technology readiness for business continuity.<ref>{{cite web |title=ISO/IEC 27031:2011 |url=https://www.iso.org/standard/44374.html |website=ISO |date=5 September 2016 |access-date=5 January 2023 |language=en}}</ref>
* ISO/PAS 22399:2007 Societal security - Guideline for incident preparedness and operational continuity management (withdrawn)<ref>{{cite web |title=ISO/PAS 22399:2007 |url=https://www.iso.org/standard/50295.html |website=ISO |date=18 June 2012 |access-date=5 January 2023 |language=en}}</ref>
* IWA 5:2006 Emergency Preparedness (withdrawn)<ref>{{cite web |title=IWA 5:2006 |url=https://www.iso.org/standard/44985.html |website=ISO |access-date=5 January 2023 |language=en}}</ref>

===British standards===
The [[British Standards Institution]] (BSI Group) released a series of standards which have since been withdrawn and replaced by the ISO standards above. 
* [[BS 7799]]-1:1995 -  peripherally addressed information security procedures. (withdrawn)<ref>{{cite web |title=BS 7799-1:1995 Information security management - Code of practice for information security management systems |url=https://knowledge.bsigroup.com/products/information-security-management-code-of-practice-for-information-security-management-systems/standard |website=BSI Group |access-date=5 January 2023}}</ref>
* [[BS 25999]]-1:2006 - Business continuity management Part 1: Code of practice (superseded, withdrawn)<ref>{{cite web |title=BS 25999-1:2006 Business continuity management - Code of practice |url=https://knowledge.bsigroup.com/products/bs-25999-1-2006-business-continuity-management-code-of-practice/standard |website=BSI Group |access-date=5 January 2023}}</ref>
* BS 25999-2:2007 Business Continuity Management Part 2: Specification (superseded, withdrawn)<ref>{{cite web |title=BS 25999-2:2007 (USA Edition) Business continuity management - Specification |url=https://knowledge.bsigroup.com/products/business-continuity-management-specification-1/standard |website=BSI Group |access-date=5 January 2023}}</ref>
* 2008: BS 25777, Information and communications technology continuity management. Code of practice. (withdrawn)<ref>{{cite web |title=BS 25777:2008 (Paperback) Information and communications technology continuity management. Code of practice |url=https://knowledge.bsigroup.com/products/information-and-communications-technology-continuity-management-code-of-practice-1/standard |website=BSI Group |access-date=5 January 2023}}</ref>

Within the UK, BS 25999-2:2007 and BS 25999-1:2006 were being used for business continuity management across all organizations, industries and sectors. These documents give a practical plan to deal with most eventualities—from extreme weather conditions to terrorism, IT system failure, and staff sickness.<ref>British Standards Institution (2006). Business continuity management-Part 1: Code of practice :London</ref>

In 2004, following crises in the preceding years, the UK government passed the [[Civil Contingencies Act 2004|Civil Contingencies Act of 2004]]: Businesses must have continuity planning measures to survive and continue to thrive whilst working towards keeping the incident as minimal as possible.
The Act was separated into two parts: 
Part 1: civil protection, covering roles & responsibilities for local responders
Part 2: emergency powers.<ref>Cabinet Office. (2004). overview of the Act. In: Civil Contingencies Secretariat Civil Contingencies Act 2004: a short. London: Civil Contingencies Secretariat</ref>
In the United Kingdom, resilience is implemented locally by the [[Local Resilience Forum]].<ref>{{cite web |title=July 2013 (V2) The role of Local Resilience Forums: A reference document |url=https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/62277/The_role_of_Local_Resilience_Forums-_A_reference_document_v2_July_2013.pdf |website=Cabinet Office |access-date=5 January 2023}}</ref>

===Australian standards===
* HB 292-2006, "A practitioners guide to business continuity management"<ref>{{cite web |title=HB HB 292—2006 Executive Guide to Business Continuity Management |url=https://www.saiglobal.com/PDFTemp/Previews/OSH/as/misc/handbook/HB292-2006.pdf |website=Standards Australia |access-date=5 January 2023}}</ref>
* HB 293-2006, "Executive guide to business continuity management"<ref>{{cite web |title=HB 293—2006 Executive Guide to Business Continuity Management |url=https://www.saiglobal.com/PDFTemp/Previews/OSH/as/misc/handbook/HB293-2006.pdf |website=Standards Australia |access-date=5 January 2023}}</ref>

===United States===
* [[NFPA 1600|NFPA 1600 Standard on Disaster/Emergency Management and Business Continuity Programs]] (2010). ''[[National Fire Protection Association]]''. (superseded).<ref>{{cite book |title=NFPA 1600, Standard on Disaster/Emergency Management and Business Continuity Programs |date=2010 |publisher=National Fire Protection Association |location=Quincy, MA |isbn=978-161665005-6 |edition=2010 |url=https://www.nfpa.org/assets/files/AboutTheCodes/1600/1600-10-PDF.pdf}}</ref>
* [[NFPA 1600, Standard on Continuity, Emergency, and Crisis Management]] (2019, current standard), ''[[National Fire Protection Association]]''.<ref>{{cite web |title=A Comprehensive Overview of the NFPA 1600 Standard |url=https://www.alertmedia.com/blog/nfpa-1600/ |website=AlertMedia |access-date=4 January 2023 |language=en |date=29 January 2019}}</ref> 
* [[United States federal government continuity of operations|Continuity of Operations]] (COOP) and National Continuity Policy Implementation Plan (NCPIP), United States Federal Government<ref name="overview"/><ref>{{cite web |title=NATIONAL CONTINUITY POLICY IMPLEMENTATION PLAN Homeland Security Council August 2007 |url=https://emilms.fema.gov/IS0545/documents/NCPIP_August_2007_508_Compliant.pdf |website=FEMA |access-date=5 January 2023}}</ref><ref>{{cite web |title=Continuity Resources and Technical Assistance {{!}} FEMA.gov |url=https://www.fema.gov/emergency-managers/national-preparedness/continuity |website=FEMA |access-date=5 January 2023 |language=en}}</ref>
* Business Continuity Planning Suite, DHS National Protection and Programs Directorate and FEMA.<ref>{{cite web |title=Continuity of operations: An overview |url=https://www.fema.gov/pdf/about/org/ncp/coop_brochure.pdf |website=FEMA |access-date=5 January 2023}}</ref><ref>{{cite web |title=Business {{!}} Ready.gov |url=https://www.ready.gov/business |website=www.ready.gov |access-date=5 January 2023}}</ref><ref>{{cite web |title=Business Continuity Planning Suite {{!}} Ready.gov |url=https://www.ready.gov/business-continuity-planning-suite |website=www.ready.gov |access-date=5 January 2023}}</ref><ref name="overview">{{cite web |title=Business Continuity Plan {{!}} Ready.gov |url=https://www.ready.gov/business-continuity-plan |website=www.ready.gov |access-date=5 January 2023}}</ref>
*  ASIS SPC.1-2009, Organizational Resilience: Security, Preparedness, and Continuity Management Systems - Requirements with Guidance for Use, [[American National Standards Institute]]<ref>{{cite book |title=ASIS SPC.1-2009 Organizational Resilience: Security, Preparedness, and Continuity Management Systems - Requirements with Guidance for Use |date=2009 |publisher=American National Standards Institute |isbn=978-1-887056-92-2 |url=https://www.ndsu.edu/fileadmin/emgt/ASIS_SPC.1-2009_Item_No._1842.pdf}}</ref>