1

NFPA 1600NFPA 1600

Standard for Standard for Disaster / Emergency Management Disaster / Emergency Management

andandBusiness Continuity ProgramsBusiness Continuity Programs

2004 Edition2004 Edition

Dean R. Larson Dean R. Larson NFPA 1600 CommitteeNFPA 1600 Committee

2

History of The Standard

1991 - Disaster Management Committee established

1995 – “Recommended Practice” issued

2000 – “Standard” issued

• Approved as an American National Standard

–“ANSI approval”

3

“The experience of the private sector in the World Trade Center emergency demonstrated the need for these standards.”

National Commission on Terrorist Attacks Upon the United States

“9/11 Commission”

4

History of The Standard

2004 –Latest Edition of NFPA 1600

–Through ANSI, vetted with over 2,000 organizations•Recommends NFPA 1600

5

9/11 Panel Vets Readiness Rules for

BusinessCommission is Worried Private

Sector Remains Unprepared for Attack

Wall Street Journal

6

Intent of The Standard

• Designed as a programmatic approach emphasizing functional elements and performance outcomes

• A resource for voluntary application

7

“A set of voluntary standards … developed by the ANSI and NFPA – empower the private sector to examine their own readiness and take part in the shared responsibility of homeland security”

Secretary Tom Ridge

8

JULY 22ND

9/11 COMMISSION REPORT

• “We endorse the American National Standards Institute recommended standard (NFPA) 1600 for private preparedness.”

9

NFPA 1600 ENDORSED BY

• DHS/FEMA

• NEMA

• IAEM

• ANSI – American National Standards Institute

10

NFPA 1600 Technical Committee onEmergency Management & Business Continuity

• Comprised of representatives from:– U.S. and Canadian Public and Private Sector

– Department of Homeland Security - FEMA

– National Emergency Management Assoc. (NEMA)

– International Assoc. of Emergency Managers (IAEM)

11

WHAT’S NEW IN NFPA 16002004 EDITION

• Annex A expanded to include additional explanatory information

• Annex A contains a table showing FEMA’s CAR / NFPA 1600 / BCI & DRII Professional Practices for integration of BCP and Emergency Management

12

WHAT’s NEW IN NFPA 1600 2004 EDITION

• Annex B (Emergency Management & Related Organizations significantly expanded resource)–Specific initiative to include

Canadian emergency management

13

WHAT’S NEW IN NFPA 16002004 EDITION

• Annex D (Disaster / Emergency Management Accreditation and Certification Programs) is

–New providing a representative listing of the programs that accredit and/or certify people and organizations

14

WHAT’S NEW IN NFPA 16002004 EDITION

• Annex D (Disaster / Emergency Management Accreditation and Certification Programs) is

–Clarification: EMAP is based on NFPA 1600 … NOT a separate program

15

WHAT’S NEW IN NFPA 16002004 EDITION

• Annex E ( Informational Resources) is –New, provides a listing of

NFPA standards and codes that are most common references in bcp and emergency management programs

16

NFPA 1600, 2004 Edition

• Chapter 1 Administration• Chapter 2 Reference Publications (Reserved)• Chapter 3 Definitions• Chapter 4 Program Management

Requirements• Chapter 5 Program Elements• Annexes

17

1.1* Scope.

• When you read a section with an (*)…

– Annex A has a corresponding section “A.1.1”

– Purpose: Explanatory material

– Recommendations

18

1.2 Purpose of Standard

• This standard shall provide those with the responsibility for disaster and emergency management and business continuity programs the criteria to assess current programs or to develop, implement, and maintain a program to mitigate, prepare for, respond to, and recover from disasters and emergencies.

19

1.2 Purpose of Standard

• Criteria –to assess current programs or

–to develop, implement, and maintain a program

20

1.3 Application.

• This document shall apply to both public and private programs.

21

1.3 Application.

• This document shall apply to both public and private programs.

OUR CHALLENGE

Sell this standard to the private sector

22

3.1 Definitions

• Definitions - shall apply to the terms used in this standard.

• Where terms are not included, common usage of the terms shall apply– Uses dictionary definitions when appropriate

• VERY DIFFICULT section to write– Uses dictionary definitions when appropriate– Many different opinions to consider– Minimum number of definitions

23

3.2 NFPA Official Definitions

• Approved

• Authority Having Jurisdiction (AHJ)

• Shall. Indicates a mandatory requirement.

• Should. Indicates a recommendation or that which is advised but not required.

• Standard

24

3.3 General Definitions.• Business Continuity Program• Damage Assessment • Disaster/Emergency Management

Program• Entity• Impact Analysis (Business Impact

Analysis, BIA)• Incident Management System

25

3.3 General Definitions.

• Mitigation • Mutual Aid Agreement• Preparedness• Recovery• Response• Situation Analysis

(Prevention/Deterrence??)

26

Chapter 4 Program Management

4.1 Program Administration4.2* Program Coordinator4.3* Advisory Committee4.4 Program Evaluation

27

Chapter 5 Program Elements

5.1* General5.2 Laws and Authorities

5.3* Hazard Identification, Risk Assessment, and Impact Analysis5.4 Hazard Mitigation5.5* Resource Management

28

Chapter 5 Program Elements

5.6* Mutual Aid5.7 Planning5.8 Direction, Control, and Coordination5.9 Communications and Warning5.10* Operations and Procedures

29

Chapter 5 Program Elements

5.11 Logistics and Facilities5.12 Training5.13 Exercises, Evaluations, and Corrective Actions5.14 Crisis Communication and Public Information5.15* Finance and Administration

30

Chapter 5 Program Elements

Let’s cover two elements in depth

31

5.3* Hazard Identification, Risk Assessment, and Impact Analysis.

• 5.3.2* Hazards to be considered at a minimum shall include, but shall not be limited to, the following:– SEE the ANNEX for list (Revised)

(1) Natural hazards (geological, meteorological, and biological)

(2) Human-caused events (accidental and intentional)

32

5.3* Hazard Identification, Risk Assessment, and Impact Analysis.

(6) The environment

(7) *Economic and financial condition

(8) Regulatory and contractual obligations

(9) Reputation of or confidence in the entity

33

5.4 Hazard Mitigation.

• 5.4.3 The mitigation strategy shall consider, but not be limited to, the following:

(1) The use of applicable building construction standards

(2) Hazard avoidance through appropriate land-use practices

34

5.4 Hazard Mitigation.(3) Relocation, retrofitting, or removal of structures at risk

(4) Removal or elimination of the hazard

(5) Reduction or limitation of the amount or size of the hazard

(6) Segregation of the hazard from that which is to be protected

35

5.4 Hazard Mitigation.

(7) Modification of the basic characteristics of the hazard

(8) Control of the rate of release of the hazard

(9)* Provision of protective systems or equipment for both cyber or physical risks

36

5.4 Hazard Mitigation.

(10) Establishment of hazard warning and communication procedures

(11) Redundancy or duplication of essential personnel, critical systems, equipment, information, operations, or materials

37

Annexes

• Annex A – Explanatory Material for provisions in body of standard– Significantly expanded

• For example, New Table A.5.1

• Annex B – Disaster/Emergency Management and Related Organizations

38

Annexes

• Annex C - Additional Resources– This annex is not a part of the

requirements of this NFPA document but is included for informational purposes only. Information that has been provided in this annex is accurate as of the date of this publication.

39

Annexes

• Annex D – Disaster/Emergency Management Accreditation and Certification Programs– NEW

• Annex E – Informational References– NEW

40

Annexes

• Annex D – Disaster/Emergency Management Accreditation and Certification Programs

• Annex E – Informational References

41

What’s next?

• Committee is back at work on the 2007 Edition– Significantly more interest because of 9/11

Endorsement

• Is Prevention/Deterrence the “Fifth?”– Some say “Yes”– Some say “Subset of Mitigation”

• Incorporating NIMS and NRP guidance

42

What’s next?

• Attempt to integrate Emergency Management and Business Continuity approaches to preparedness– Emergency Management -> Public– Business Continuity -> Private

• BOTH have the same Goal: Survivability

43

Questions?

?For a copy of this presentation, please give me your email address

44

NFPA 1600Standard on Disaster/Emergency Management

and Business Continuity Programs 2004 Edition

You can download NFPA 1600 from the NFPA website identified below:

http://www.nfpa.org/PressRoom/NewsReleases/1600/1600.asp

Dean R. Larson PhDCEM CSP CPT CPEA

IERC and Lake County LEPCdrlarson@jorsm.com

Cell:219.689.1388