Standard, good practice, regulation: who says what
Three families of texts
Standards
A standard is voluntary. You choose to conform, and possibly to be certified. It brings a shared language, a proven structure and a credibility signal to clients.
ISO 22301 is certifiable. ISO 22313, ISO/TS 22317 and ISO 22361 are not: they are guides.
Professional good practice
The BCI Good Practice Guidelines and the DRI Professional Practices are neither standards nor regulations: they are the profession's own corpora. They describe how practitioners actually work, at a level of operational detail no standard reaches.
They serve two purposes: training practitioners, and individual certification — the certificate is about the person, not the organisation.
Regulations
A regulation is imposed. It is not negotiated, not chosen, and non-compliance carries sanctions.
DORA, NIS 2, the CER Directive, the EBA guidelines and the UK operational resilience regime all sit here.
Choosing which text to open
| Your question | The text to open |
|---|---|
| What must I demonstrate to be certified? | ISO 22301 |
| How do I actually go about it? | ISO 22313, BCI GPG |
| How do I run a BIA? | ISO/TS 22317 |
| How do I structure my crisis team? | ISO 22361, ISO 22320 |
| How do I build an exercise programme? | ISO 22398 |
| What must I report, and within what deadline? | DORA Art. 19, NIS 2 Art. 23 |
| How do I set an impact tolerance? | BCBS 516, PRA SS1/21 |
| How do I design IT recovery? | ISO/IEC 27031, NIST SP 800-34 |
A recommended reading order
For an organisation starting out, the order that works is:
- ISO 22300 for the vocabulary — an hour of reading that prevents six months of misunderstanding;
- ISO 22301 for the structure of requirements;
- ISO/TS 22317 before launching the first BIA;
- The applicable regulation, if there is one, read last but applied first.
That final inversion is deliberate: a regulatory requirement is easier to grasp once you already know the discipline it governs.
Key takeaways
- A standard is chosen, a regulation is imposed
- The GPG answers "how", ISO 22301 answers "what"
- Regulatory compliance does not automatically follow from certification