NFPA 1600
“Standard on Continuity, Emergency, and Crisis Management”
NFPA 1600 “Standard on Continuity, Emergency, and Crisis Management” is published by the National Fire Protection Association (NFPA). NFPA is an American National Standards Institute Accredited Standards Developer (SDO). It was founded in 1896 and is an independent, non-profit, organization whose mission is to reduce the worldwide burden of fire and other hazards on the quality of life by providing and advocating consensus codes and standards, research, training, and education. NFPA has over 80,000 members in more than 100 nations.
Preparedness, LLC's
Role in NFPA 1600
Donald L. Schmidt, CEO of Preparedness, LLC is the Past Chair of the NFPA 1600 committee. He joined the committee in 1994; has been involved in every edition of NFPA 1600; and served as chair for the 2010, 2013, and 2016 editions. Mr. Schmidt is the editor of “Implementing NFPA 1600 National Preparedness Standard” published by NFPA.
History of NFPA 1600
Program Self-Assessment Checklist
This 200+ question checklist is based on NFPA 1600 “Standard on Continuity, Emergency, and Crisis Management” published by the National Fire Protection Association and available online for free download at www.nfpa.org/1600.
Preparedness Bulletin:
Auditing the Preparedness Program
Our Preparedness Bulletin provides guidance on auditing your preparedness program.
1991 Disaster Management Committee Established
The Technical Committee on Emergency Management and Business Continuity was established by the NFPA Standards Council in January 1991. The committee was assigned responsibility for developing documents relating to preparedness for, response to, and recovery from disasters resulting from natural, human-caused, and technological events.
The technical committee includes a maximum of 30 voting, principal members, alternates (nonvoting if the principal member votes), and nonvoting members from the United States, Canada, and abroad. In accordance with the American National Standards Institute’s rules for accredited standards developers, no more than one-third of the members can represent the same interest group. This concept of "balance" is designed to prevent one group from dictating the content of the standard.
Members come from the private sector and public sector (federal, state, and local government). Private sector industry representatives include financial services, insurance, energy, health care, technology, manufacturing, higher education, utilities, and consulting. Current and past members represent or have represented DRI International, U.S. Department of Homeland Security (DHS), National Emergency Management Association (NEMA), NEMA’s Emergency Management Accreditation Program (EMAP), and the International Association of Emergency Managers (IAEM).
1995 Recommended Practice for Disaster Management
NFPA 1600 was first published in 1995 and titled “Recommended Practice for Disaster Management.” A “recommended practice” is written with the word “should” as the operative word in elements of the standard. At the time, the committee felt that a new standard should be first introduced as a recommended practice.
Recommended practices are not written for adoption by government or incorporation into regulations. NFPA’s codes and standards use the mandatory word “shall” to prescribe mandatory requirements.
2000 Standard
The second edition of NFPA was adopted in 2000 in the form of a “standard.” Nonmandatory language in the document (use of the word “should”) was changed to mandatory language (“shall”) throughout.
This edition also incorporated a “total program approach” for disaster/emergency management and business continuity with common program elements, techniques, and processes.
2004 9/11 Commission Recommendation
In January 2004 following the terrorist attacks of September 11, the 9/11 Commission investigated the preparedness of private sector organizations. The American National Standards Institute was asked to find consensus on a “National Standard for Preparedness” for the private sector. A series of workshops was held in 2004 under the auspices of ANSI’s Homeland Security Standards Panel, and the panel recommended that the Commission endorse a voluntary National Preparedness Standard. The recommended standard was NFPA 1600®. The 9/11 Commission’s recommendation to adopt NFPA 1600 can be found in Chapter 12 of the 9/11 Commission Report.
“We endorse the American National Standards Institute’s recommended standard for private preparedness. We were encouraged by Secretary Tom Ridge's praise of the standard, and urge the Department of Homeland Security to promote its adoption. We also encourage the insurance and credit-rating industries to look closely at a company's compliance with the ANSI standard in assessing its insurability and creditworthiness. We believe that compliance with the standard should define the standard of care owed by a company to its employees and the public for legal purposes. Private-sector preparedness is not a luxury; it is a cost of doing business in the post-9/11 world. It is ignored at a tremendous potential cost in lives, money, and national security.”2004 Edition
The 2004 edition was published in April 2004. The standard continued to evolve, and it was reformatted to comply with NFPA's Manual of Style.
2004 Public Law 108-458
This recommendation has since been restated in two federals laws--Public 108-458 and most recently within Title IX of Public Law 110-53, which calls for voluntary certification of private sector preparedness programs. [click here for details on PL 110-53 and the voluntary program.]
2007 Edition
A significant change to the 2007 edition was the expansion from the historical “four phases of emergency management” to include prevention bringing the standard into alignment with the related disciplines and practices of risk management, security, and loss prevention.
For the first time, the logos of the U.S. Department of Homeland Security (DHS), the International Association of Emergency Managers (IAEM), and National Emergency Managers Association (NEMA) were added to the cover recognizing their endorsement of the standard.
2007 Public Law 110-53 “PS-Prep”
The 9/11 Commission's recommendations for enhanced private sector preparedness was written into two Federal Laws—Public Law 108-458 in 2004 and Public Law 110-53 in 2007. Title IX of PL 110-53 calls for the voluntarily certification of private sector preparedness programs—now referred to as PS-Prep.™ The U.S. Department of Homeland Security has designated multiple editions of NFPA 1600—most recently the 2016 edition—to be used as the criteria for accreditation of private sector preparedness programs.
2010 Edition
The 2010 edition of NFPA 1600 was significantly reorganized. Chapter 5 of the 2007 edition was expanded into four chapters, which were reordered to follow a program development process. This ordering also follows the “Plan—Do—Check—Act” program development process that users of ISO standards are accustomed to.
Management commitment to, direction of, and support for the emergency management and business continuity program is critical. This was the impetus for the committee to include a new section 4.1 on “Leadership and Commitment.” Program management was also enhanced with a new section, 4.6, on “Performance Objectives.” Finance and administration is another pillar of an emergency management and business continuity program. The finance section, which used to appear at the end of the 2007 edition has been relocated to the program management chapter and expanded to include crisis management procedures. A new records management section has been included as well to fulfill auditing requirements.
A new section on “Business Impact Analysis” was added to Chapter 5 supplementing the risk assessment section of the 2007 edition. This new section includes a requirement to evaluate the potential for loss of information—technically referred to as the “recovery point objective” or “RPO.”
A new section, 6.6 “Employee Assistance and Support,” was added to address the need to render care for the physical and emotional well-being of employees in the aftermath of an incident.
The committee significantly expanded the requirements for exercises and placed it within its own chapter. These requirement are performance based—to establish and maintain required capabilities. Basic design requirements for exercises were specified.
Program evaluation was moved from the program management section of the 2007 edition and expanded within a new chapter on program improvement. The new chapter included management review of policies, objectives, and program implementation. “Triggers” for program evaluation were specified in addition to the requirement that the program should be evaluated whenever the effectiveness of the program has been called into question.
Annex F, NFPA 1600 2013 Edition as a Management System Standard, was added for use by those who wish to follow a “management system standard” . Language was added to the standard to allow users to adopt Annex F in place of the numbered chapters of the standard.
2013 Edition
The 2013 edition continued the reordering of the standard to align with a program development process and the continuous improvement process.
Performance objectives were moved from Chapter 4, Program Management to Chapter 5, Planning. Prevention and mitigation were moved from Planning to Chapter 6, Implementation. Resource management was split into resource needs assessment (Chapter 5, Planning) and resource management (Chapter 6, Implementation).
Content on “communications and warning” and “crisis communications” was totally written into two sections “Warning, Notifications, and Communications” and “Crisis Communications and Public Information.”
Requirements for business continuity and recovery were revised throughout the document, and new requirements for employee assistance and support were added.
Chapter 7, Training and Education was added to expand and clarify those requirements. In Chapter 9, the committee added program maintenance requirements. Annex A was reorganized, and new annexes were added.
2016 Edition
NFPA 1600 is used extensively in the private and public sectors. Recognizing the public sector terminology of "continuity of operations planning, often referred to as “COOP,” the committee voted to expand the title to include the words “Continuity of Operations.”
The purpose of the standard was also changed to emphasize that the standard provides fundamental criteria for preparedness, and that the program shall address prevention, mitigation, response, continuity, and recovery. In other words, "preparedness" is no longer an element of the program—it is the program.
The committee clarified crisis management planning emphasizing that entities prepare to address issues, an event, or series of events, that severely impacts or has the potential to severely impact an entity's operations, reputation, market share, ability to do business, or relationships with key stakeholders.
Business continuity was again a focus of the 2016 edition and supply chain risk and information security were addressed in multiple places. Supply chain vulnerability assessment was added to the section on risk assessment. Assessment of the impacts that could result from the loss of “information” was added to the requirements for the impact analysis. Planning for the security of information was added to the continuity planning section. The business impact analysis section in Chapter 5 was largely rewritten along with revised sections on continuity planning and recovery planning to provide more depth and differentiate “continuity” from “recovery.”
A significant change to the risk assessment requirements in Chapter 5, Planning was the relocation of the detailed list of natural, human-caused, and technological hazards from Annex A to the requirements for risk assessment. The committee felt that the risk assessment is so important to the foundation of the program, that users should evaluate—to the extent necessary—all of the hazards on the list during the risk assessment process.
Annex C, Small Business Preparedness Guide was included to address a longstanding need for small business planning. A definition for persons with access and functional needs was added, and it supports new Annex J, Access and Functional Needs. Minor changes address the role of social media within crisis communications plans and capabilities.
2019 Edition
The title was changed to emphasize “crisis” management content that has been introduced over the past three editions. A crisis is defined as “an issue, event, or series of events with potential for strategic implications” including impacts on brand, image, reputation, and more. A new section “crisis management” has been added to chapter 6, Implementation. This section defines a “crisis management capability,” with senior leadership involvement, signals detection, identification of issues, strategy development, and more.
Another notable change is the addition of a new chapter 7 titled “Execution.” It defines what should be obvious but is often overlooked, that is, how a program should be executed. Incident recognition, reporting and notification, activation and planning, incident management, documentation, and resource management are included in the new chapter. The chapter extracts the important elements of alerting, notification, and warning with activation of an incident management system.
The annexes, which are a treasure trove of valuable information, continue to expand. Annex J, “Social Media in Emergency Management” has been added. When an incident occurs, social media is alive before emergency, continuity, and crisis management responders are fully engaged. Therefore, integrating social media into all program activities—preparedness for a forecast event to communicating with stakeholders regarding continuity and recovery information after—is a must.
Other new annexes include Annex K Emergency Communications: Public Alerts and Warnings in Disaster Response and Annex L Emergency Management, Continuity, and Crisis Management Data Interoperability.
May 31, 2019. Donald L. Schmidt, CEO of Preparedness LLC, authored “NFPA 1600 2019 Edition: A Resource for Every Practitioner’s and Auditor’s Toolbox” for the launch of the new Risk and Resilience HUB website. The article was also distributed by the Continuity eGUIDE. more …
NFPA 1660, Standard for Emergency, Continuity, and Crisis Management: Preparedness, Response, and Recovery, 2024 edition
NFPA 1600, “Standard on Continuity, Emergency, and Crisis Management,” 2019 edition, NFPA 1616, “Standard on Mass Evacuation, Sheltering, and Re-entry Programs,” 2020 edition, and NFPA 1620, “Standard for Pre-Incident Planning” 2020 edition, have been consolidated into a new standard, NFPA 1660. The technical committees responsible for these standards worked together to complete the consolidation, and the three committees continue to exist at this time.
The National Fire Protection Association’s consolidation plan for its Emergency Response and Responder Safety standards with “similar content areas” is intended to “increase usability, reduce errors and conflicts, and ultimately produce higher quality standards.”
NFPA 1600 2019 edition’s chapters 4 through 10 are almost without change within the new 1660 and have retained their numbering. Chapter 1, “Administration” has been expanded to encompass the broader scope, purpose, and application of the three predecessor standards. An expanded list of publications can be found in Chapter 2, and a much longer list of definitions can be found in Chapter 3. A new section 4.1 “Administration” encompasses the scope, purpose, and application from 1600-2019 requiring subsections to be renumbered 4.2 through 4.9. Otherwise, there are no significant changes to the text from chapters 4-10 of NFPA 1600-2019.
A digital version of the new NFPA 1660 is viewable on the NFPA website and for sale by NFPA.
