NFPA 1600

NFPA 1600 is a “Standard on Disaster/Emergency Management and Business Continuity Programs” is the National Preparedness Standard for all organizations, including governments and businesses. If you are in the business of providing emergency, disaster recovery, or business continuity planning or services, you better get to know “1600” soon.

Background

The NFPA 1600 “Standard on Disaster/Emergency Management and Business Continuity Programs” is designed to be a description of the basic criteria for a comprehensive program that addresses disaster recovery, emergency management, and business continuity.  Clearly a benchmark and potentially a requirement, NFPA 1600 should be an important influence on your program.  This article discusses the standard and the implications for emergency, continuity, and disaster recovery planners.  

Update: The American National Standards Institute (ANSI) recommended to the 9-11 Commission on April 30, 2004 that NFPA 1600, Standard on Disaster/Emergency Management and Business Continuity Programs, be recognized as the national preparedness standard. See related links.

In case you don’t know, The National Fire Protection Association (NFPA) is an international nonprofit codes and standards organization. Don’t let the words “national” and “fire” in the NFPA’s name confuse you. The NFPA is truly an international body with over 60,000 members from all over the world.  Less than a quarter of these members are affiliated with fire departments.  The majority of the members are representatives of the private and public sectors and come from a wide variety of fields.

NFPA standards are developed through a consensus standards development process approved by the American National Standards Institute.  The NFPA develops standards that are routinely adopted by state and local lawmakers for building, life safety, and electrical standards.  The NFPA’s mission is to “reduce the worldwide burden of fire and other hazards on the quality of life by providing and advocating scientifically based consensus codes and standards, research, training and education ^[i].”

NFPA 1600 is considered by many to be an excellent benchmark for continuity and emergency planners in both the public and private sectors.  The standard addresses methodologies for defining and identifying risks and vulnerabilities and provides planning guidelines which address:

• Stabilizing the restoration of the physical infrastructure
• Protecting the health and safety of personnel
• Crisis communications procedures
• Management structures for both short-term recovery and ongoing long-term continuity of operations

See the Bibliography for links to other information sources.

History

The NFPA Standards Council originally established a “Disaster Management” Committee in 1991 to develop preparedness, response and recovery guidelines for disasters.  After four years of effort, the committee issued NFPA 1600 in 1995 as “Recommended Practice for Disaster Management.”  Since there was a general sense that local jurisdictions were not yet ready to meet the standard’s requirements, it was issued as a “recommended practice.”  As such, NFPA 1600 was originally only a formal statement of what local jurisdictions should be doing in the disaster management area – it was not a standard per se.

The NFPA 1600 development process closely paralleled the development of the Federal Emergency Management Agency’s (FEMA) “Capabilities Assessment for Readiness” (CAR) document.  ERI International's "Blueprint for Community Emergency Management" was a source document for this original version of the standard.  ERI President, Rick LaValla was instrumental in both the development of the first NFPA 1600 standard and the "Operational Readiness and Capability Assessment” which later became known as CAR.

In preparation for issuing the 2000 edition of NFPA 1600, the committee took a much broader "total program approach" and incorporated elements of three related fields: disaster management, emergency management, and business continuity programs.  The committee expanded the standard to include activities both before and after a disaster, so that mitigation activities are included as part of the effort to protect life and property.  In addition, business continuity and disaster recovery practitioners were involved. 

Mr. LaValla stated that he was engaged by FEMA in 1996 to assist with the development of a national preparedness survey of state emergency management agencies that would result in a report to Congress.  Mr. LaValla says “ERI was selected because of a long history with developing emergency management program “blueprints,” and assessment methodologies.  ERI had also just completed writing the “New State Director's” training program and text for NEMA which contained a comprehensive local government emergency management program design and assessment questionnaire.” 

In 1996, the DRI International and the Business Continuity Institute were asked to participate in the standards-making process.  As a result, the standard includes elements of the Professional Practices that both DRII and BCI developed and is consistent with DRII’s Business Continuity Planning Model.

The Standard Applies to both the Public and Private Sector for Good Reasons

The NFPA 1600 Standards Committee, whose members are both practitioners and stakeholders in these fields, worked with the industries involved and developed a consensus standard that now serves as a benchmark for disaster management, emergency management, and business continuity programs in both the private and public sectors.  The standard provides program elements, techniques, and processes that now applies to all CEM programs.  However, it appears that the business continuity and disaster recovery professions are largely unaware of the implications that NFPA 1600 has for their activities.  While the original intentions of both the NFPA and the 1600 Standard may have been directed toward public safety officials, the current organization and it’s standard clearly impact the private sector.

The concept of public-private partnerships has become increasingly important in emergency management and the standard now addresses the need for business and nonprofit organizations, as well as governments, to be prepared to deal with emergencies.  Emergency managers and business managers both understand that the entire community, including residents and businesses, must be well-prepared if the entire jurisdiction is to be resilient to emergencies and disasters.  Initiatives such as Project Impact and other public-private partnerships as well as Local Emergency Planning Committees have brought together public and private responders together to plan for their communities as well as their organizations.

A Convergence of Efforts

Over the past ten years or so we have seen a convergence of public and private sector planning efforts.  Businesses have been expanding disaster recovery plans to include continuity of operations and emergency response planning while governments have been expanding old civil defense and continuity of government concepts to include mitigation and recovery along with emergency preparedness and response.  Today, governments are much more likely to be planning for continuity of operations issues.

Recognizing this convergence and the obvious interdependencies between business and the community, the NFPA involved the business community in the development of NFPA 1600, and consideration was given to their unique concerns.  It is interesting to note that the title, “Standard on Disaster / Emergency Management and Business Continuity Programs” was created in an effort to make all of the various participants comfortable with the final product.

NFPA 1600 has now been adopted as a standard by a significant part of our industry.  The Federal Emergency Management Agency, DRI International, the National Emergency Managers Association (NEMA), and the International Association of Emergency Managers (IAEM) have endorsed the most recent edition of NFPA 1600. FEMA’s Local Capability Assessment for Readiness (LCAR) program, which is used as a benchmark for state and local governments, is based on NFPA 1600.  NEMA adopted 1600 as the basis for their Emergency Management Accreditation Program (EMAP).  In addition, the American National Standards Institute (ANSI) has adopted NFPA 1600.

Will NFPA 1600 Become Mandatory?

Broad industry involvement and acceptance makes the NFPA 1600 Standard an industry standard under most definitions.  As a result, 1600 may be on a path to adoption as a mandatory requirement.  This path will follow milestones of voluntary compliance, use as a benchmark or third-party requirement, and adoption by reference.  While the NFPA standards are voluntary, they are often incorporated in regulations or laws with or without modification and, since they are generally accepted as industry standards, they may be used in lawsuits as the standard that you should be operating under.

However, NFPA 1600 is not the only game in town and there are some unsettled sentiments about the application of 1600 to business continuity planning.  The Business Continuity Institute has expressed concern that there is no commercial business continuity document and that in the NFPA standard, business continuity is buried within Emergency Management.  DRII’s current strategy is to seek incorporation of its methodology, as contained in the “Professional Practices for Business Continuity Planners” in standards promulgated by the International Standards Organization (ISO).  In addition, there is an ANSI group looking at continuity and disaster management and ISO 17799, an international security standard, sets forth business continuity planning standards.

As a result of these other standard setting initiatives, there may be multiple standards that impact the various CEM professions.

Bibliography

National Fire Protection Association.  The NFPA standards making process is an open one; see the proposal process.

For a complete overview, see the EM Forum discussion of 1600.  You should start with the introductory presentation.

For a good description of the standard’s contents see “NFPA 1600 – New Standard on Disaster Recovery, Emergency Management & Business Continuity Planning” NFPA 1600 Task Group on Education and Outreach.  

Related Websites
ANSI Recommendation to 9-11 Commission
NFPA 1600 Free Download
NFPA Press Release
ANSI Press Release
ANSI Homeland Security Standards Panel
NFPA 1600 Committee's Report on Comments 

End Notes