The Crisis StudioBusiness continuity management systems — Requirements
Applies to: Any organization. This is the certifiable BCMS standard regulators point to.
Amendment 1 (2024) adds climate change considerations. Paid standard.
Official source ↗The main business continuity, operational resilience, disaster recovery, cyber resilience and third-party risk regulations and standards worldwide. Each one links to the official source. Filter by where you operate and what you're trying to fix, or start from the profile that looks most like you. Or search your organization by name for a tailored list.
Pick the profile closest to your organization. Each link jumps to the source. These are common starting points, not a complete list. Most organizations fall under more than one regime.
Voluntary, certifiable standards and the global principles that national regulators copy from. If you only read one section, read this one.
Applies to: Any organization. This is the certifiable BCMS standard regulators point to.
Amendment 1 (2024) adds climate change considerations. Paid standard.
Official source ↗Applies to: Anyone implementing ISO 22301.
Companion guidance. Paid standard.
Official source ↗Applies to: BC teams building or refreshing a BIA.
Last confirmed 2025. Paid standard.
Official source ↗Applies to: Organizations dependent on critical suppliers.
Paid standard.
Official source ↗Applies to: Boards and executives framing resilience beyond BC.
Revision in progress. Check for a newer edition.
Official source ↗Applies to: Executive crisis teams and the people who design their exercises.
Paid standard.
Official source ↗Applies to: Any organization responding to incidents, alone or with partners.
Last confirmed 2024. Paid standard.
Official source ↗Applies to: Any organization. The certifiable ISMS standard.
Paid standard.
Official source ↗Applies to: IT and DR teams setting RTO, RPO and MBCO for ICT services.
Second edition, May 2025. Paid standard.
Official source ↗Applies to: Procurement, vendor risk and security teams.
Multi-part series. Paid standard.
Official source ↗Applies to: Any organization. The ERM baseline most resilience programs sit inside.
Paid standard.
Official source ↗Applies to: Banks. Most national op-res rules trace back to this.
Free.
Official source ↗Applies to: Banks.
Published alongside the operational resilience principles. Free.
Official source ↗Applies to: Financial institutions and their supervisors.
Common terms, critical-service identification, incident reporting. Free.
Official source ↗Applies to: Payment systems, CCPs, CSDs, trade repositories.
Principle 17 covers operational risk and BC. Free.
Official source ↗Applies to: FMIs. Sets the 2-hour recovery expectation for critical operations.
A cyber resilience toolkit was out for consultation in 2026. Free.
Official source ↗Applies to: Securities intermediaries, trading venues, CRAs.
Seven principles, including BC and disaster recovery. Free.
Official source ↗No single resilience law. Requirements come from your sector regulator: banking agencies, the SEC, FINRA, state regulators, HHS, CMS, NERC.
Applies to: Any organization. Widely used outside the US as well.
Voluntary. Free.
Official source ↗Applies to: Federal systems. Widely used as a private-sector IT DR reference.
Free.
Official source ↗Applies to: Security and incident response teams.
Aligned to CSF 2.0. Free.
Official source ↗Applies to: Organizations managing technology supplier risk.
Free.
Official source ↗Applies to: Banks, credit unions and their technology service providers.
What examiners actually test. Free.
Official source ↗Applies to: Large US banking organizations.
Free.
Official source ↗Applies to: All banking organizations supervised by the three agencies.
Free.
Official source ↗Applies to: Banking organizations and their bank service providers.
Notify your regulator within 36 hours of a notification incident.
Official source ↗Applies to: US public companies.
Material incidents disclosed within four business days of the materiality determination.
Official source ↗Applies to: Broker-dealers, investment advisers, funds, transfer agents.
Requires an incident response program, customer notification and service provider oversight.
Official source ↗Applies to: FINRA member broker-dealers.
Free.
Official source ↗Applies to: NYDFS-licensed banks, insurers and financial services firms.
Amended 2023. Includes BCDR and 72-hour notification requirements.
Official source ↗Applies to: Covered entities and business associates handling ePHI.
Contingency plan required. Free guidance.
Official source ↗Applies to: Medicare and Medicaid participating providers and suppliers (17 provider types).
Requires plans, training and exercises.
Official source ↗Applies to: Covered critical infrastructure entities.
Final rule still pending: 72-hour incident and 24-hour ransom payment reporting.
Official source ↗Applies to: Bulk electric system owners and operators.
Includes CIP-008 incident reporting and CIP-009 recovery plans.
Official source ↗Applies to: Any organization. Consolidates the old NFPA 1600, 1616 and 1620.
ANSI standard. Free to view with registration.
Official source ↗Applies to: Public sector, and private organizations that coordinate with responders.
Free.
Official source ↗Directly applicable regulations and directives. DORA covers financial services; NIS2 and CER cover essential and important entities across sectors.
Applies to: Around 20 types of EU financial entity, plus critical ICT third-party providers.
Applied from 17 Jan 2025. RTS and ITS sit underneath it.
Official source ↗Applies to: Essential and important entities in 18 sectors.
Transposed into national law. Check your member state's implementing act.
Official source ↗Applies to: Critical entities designated by member states across 11 sectors.
Covers physical and all-hazards resilience. Pairs with NIS2.
Official source ↗Applies to: Manufacturers and sellers of products with digital elements.
Reporting obligations apply before the main requirements. Check the phased dates.
Official source ↗Applies to: Anyone processing EU personal data.
Art. 32 covers security and restoring availability. Arts. 33–34 set 72-hour breach notification.
Official source ↗Applies to: EU banks, investment firms, payment and e-money institutions.
Final Sept 2026. Will replace the 2019 outsourcing guidelines (EBA/GL/2019/02); application date to be confirmed.
Official source ↗Operational resilience rules for financial firms, a separate regime for critical third parties, and national cyber and civil-contingencies law.
Applies to: PRA-regulated banks, building societies, insurers.
Full compliance was due 31 Mar 2025.
Official source ↗Applies to: PRA-regulated firms.
Updated version takes effect March 2027. Check the page for the current text.
Official source ↗Applies to: Banks, insurers, payment and e-money firms, and enhanced SM&CR firms.
SYSC 15A rules. Free.
Official source ↗Applies to: Third parties designated by HM Treasury as critical (e.g. major cloud providers).
Published Nov 2024; in force 1 Jan 2025.
Official source ↗Applies to: Operators of essential services and relevant digital service providers.
Reforms are moving through Parliament via the Cyber Security and Resilience Bill.
Official source ↗Applies to: NIS-regulated organizations, and anyone else who wants it.
Free.
Official source ↗Applies to: Category 1 and 2 responders, including utilities and transport.
Requires business continuity plans for responders.
Official source ↗Applies to: National framework. Useful context for any UK organization.
Implementation updates published annually.
Official source ↗Prudential standards in Australia, Singapore, Hong Kong, Japan and India. Most of them follow the Basel operational resilience principles.
Applies to: APRA-regulated banks, insurers and super funds.
In force from 1 July 2025.
Official source ↗Applies to: APRA-regulated entities.
72-hour notification for material incidents.
Official source ↗Applies to: Critical infrastructure assets in 11 sectors.
Risk management programs (CIRMP) and mandatory cyber incident reporting.
Official source ↗Applies to: Singapore financial institutions.
Revised 2022. Organized around critical business services.
Official source ↗Applies to: Singapore financial institutions.
Free.
Official source ↗Applies to: Banks and merchant banks (with Notices 658 / 1121).
MAS has consulted on broader third-party risk guidelines that would replace this.
Official source ↗Applies to: Insurers, capital markets and other non-bank FIs.
Effective 11 Dec 2024.
Official source ↗Applies to: Authorized institutions in Hong Kong.
Free.
Official source ↗Applies to: Japanese financial institutions.
Provisional English translation. Based on the Basel principles.
Official source ↗Applies to: Banks, NBFCs, co-operative banks and AIFIs.
Issued 30 Apr 2024. 17 principles.
Official source ↗OSFI guidelines for federally regulated banks and insurers. E-21, B-10 and B-13 are written to be read together.
Applies to: Federally regulated banks and insurers.
Published Aug 2024; full adherence expected by 1 Sept 2026.
Official source ↗Applies to: Federally regulated financial institutions.
Free.
Official source ↗Applies to: Federally regulated financial institutions.
Free.
Official source ↗National business continuity standards that are mandatory for many government and regulated entities.
Applies to: UAE government entities and many regulated organizations.
Closely aligned to ISO 22301. Available from the NCEMA site.
Official source ↗Nothing matches that search. Try a broader term, or clear the topic filters.
Most of these frameworks expect you to test your plans with severe but plausible scenarios, and to fix what the test finds. We design exercises around the specific expectations your regulator will ask about, then help you close the gaps.
Scenario testing, tabletop exercises and gap remediation, mapped to DORA, PRA SS1/21, FFIEC, CPS 230, E-21 and others.
Talk to us about scenario testing →