NFPA 1600 no longer exists as a standalone standard. The National Fire Protection Association (NFPA) folded it into NFPA 1660, and the 2024 edition of NFPA 1660 is now the current version of everything NFPA 1600 used to cover. If your policy, your audit criteria, or your vendor requirements still cite “NFPA 1600,” the requirements haven’t gone anywhere. The reference has.
This overview covers what changed, what the former NFPA 1600 chapters require, and how to use the standard in a business continuity or emergency management program today.
What Happened to NFPA 1600?
NFPA 1600 is now part of NFPA 1660, Standard for Emergency, Continuity, and Crisis Management: Preparedness, Response, and Recovery. NFPA released the first edition, dated 2024, in 2023.
NFPA 1660 combines and replaces three standards:
- NFPA 1600, Standard on Continuity, Emergency, and Crisis Management (last standalone edition: 2019)
- NFPA 1616, Standard on Mass Evacuation, Sheltering, and Re-entry Programs
- NFPA 1620, Standard for Pre-Incident Planning
The merger is part of a larger NFPA project. In 2019, the NFPA Standards Council approved a plan to consolidate 114 emergency response and responder safety documents into about 40. NFPA 1660 is one result.
What that means in practice, according to NFPA:
- NFPA will not publish new standalone editions of NFPA 1600, 1616, or 1620. Older editions are still for sale, but NFPA 1660 is the current edition.
- Chapter 3 now holds one set of definitions for all three former standards, with the terminology aligned.
- The chapters from each former standard were carried over in their original order. Section 1.3 has an application statement that tells you which chapters correspond to which former standard, and each chapter title carries the former standard’s number in parentheses.
- If an authority having jurisdiction wants to reference the latest version of NFPA 1600, it should reference NFPA 1660 or the specific NFPA 1660 chapters identified in Section 1.3.
| Former standard | Where it lives in NFPA 1660 (2024) |
| Definitions from all three | Chapter 3, one aligned set |
| NFPA 1600: emergency management, business continuity, and crisis management programs | The early chapters (Section 1.3 lists them) |
| NFPA 1616: mass evacuation, sheltering, and re-entry | Chapters 11 through 16 |
| NFPA 1620: pre-incident planning | The chapters that follow |
The standard is still moving. NFPA’s technical committees are working on the next edition, and joint task groups are reviewing the whole document to consolidate repetitive requirements, including administration, training, communications, and program maintenance. Expect the structure to tighten again.
Why NFPA 1600 Mattered
NFPA 1600 started in 1995 as a recommended practice for disaster management. It became much more than that after September 11.
The 9/11 Commission endorsed what the American National Standards Institute called “a voluntary National Preparedness Standard,” and NFPA 1600 became that standard. The Commission wrote, “We believe that compliance with the standard should define the standard of care owed by a company to its employees and the public.” In 2010, the Department of Homeland Security named NFPA 1600 as one of three standards in its voluntary Private Sector Preparedness (PS-Prep) certification program.
That history is why NFPA 1600 still shows up in contracts, audit questionnaires, and policies written a decade ago. NFPA 1660 inherits the reputation. Like NFPA 1600, it is voluntary unless a regulator, contract, or authority having jurisdiction makes it mandatory.
What the Former NFPA 1600 Chapters Require
The program chapters are short. They tell you what a program must have, not how to build it. Here is what each covers, in plain language.
Program Management
Leadership commitment comes first. The standard expects your leadership to support the program through development, implementation, and maintenance, to fund it, and to fix deficiencies when reviews find them. It calls for a program coordinator appointed by leadership and a program committee, plus a documented policy, scope, and objectives, compliance with applicable laws and regulations, finance and administration procedures, and records management.
This is the chapter most programs underestimate. A coordinator without a committee and an engaged sponsor is a program on paper.
Planning
Planning covers the risk assessment, the Business Impact Analysis (BIA), resource needs, and the involvement of stakeholders inside and outside the organization. The risk assessment is all-hazards: natural, human-caused, and technological.
Implementation
Implementation turns the planning into strategies and plans: prevention and mitigation, crisis communications and public information, emergency operations and response, business continuity and recovery, and the operational procedures that support them.
Execution
The 2019 edition of NFPA 1600 added a chapter on executing the plans when something happens: recognizing and reporting an incident, notification, activation, incident management, documentation, and managing resources. The 2019 edition also strengthened the expectation of a crisis management capability. If your program was built against the 2016 edition, check this chapter first.
Training and Education
Competency-based training for everyone with a role in the program, and awareness for everyone else. The standard also addresses public education, which matters most for public-sector entities.
Exercises and Tests
Exercises evaluate your plans, procedures, training, and capabilities, identify deficiencies, and drive corrective action. The standard ties frequency to what it takes to establish and maintain the capability, not to a calendar quota.
Program Maintenance and Improvement
Evaluate the program on a regular schedule and when something changes: a new regulation, a new hazard, a reorganization, or lessons from an incident or exercise. Track corrective actions to closure.
If those seven areas look like a Plan, Do, Check, Act cycle, they are. Program management and planning are Plan. Implementation and execution are Do. Training and exercises are Check. Maintenance and improvement are Act.
The Annexes
The annexes are explanatory. They are not part of the requirements, but they are where most practitioners get the value.
The most useful is the self-assessment. NFPA’s self-assessment tables restate the requirements and let you mark each one as conforming, partially conforming, or nonconforming, with columns for evidence, corrective action, owner, and schedule. That is a ready-made gap analysis.
Earlier editions of NFPA 1600 also carried annexes on small business preparedness, family preparedness, maturity models, and crosswalks to other standards such as the DRI International Professional Practices. Check the NFPA 1660 edition you buy for which of these carried forward and where.
NFPA 1660 or ISO 22301?
People ask me which standard is “right.” My answer hasn’t changed.
NFPA 1660, like NFPA 1600 before it, has an emergency management and crisis management bent and talks about continuity of operations. ISO 22301 is a management system standard built around business continuity. Read one and crisis management is a component of business continuity. Read the other and continuity looks like a component of emergency management. As I said on Managing Uncertainty, Episode 181, “The real answer is it doesn’t matter and we shouldn’t care.”
Use the language that resonates inside your organization. Use NFPA 1660 if you work alongside public agencies, run an emergency management function, or answer to a contract or authority that names it. Use ISO 22301 if you want a management system your auditors and global operations already recognize. Plenty of programs use both. Our guide to business continuity standards compares the options.
How to Use NFPA 1660 in Your Program Now
- Update your references. Change “NFPA 1600” in your policy, audit criteria, and vendor requirements to NFPA 1660, citing the chapters Section 1.3 maps to the former standard.
- Run the self-assessment against the former NFPA 1600 chapters. Treat partial conformity as a finding, not a pass.
- Start with Execution and Program Management. If your program dates from the 2016 edition, the execution chapter is the likeliest gap. Leadership commitment is the likeliest weakness.
- Prove it in an exercise. Conformity on paper means little until your team activates the plan under pressure.
- Score maturity, not just conformity. A conformity checklist tells you what exists. A business continuity maturity assessment tells you whether it works and what to fix first.
The number on the cover changed. The work didn’t.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Business Continuity.
- Build or reset your program. Our Business Continuity services put governance, plans, and exercises in place around your business.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your program with us.
