Industry standards

The standards and frameworks that shape resilience, business continuity, crisis management and cyber recovery practice, and that we work with every day.

Business continuity and organisational resilience

ISO 22301
Security and resilience - Business continuity management systems - Requirements
The certifiable international standard for a business continuity management system (BCMS).
ISO 22313
Business continuity management systems - Guidance on the use of ISO 22301
Practical guidance for putting an ISO 22301 BCMS in place.
ISO 22317
Business continuity management systems - Guidelines for business impact analysis
How to run a business impact analysis (BIA).
ISO 22318
Business continuity management systems - Guidelines for supply chain continuity management
Extends continuity planning to suppliers and third parties.
ISO 22316
Security and resilience - Organizational resilience - Principles and attributes
Principles for building resilience across the whole organisation.
BS 65000:2022
Organizational resilience - Code of practice
UK code of practice for strengthening organisational resilience, with principles, recommendations and practical measures.
BCI Good Practice Guidelines
Business Continuity Institute
The professional practice guide for business continuity.
DRI Professional Practices
DRI International
Professional practices for business continuity management.

Crisis, incident and emergency management

BS EN ISO 22361:2022
Security and resilience - Crisis management - Guidelines
Guidance for building and improving strategic crisis management capability, including leadership, decision-making, communications and exercises.
ISO 22320
Security and resilience - Emergency management - Guidelines for incident management
Structures and processes for incident command and coordination.

Cyber, information security and ICT resilience

ISO/IEC 27001
Information security management systems - Requirements
The certifiable international standard for information security management.
ISO/IEC 27031
ICT readiness for business continuity
Links IT and cyber recovery to business continuity.
ISO/IEC 20000-1
IT service management - Service management system requirements
Service management, including service continuity and availability.
NIST Cybersecurity Framework 2.0
US National Institute of Standards and Technology
Govern, Identify, Protect, Detect, Respond and Recover.
NIST SP 800-34
Contingency Planning Guide for Federal Information Systems
IT contingency and disaster recovery planning.
Cyber Essentials
UK Government-backed scheme, run by the NCSC
Baseline technical controls that protect against the most common cyber attacks.
NCSC Cyber Assessment Framework (CAF)
UK National Cyber Security Centre
Outcome-based framework for assessing cyber resilience.
COBIT
ISACA
Governance and management framework for enterprise IT.

Network and information systems security law

NIS Regulations 2018 (UK)
The Network and Information Systems Regulations 2018
UK law requiring operators of essential services and digital service providers to manage cyber risk and report incidents.
NIS2 Directive (EU)
Directive (EU) 2022/2555
The EU's updated cyber security law, widening the sectors covered and tightening risk management and incident reporting.

Risk management

ISO 31000
Risk management - Guidelines
International principles and guidelines for managing risk.

Please note: AV Resilience Consulting is not accredited or endorsed by the NCSC. Standards, frameworks and laws are listed for information only. Inclusion on this page, including Cyber Essentials, does not imply certification, accreditation or endorsement by any standards body, government or regulator.

Financial services regulation (FCA/PRA operational resilience, DORA) is covered on the Regulations page.