Business Continuity Planning Frameworks: Which Standard to Use, and When

There is no single best business continuity planning framework. There is the one that fits your organization, your regulators, and your culture, and there are the others you borrow from.

Most programs I review either picked a framework by accident (whatever the last consultant or auditor used) or tried to follow three at once and ended up with a program that satisfies none of them. Both are fixable.

This guide covers the business continuity planning frameworks and standards that matter in 2026, where each one stands today, what happened to the ASIS business continuity standard, and how to choose the backbone for your program.

Framework, Standard, Guideline, Regulation: Know What You’re Holding

The words get used loosely. The differences matter when an auditor or examiner shows up.

• Requirements standards say what a program must have. You can be audited and certified against them. ISO 22301 is the main one.
• Guidance standards and guidelines explain how to do the work. Nobody certifies you to them. ISO 22313, ISO 22361, and the ASIS guideline are examples.
• Bodies of knowledge describe good practice for practitioners and underpin professional certifications. The BCI Good Practice Guidelines and the DRI Professional Practices fall here.
• Regulatory guidance is what an examiner will hold you to. The FFIEC Business Continuity Management booklet is the clearest example for US financial institutions.

All of the standards are voluntary unless a regulator, a contract, or a customer makes them mandatory. That happens more often than people expect.

The Business Continuity Planning Frameworks That Matter

ISO 22301 and its family

ISO 22301, Security and resilience: Business continuity management systems: Requirements, is the international standard most programs anchor to. The current edition is from 2019. A 2024 amendment added climate action changes. ISO’s technical committee has also started a revision: the 2019 edition is marked “to be revised,” and a new draft is in development. Nothing changes for your program until the new edition publishes, but if you are planning a certification, ask your auditor about timing.

ISO 22301 tells you what a program needs, not how to build it. As I said on Managing Uncertainty Episode 110, “The ISO 22301 standard is a blueprint. It’s a starting place, but it’s not a step-by-step instruction manual that’s been specifically tailored to your business.”

Three companion documents fill in the how:

• ISO 22313:2020 is the guidance on using ISO 22301. ISO has started its revision as well.
• ISO/TS 22317:2021 covers the Business Impact Analysis. ISO reviewed and confirmed it in 2025, so it remains current.
• ISO 22361:2022 covers crisis management. It is a guidelines document, not a certifiable standard. Our guide to implementing ISO 22361 explains how we use it to build crisis teams.

For IT disaster recovery, ISO/IEC 27031 (second edition, 2025) covers technology readiness for business continuity.

NFPA 1660 (formerly NFPA 1600)

NFPA 1600 no longer exists as a standalone standard. The National Fire Protection Association combined it with its standards on mass evacuation (NFPA 1616) and pre-incident planning (NFPA 1620) into NFPA 1660, Standard for Emergency, Continuity, and Crisis Management: Preparedness, Response, and Recovery. The 2024 edition is current.

NFPA 1660 has an emergency management bent. It fits organizations that work alongside public agencies, run their own emergency management function, or answer to a contract that names it. Our overview of the NFPA 1600 standard covers what changed in the merger and where the old chapters now live.

NIST SP 800-34

NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems, dates from 2010 and is still the current version. It was written for federal information systems, but its process (policy, BIA, preventive controls, recovery strategies, plan, testing, maintenance) works for any IT contingency program. It is a technology document. It won’t help you with crisis leadership or business process recovery.

BCI Good Practice Guidelines

The Business Continuity Institute’s Good Practice Guidelines are the practitioner’s handbook. Edition 7.0 launched in October 2023 and organizes the work into six Professional Practices. If ISO 22301 is the “what,” the GPG is a good “how.” Our guide to the BCI Good Practice Guidelines walks through each practice.

DRI Professional Practices

DRI International’s Professional Practices for Business Continuity Management cover ten areas, from program management and risk assessment through crisis communications and coordination with external agencies. The current version is the 2023 edition. Like the GPG, it is a body of knowledge and the basis for DRI’s certifications.

FFIEC Business Continuity Management booklet

If you run continuity at a US bank or credit union, this is the framework that matters most, because your examiners use it. The Federal Financial Institutions Examination Council released the Business Continuity Management booklet in November 2019, replacing the 2015 Business Continuity Planning booklet. The shift is in the title: from writing plans to managing continuity across the enterprise, framed as part of operational resilience.

What Happened to the ASIS Business Continuity Standard?

People still search for “the ASIS business continuity standard.” There have been several ASIS documents with that idea in their name, and most of them have been replaced.

• The 2005 ASIS Business Continuity Guideline, A Practical Approach for Emergency Preparedness, Crisis Management, and Disaster Recovery, was a plain-language guide to building a program.
• ASIS/BSI BCM.01-2010, developed with the British Standards Institution, was approved as an American National Standard for business continuity management systems in 2010.
• ANSI/ASIS SPC.1-2009 covered organizational resilience: security, preparedness, and continuity management systems.

In 2017, ASIS published Security and Resilience in Organizations and Their Supply Chains (ORM.1), which replaced both SPC.1 and BCM.1. In 2021, ASIS published the Business Continuity Management Guideline (ASIS BCM-2021), which replaces the 2005 guideline.

So if your policy or a customer contract cites “the ASIS business continuity standard,” find out which one it means. The 2010 standard and the 2005 guideline have both been superseded.

How the ASIS guideline compares with the two standards it is most often weighed against:

The ASIS guideline is less widely used than ISO 22301, but it is easy to work from. That has value when you are starting from nothing.

How to Choose a Business Continuity Planning Framework

Start with who will judge your program, then pick one backbone and borrow from the rest.

1. If you’re regulated, start with your regulator. A bank starts with the FFIEC booklet. A hospital starts with its accreditation and Centers for Medicare & Medicaid Services (CMS) requirements. Map the standard to the regulation, not the other way around.
2. If customers or auditors ask for a recognized standard, use ISO 22301. It is the one most global customers, auditors, and third-party risk questionnaires recognize.
3. If you work closely with public agencies, look at NFPA 1660. Its language matches emergency management.
4. Add the specialists where you need depth. ISO/TS 22317 for your BIA, ISO 22361 for crisis management, ISO/IEC 27031 or NIST SP 800-34 for IT recovery.
5. Use the GPG or DRI Professional Practices as your team’s method. They are written for practitioners, and they map well to ISO 22301.

Then stop arguing about it. Every standard draws the boundaries differently. One makes crisis management part of business continuity; another makes continuity part of emergency management. As I said on Episode 181, “The real answer is it doesn’t matter and we shouldn’t care.” Use the language that works inside your organization.

Don’t try to implement every clause of every standard either. Ground the program in your backbone, document where you’ve deliberately done something different, and be ready to explain why. That is what auditors want to see.

Old View / New View

Putting the Framework to Work

A framework doesn’t run a program. People do. We use the standards as the yardstick in a four-step process: Diagnose. Design. Deliver. Evolve.

• Diagnose where you stand against the framework you chose, with a maturity score, not a pass or fail. A business continuity maturity assessment tells you whether the program works and what to fix first. An audit only tells you whether the parts exist.
• Design a program sized to your strategy, risk appetite, and culture.
• Deliver the plans, the training, and the exercises.
• Evolve the program as the business, the threats, and the standards change, including the ISO 22301 revision now in progress.

Choose the framework that fits. Then spend your energy on the part no standard can do for you: making it work when something breaks.

Keep Going

A few ways to go deeper if this was useful.

• Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Business Continuity.
• Build or reset your program. Our Business Continuity services put governance, plans, and exercises in place around the framework that fits your business.
• Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
• Talk to us. Set up a call to think through your program with us.