NFPA 1600 - Standard on Continuity, Emergency, and Crisis Management

Establish leadership and commitment for continuity, emergency, and crisis management programs

• Program documentation covering Leadership and Commitment
• Risk and business impact analysis workpapers
• Exercise plans and after-action reports
• Program review and corrective action register

• BIA not refreshed for material business changes
• Exercise programme too narrow to test interdependencies
• Corrective actions tracked but not closed
• Resource needs assessment outdated

Assign a coordinator with responsibility for developing and maintaining the program

• Program documentation covering Program Coordinator
• Risk and business impact analysis workpapers
• Exercise plans and after-action reports
• Program review and corrective action register

• BIA not refreshed for material business changes
• Exercise programme too narrow to test interdependencies
• Corrective actions tracked but not closed
• Resource needs assessment outdated

Establish a program committee to provide input, recommendations, and program oversight

• Program documentation covering Program Committee
• Risk and business impact analysis workpapers
• Exercise plans and after-action reports
• Program review and corrective action register

• BIA not refreshed for material business changes
• Exercise programme too narrow to test interdependencies
• Corrective actions tracked but not closed
• Resource needs assessment outdated

Identify applicable laws, authorities, and secure financing for program administration

• Program documentation covering Laws, Authorities and Financing
• Risk and business impact analysis workpapers
• Exercise plans and after-action reports
• Program review and corrective action register

• BIA not refreshed for material business changes
• Exercise programme too narrow to test interdependencies
• Corrective actions tracked but not closed
• Resource needs assessment outdated

Maintain records of program activities, assessments, and performance evaluations

• Program documentation covering Records Management
• Risk and business impact analysis workpapers
• Exercise plans and after-action reports
• Program review and corrective action register

• BIA not refreshed for material business changes
• Exercise programme too narrow to test interdependencies
• Corrective actions tracked but not closed
• Resource needs assessment outdated

Conduct hazard identification, risk assessment, and consequence analysis for all hazards

• Program documentation covering Risk Assessment
• Risk and business impact analysis workpapers
• Exercise plans and after-action reports
• Program review and corrective action register

• BIA not refreshed for material business changes
• Exercise programme too narrow to test interdependencies
• Corrective actions tracked but not closed
• Resource needs assessment outdated

Perform business impact analysis to identify impacts of disruptions to business operations

• Program documentation covering Business Impact Analysis
• Risk and business impact analysis workpapers
• Exercise plans and after-action reports
• Program review and corrective action register

• BIA not refreshed for material business changes
• Exercise programme too narrow to test interdependencies
• Corrective actions tracked but not closed
• Resource needs assessment outdated

Identify and assess resource requirements for prevention, mitigation, response, continuity, and recovery

• Program documentation covering Resource Needs Assessment
• Risk and business impact analysis workpapers
• Exercise plans and after-action reports
• Program review and corrective action register

• BIA not refreshed for material business changes
• Exercise programme too narrow to test interdependencies
• Corrective actions tracked but not closed
• Resource needs assessment outdated

Develop and implement strategies for prevention and mitigation of identified hazards

• Program documentation covering Prevention and Mitigation
• Risk and business impact analysis workpapers
• Exercise plans and after-action reports
• Program review and corrective action register

• BIA not refreshed for material business changes
• Exercise programme too narrow to test interdependencies
• Corrective actions tracked but not closed
• Resource needs assessment outdated

Establish crisis management capabilities and crisis communications procedures

• Program documentation covering Crisis Management and Communications
• Risk and business impact analysis workpapers
• Exercise plans and after-action reports
• Program review and corrective action register

• BIA not refreshed for material business changes
• Exercise programme too narrow to test interdependencies
• Corrective actions tracked but not closed
• Resource needs assessment outdated

Develop emergency response plans and incident management procedures

• Program documentation covering Emergency Response Operations
• Risk and business impact analysis workpapers
• Exercise plans and after-action reports
• Program review and corrective action register

• BIA not refreshed for material business changes
• Exercise programme too narrow to test interdependencies
• Corrective actions tracked but not closed
• Resource needs assessment outdated

Implement business continuity plans and recovery strategies for critical functions

• Program documentation covering Continuity and Recovery
• Risk and business impact analysis workpapers
• Exercise plans and after-action reports
• Program review and corrective action register

• BIA not refreshed for material business changes
• Exercise programme too narrow to test interdependencies
• Corrective actions tracked but not closed
• Resource needs assessment outdated

Establish employee assistance and support programs for affected personnel

• Program documentation covering Employee Assistance and Support
• Risk and business impact analysis workpapers
• Exercise plans and after-action reports
• Program review and corrective action register

• BIA not refreshed for material business changes
• Exercise programme too narrow to test interdependencies
• Corrective actions tracked but not closed
• Resource needs assessment outdated

Develop and conduct exercises to evaluate the program and individual plans

• Program documentation covering Exercise Program
• Risk and business impact analysis workpapers
• Exercise plans and after-action reports
• Program review and corrective action register

• BIA not refreshed for material business changes
• Exercise programme too narrow to test interdependencies
• Corrective actions tracked but not closed
• Resource needs assessment outdated

Document exercise results, identify areas for improvement, and track corrective actions

• Program documentation covering After-Action Reporting
• Risk and business impact analysis workpapers
• Exercise plans and after-action reports
• Program review and corrective action register

• BIA not refreshed for material business changes
• Exercise programme too narrow to test interdependencies
• Corrective actions tracked but not closed
• Resource needs assessment outdated

Conduct periodic reviews and evaluations to assess program performance and capabilities

• Program documentation covering Program Review and Evaluation
• Risk and business impact analysis workpapers
• Exercise plans and after-action reports
• Program review and corrective action register

• BIA not refreshed for material business changes
• Exercise programme too narrow to test interdependencies
• Corrective actions tracked but not closed
• Resource needs assessment outdated

Implement corrective actions based on exercises, incidents, and program evaluations

• Program documentation covering Corrective Action
• Risk and business impact analysis workpapers
• Exercise plans and after-action reports
• Program review and corrective action register

• BIA not refreshed for material business changes
• Exercise programme too narrow to test interdependencies
• Corrective actions tracked but not closed
• Resource needs assessment outdated

Establish a crisis communications capability that addresses internal employees, external stakeholders, regulators, and the public.

• Crisis communications plan
• Stakeholder contact directory
• Pre approved holding statements
• Spokesperson training records

• No pre approved statements
• Single spokesperson dependency
• Channels not tested

Identify legal, regulatory, and contractual obligations relevant to continuity, emergency, and crisis management.

• Register of applicable laws
• Regulator correspondence
• Contractual obligations summary
• Annual legal review evidence

• Register out of date
• International obligations missed
• Contract clauses not mapped

Develop continuity plans for critical functions that include recovery strategies, alternate sites, and workforce continuity.

• Function level continuity plans
• Alternate site arrangements
• Workforce mobilisation plans
• Plan approval records

• Alternate sites not tested
• Workforce plans dependent on key persons
• Plans not aligned with BIA

Evaluate the program through periodic reviews, audits, and corrective action management with documented results.

• Internal audit schedule
• Audit reports
• Corrective action register
• Management review minutes

• No internal audit performed
• Corrective actions overdue
• Reviews lack management presence

Maintain records of plans, training, exercises, incidents, and program activities to demonstrate program operation.

• Records inventory
• Retention schedule
• Access control to program records
• Sample retrieval evidence

• No retention schedule
• Records held in personal drives
• No backup of program documentation

Conduct exercises that progress from discussion based to operations based and test plans, capabilities, and personnel.

• Annual exercise schedule
• Exercise design documents
• After action reports
• Improvement plan tracker

• Same scenario repeated
• Senior leaders absent
• Improvement actions not closed

Establish mutual aid agreements with other entities and confirm capabilities, terms, and activation procedures.

• Signed mutual aid agreements
• Partner capability summaries
• Activation procedure documents
• Annual review records

• Agreements lapsed
• Capabilities not validated
• Activation untested

Establish procedures for emergency procurement, expense tracking, and financial reporting during and after events.

• Emergency purchasing authority document
• Expense tracking template
• Sample event cost report
• Insurance claim procedure

• No emergency procurement authority pre approved
• Expenses not tracked to events
• Insurance limits unknown

Develop strategies to prevent or mitigate identified hazards and vulnerabilities to reduce likelihood or impact.

• Mitigation strategy document
• Project tracking for prevention initiatives
• Post implementation effectiveness reports

• Strategies not funded
• No effectiveness measures
• Strategies focused on insurance only

Establish the scope, mission, and objectives of the continuity, emergency, and crisis management program and obtain executive approval.

• Approved program charter
• Executive sponsorship memo
• Scope and exclusions document
• Annual program objectives

• Charter outdated or never refreshed
• Scope silent on third parties
• Objectives without measurable targets

Appoint a program coordinator and establish an advisory committee with representation from key functions.

• Coordinator appointment letter
• Committee terms of reference
• Meeting minutes
• Attendance records

• Committee dormant
• Functions missing representation
• No documented decisions

Develop a recovery plan that restores operations, infrastructure, and supply chain to normal or new normal state.

• Recovery plan document
• Function restoration sequence
• Funding sources identified
• Insurance documentation

• No prioritisation across functions
• Insurance gaps unknown
• No supplier recovery dependencies mapped

Identify resources needed to meet program objectives including personnel, equipment, facilities, technology, and supplies.

• Resource needs document
• Inventory of available resources
• Procurement requests for gaps
• Mutual aid agreements

• No reconciliation between needs and inventory
• Mutual aid agreements expired
• Surge resources unidentified

Develop and maintain an emergency operations and response plan that addresses life safety, incident stabilisation, and property and environment protection.

• Approved emergency response plan
• Position checklists
• Activation matrix
• Evacuation and shelter procedures

• Plan focused on one hazard only
• Activation criteria vague
• Position checklists missing for surge roles

Conduct a risk assessment that identifies hazards, vulnerabilities, and the likelihood and impact of potential events.

• Risk assessment report
• Methodology documentation
• Approval by program committee
• Risk register

• Hazards listed without analysis
• No quantification of impact
• Assessment older than program cycle

Conduct a business impact analysis to determine recovery objectives, critical functions, dependencies, and resources required.

• BIA report
• Critical function list with RTOs and RPOs
• Dependency mapping
• Sign off by function owners

• RTOs not validated by leadership
• Dependencies on third parties missing
• BIA not refreshed annually

Provide training to personnel with continuity, emergency, and crisis management responsibilities at a level appropriate to their roles.

• Training curriculum by role
• Completion records
• Competency assessment results
• Refresher schedule

• Generic training only
• No competency measure
• Roles untrained on plan updates

Address employee assistance, family support, and welfare during and after disruptive events.

• Employee assistance program documentation
• Family communication plan
• Critical incident stress procedures

• Family contacts not collected
• Post event mental health support absent
• Assistance program not promoted