The BCI Good Practice Guidelines (GPG) are the Business Continuity Institute’s handbook for how business continuity work actually gets done. The current version, Edition 7.0, launched on October 31, 2023. When people say “the 2023 Good Practice Guidelines,” that is the edition they mean.
I am a Member of the Business Continuity Institute (MBCI), and we use the GPG alongside ISO 22301 in client work. Here is what Edition 7.0 contains, what changed, and how to use it without turning your program into a paperwork exercise.
What Are the BCI Good Practice Guidelines?
The GPG is a practitioner’s guide to building and running a business continuity program. It draws on the experience of BCI members and the processes in international standards. ISO 22301 tells you what a business continuity management system must do. The GPG tells you how practitioners actually do it.
A few facts worth knowing (all from the BCI’s GPG page and its Edition 7.0 announcement):
- Edition 7.0 replaced the GPG 2018. It launched October 31, 2023, and has been available since November 1, 2023.
- Editions now carry numbers, not years. The BCI moved away from a major rewrite every five years toward an “evergreen document” it reviews on an ongoing basis.
- The “lifecycle” is now a “system.” The old Business Continuity Management Lifecycle has been replaced by the Business Continuity Management System (BCMS), the same term ISO 22301 uses.
- Access. BCI members download the full PDF free. Non-members buy it from the BCI Shop. A free GPG Lite edition covers the objectives of each Professional Practice and a glossary.
The Six Professional Practices in the BCI Good Practice Guidelines 2023
Edition 7.0 is built on six Professional Practices (PPs): two management practices and four technical practices. Several were renamed from the 2018 edition.
| Professional Practice (Edition 7.0) | 2018 name |
| PP1: Establishing a Business Continuity Management System | Policy and Programme Management |
| PP2: Embracing Business Continuity | Embedding Business Continuity |
| PP3: Analysis | Analysis |
| PP4: Solutions Design | Design |
| PP5: Enabling Solutions | Implementation |
| PP6: Validation | Validation |
PP1: Establishing a Business Continuity Management System
Scope, policy, governance, roles, and the cycle that keeps the program improving. This is where most struggling programs are actually broken. If nobody with authority owns the program, nothing in PP3 through PP6 will stick. Our guide covers business continuity governance in more detail.
PP2: Embracing Business Continuity
Awareness, training, and culture. The rename from “embedding” to “embracing” is telling: the goal is a business that wants the capability, not one that tolerates the paperwork. In my experience, that starts with tying continuity to what the business is trying to achieve, not to an audit finding.
PP3: Analysis
The Business Impact Analysis (BIA) and risk assessment. PP3 sets the continuity requirements: what matters most, how fast it has to come back, and what it depends on. Everything downstream inherits these answers, so a stale BIA quietly breaks the rest of the program.
PP4: Solutions Design
The biggest rewrite in Edition 7.0. The 2018 edition offered five generic solution types (diversification, replication, standby, post-incident acquisition, and doing nothing). Edition 7.0 dropped them. PP4 now asks you to design solutions that meet the urgency of recovery the organization defined in PP3, with example tables organized by resource type and recovery time objective, including what has to be in place before the disruption (BCI). That is a real improvement. A solution for your people looks nothing like a solution for a critical supplier.
PP5: Enabling Solutions
Turning the design into something that works: the alternate site, the backup supplier, the trained backup staff, and the strategic, tactical, and operational plans. Edition 7.0 adds an approach to scenario-specific planning, such as infectious disease or cyber incidents, and a section on returning to business as usual (BCI). It also acknowledges that some of the plans business continuity depends on are owned by other functions. That matches what we see. Your continuity program will rely on IT disaster recovery plans and crisis plans it does not write.
PP6: Validation
Exercising, maintenance, and review. This is where you find out whether PP3 through PP5 actually work. A plan that has never been exercised is a hypothesis. Our guide covers how to build an exercise program that gets harder as your team gets better.
How to Use the BCI Good Practice Guidelines in Your Program
The GPG is a good handbook. It is a poor checklist. Here is how I’d use it.
| Old View | New View |
| Implement every practice, line by line | Use the practices to find your biggest gaps |
| Pick a standard and defend it | Use the language that works inside your organization |
| More documentation means more maturity | Exercised capability means more maturity |
| Business continuity owns every plan | Business continuity connects plans other functions own |
Pair it with ISO 22301, don’t choose between them
ISO 22301 sets the requirements for a business continuity management system. The GPG explains good practice for meeting them. Use ISO 22301 to decide what your program must do, and the GPG to decide how. If your organization also answers to a regulator, such as the FFIEC for banks, that regulator’s expectations come first. Our guide covers which standards apply where.
Don’t argue taxonomy
Practitioners spend too much time on whether crisis management sits inside business continuity or the other way around. Different standards draw the lines differently. As I said on Managing Uncertainty, Episode 181, “The real answer is it doesn’t matter and we shouldn’t care.” What matters is what resonates inside your organization. If your executives respond to “operational resilience,” use that, and map the GPG to it quietly.
Use it to find gaps, then prioritize
Read each Professional Practice and ask one question: what would break first here? You will find more gaps than you can fix in a year. Rank them by business impact, fix the top three, and come back next year. A standards-based business continuity maturity assessment does this formally and gives you a score you can track.
Scale it to your size
The BCI says the BCMS applies to organizations of any size, sector, or geography. That doesn’t mean every organization needs every artifact. A team of one running continuity for a 2,000-person company should take the principles of each practice and skip the ceremony.
Build credentials on it
If you’re building a career in this field, the GPG is the foundation of the BCI’s training and certifications. Our post on choosing the right business continuity certification compares the BCI and DRI International paths.
The GPG will not build your program for you. It will tell you what good looks like. Closing the distance is your job.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Business Continuity.
- Build or reset your program. Our business continuity services follow four steps: Diagnose. Design. Deliver. Evolve.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your program with us.
