IMMEDIATE ACTION IS REQUIRED

Your assistance is urgently needed to preserve the integrity of BCP standards.

 

Washington, DC - August 12, 2008 -  Last October, Disaster Recovery Institute International (DRI) issued a position statement regarding the establishment of a standard for Business Continuity Planning.  This was in response to the American Society for Industrial Security (ASIS) attempting push through an unproved and ill-considered standard with the American National Standards Institute (ANSI).  We believed that our statement had settled the matter.
 
However, ASIS has filed two notices with the ANSI called "PINS Forms: Standards Action Public Review Requests." One of these is "BSR/ASIS BCM.01-200x, Business Continuity Management: Preparedness, Crisis Management, and Disaster Recovery". This proposed standard is being drafted "to include auditable criteria for preparedness, crisis management, business/operational continuity and disaster management using a process approach with the Plan-Do-Check-Act model, as required by Title IX of H.R. 1 and Public Law 110-53 'Implementing Recommendations of the 9/11 Commission Act of 2007'".
 
DRI International strongly opposes this filing.  We are asking our colleagues and certified professionals in the field to oppose this effort to create a "Business Continuity Management" standard in an industry already beset with multiple and often confusing standards.  The comment period for this "PINS" phase of "BSR/ASIS BCM.01-200x" closes on August 30, 2008.
 
Please send a clear message to ANSI through its designated point of contact, Susan Carioti at scarioti@asisonline.org. We are making every attempt to coordinate this effort and track the comments, which we believe will help in making presentations to ANSI and other appropriate agencies.  When you send your e-mail to Ms. Carioti, please send a bcc to standards@drii.org.  Your efforts are greatly appreciated.

Suggested Comments for Response
 
Doesn't a standard for Business Continuity practices already exist?
Yes.  NFPA 1600 - Standard on Disaster/Emergency Management and Business Continuity Programs has been the US and Canadian standard for Business Continuity since 1995.  NFPA 1600, DRI International Professional Practices and BCI's Certification Standards for Professional Practitioners form the basis for the certifications held by the majority of the world's certified Business Continuity professionals.
 
Is NFPA 1600 recognized outside the Business Continuity community?
Yes.  It is the standard endorsed by the U.S. Department of Homeland Security and the Federal Emergency Management Agency and certified as an ANSI Standard.
 
Was ASIS given an opportunity to have their opinion heard?
Yes.  But, ASIS had an opportunity to provide input to NFPA 1600, as a member of NFPA's Technical Committee, but ASIS declined.
 
Were BC Professionals involved in creating this standard?
No.  ASIS created a "standard" that serves the needs of the security profession without the benefit of comment from DRI International, BCI, RIMS, NFPA and other recognized subject matter experts.  ASIS has never approached the business continuity industry itself to participate in the creation of its draft standard.
 
What's wrong with independent standards?
Briefly, the continuing creation of independent standards in these areas does little more than generate confusion in fields that are already beset with multiple standards and definitions. Such efforts serve only to increase the "noise" in an industry that is already far too difficult for even experienced practitioners to explain to those who look to us to help them manage the complex array of risks that we all face in today's environment.
 
If a standard needs to be created, how should it be done?
True "standards" come about as the result of communication and collaboration involving experts in the subject matter area to which the particular standard is to apply.  This is the only way to ensure that the standards that are created represent a consensus that will be of benefit to both the subject matter professionals and the respective communities that they serve.