ICOR Logo

Private Sector Preparedness - What's in it for me? 

This month's ICORrespondence Newsletter investigates the subject of the U.S. Private Sector Preparedness Voluntary Certification, the Standards approved to meet this certification, why your business should become certified, and how to prepare for certification.

 

And...share your opinion with us by joining the ICOR Linkedin Network!  Search for us under The International Consortium for Organizational Resilience.  Let us know your thoughts on the PS-Prep Program, the standards accepted, and the usefulness of benchmarking.  Also, what does this program mean to multi-national organizations and those outside the U.S.?  Does it matter?

 

And if you have questions, don't hesitate to call or send an email.

 

Sincerely,

 

Lynnda Nelson, President
The International Consortium for Organizational Resilience
Lynnda@theicor.org
866.765.8321 US/Canada  +1630.705.0910 International Calls
Private Sector Prepareness - What's in it for me?
What is PS Prep?
What are the Standards for Private Sector Preparedness?
Why Should my Business Become Certified?
How Can my Organization Become Certified?
How Can I Help my Organization Prepare for Third Party Certification?
What Should I do Now?
What is PS Prep?
PS-Prep is a partnership between DHS, FEMA, and the private sector that enables private entities to receive emergency preparedness certification from a DHS accreditation system created in coordination with the private sector.  http://www.fema.gov/privatesector/preparedness/

 

In 2001, the USA Patriot Act identified the importance of protecting critical infrastructure in the United States.  It also focused on the importance of protecting key resources essential to the minimal operations of the economy or government that are publically or privately controlled. 

 

The National Infrastructure Protection Plan (NIPP) was developed as an output of the Act to be a unifying structure for the government and the private sector and to improve the protection and resiliency of critical infrastructure and key resources.

 

On August 2, 2007, Public Law 110-53 was enacted and documented in a report entitled, "Implementing Recommendations of the 9/11 Commission 2007 Act - Comprehensive Summary of Public Law 110-53."   For a full copy of this report visit http://intelligence.senate.gov/laws/pl11053.pdf

 

Title IX of this law focuses on Private Sector Preparedness (PS Prep) and identifies a program for encouraging the private sector to voluntarily participate in being certified under PS Prep to demonstrate that they are prepared to manage risks and have increased the resiliency of the organization.

 

With over 80% of the US critical infrastructure owned and controlled by the private sector, this Law is vital to ensuring that the private sector is prepared to provide its goods and services under all conditions.

 

Under Title IX, the Administrator and the Assistant Secretary for Infrastructure Protection was assigned to develop recommendations to assist or foster action by the private sector to increase their resilience.

 

Section 524 assigned the development of the Voluntary Private Section Preparedness Accreditation and Certification Program (PS Prep) to the American National Accreditation Board (ANAB). 

 

What are the Standards for Private Sector Preparedness?
The U.S. Department of Homeland Security (DHS) announced the adoption June 15, 2010 of the final standards for the Voluntary Private Sector Preparedness Accreditation and Certification Program (PS-Prep)-a major milestone in DHS' implementation of a program recommended by the 9/11 Commission to improve private sector preparedness for disasters and emergencies as mandated by U.S. Public Law 53-110 Title IX. 
 
"Private organizations across the country-from businesses to universities to non-profit organizations-have a vital role to play in bolstering our disaster preparedness and response capabilities," said Secretary Napolitano. "These new standards will provide our private sector partners with the tools they need to enhance the readiness and resiliency of our nation."
 
The following standards have been accepted for compliance: 
  1. National Fire Protection Association 1600 - 2007and 2010 versions-Standard on Disaster/Emergency Management and Business Continuity Programs. (Download for Free - 2007) (Download for Free - 2010)
  2. British Standard 25999-2:2007- Business Continuity Management. (Download at Cost)
  3. ASIS SPC. 1-2009-Organizational Resilience: Security Preparedness, and Continuity Management Systems- Requirements with Guidance for Use. (Download for Free)  
PS-Prep will raise the level of private sector preparedness through a number of means, including:
  1. Establishing a system for DHS to adopt private sector preparedness standards;
  2. Encouraging creation of those standards;
  3. Developing a method for a private sector entity to obtain a certification of conformity with a particular DHS-adopted private sector standard, and encouraging such certification; and
  4. Making preparedness standards adopted by DHS more widely available.    
Why Should my Business Become Certified? 

Certification helps you to demonstrate to your stakeholders that your business is run effectively and that it will continue to do so in the event of a disruption.

The process of achieving and maintaining the Business Continuity Management (BCM) certification also helps ensure that you are continually improving and refining your BCM activities. The regular assessment process will also improve staff responsibility, commitment and motivation.

 

Certification improves overall performance, removes uncertainty and widens market opportunities. It will prove to your customers that you can be trusted to deliver. Certification to BS 25999 creates an opportunity to reduce the burdens of internal and external audits from your key customers.

Despite all these internal reasons, the reason for many companies will be that a major customer requires some evidence of competent BCM performance. 

If this is your reason then don't panic; BCM isn't as complicated or as difficult as you might think.  Also you don't have to be an expert in any of the other management systems such as ISO 9001 (Quality management systems) or ISO 14001 (Environmental management systems) - the BCM system can be implemented alone.

However because it follows the simple Plan, Do, Check, Act cycle of other management systems if you are already a user of ISO 9001 and/or ISO 14001 then getting started with the BCM system will be very familiar to you.
How Can my Organization Become Certified?  

Title IX also identified the process for private sector organizations to become certified.  Small businesses (at this time the criteria as to what is a small business under the Law has yet to be determined) are allowed to use a first party self-declaration of conformity to one or more of the standards. 

 

All other organizations are required to use third party certification by an ANAB accredited certifying body.

 

It is important that your organization hires an ANAB accredited certifying body to conduct the third party audit for certification.  The certifying bodies have had to complete rigorous training to ensure that they are competent to conduct the certifying audits. 

 

For an up to date listing of those certifying bodies currently applying for accreditation by ANAB and for other information about PS Prep, visit http://www.anab.org/accreditation/preparedness.aspx
How Can I Help my Organization Prepare for Third Party Certifcation?

It is important that before your organization applies for third party certification from an ANAB approved certifying body, that your organization is ready.

 

The first decision that needs to be made is which standard or standards should your organization be certified to?  To answer this question you will want to review each of the 3 standards to determine which one is best aligned to the program you already have in place.

 

If this process seems daunting, The International Consortium for Organizational Resilience (ICOR) offers two different training courses focused on teaching the requirements of the 3 standards.


  1. BCM 5000:  Auditing BCM Programs for PS Prep Certification is the only auditor preparation course that includes preparation of auditing a BCMS against all 3 PS Prep standards. Attendees will gain a solid understanding of business continuity management programs and practices along with an in-depth study of the appropriate audit requirements. The course includes the following process for instruction;

· Essential BCM Program Components are introduced and explained (the How)
· The appropriate standard component is identified (the Why)
· The appropriate audit requirement is determined (the What)

 

The audiences for this 5 day in depth course are internal auditors, BCM practitioners, and certifying bodies seeking ANAB accreditation.  One benefit to using this course as a preparation for third party certification is that it is the same course offered both those seeking certification and those providing the certification so you will learn the language and be very familiar with what will be required by the auditors.

 

2.       BCM 4050:  Business Continuity Maturity Model® Assessor's Training has been updated as of January    2011 to be aligned to all 3 PS Prep Standards.  So in addition to being an assessment tool to measure an organization's Business Continuity Program maturity and provide direction for creating and maintaining a BC program as a sustainable process, it can also be used as an internal audit tool to evaluate your readiness for an external audit under PS Prep.

 

The audience for this 2 day course are those BCM practitioners with at least 3 years of experience and internal auditors of BCM programs.  The course will teach you how to use the BCMM® tool and how to audit against the 3 standards, but will expect all participants to have the required BCM knowledge and experience to evaluate their program.

 

The International Consortium for Organizational Resilience (ICOR), an international non-profit professional development and credentialing organization, completed its preliminary application to the American National Standards Institute (ANSI) for recognition of four of its training programs as one of its Certificate Accreditation Programs (CAP). 

 

ANSI's CAP accredits a wide range of organizations that issue education and training certificates internationally and has accepted ICOR's preliminary application for four of its training courses. 


To learn more about the two courses, contact Lynnda@theicor.org or visit http://theicor.org/courselisting.html#bcm

To learn more about the value of the ANSI CAP program and to view other education and training programs currently accredited by ANSI and those whose preliminary application has been accepted visit the ANSI website.  https://www.ansica.org/wwwversion2/outside/CAPgeneral.asp?menuID=212


The acceptance of ICOR's preliminary application is significant and directly impacts those organizations interesting in pursuing PS Prep certification. 

The Department of Homeland Security / Federal Emergency Management Agency (DHS/FEMA) Voluntary Private Sector Accreditation and Certification Preparedness Program (PS Prep) requires that trained auditors working for certification bodies be accredited by ANAB (ANSI-ASQ National Accreditation Board).   

 
What Should I do Now?

Now is a good time to learn more about the 3 standards and to talk to senior management and your auditing leadership about PS Prep and how your organization might benefit from PS Prep certification.

 

For questions, contact Lynnda Nelson, President of ICOR at 866-765-8321 or send an email to Lynnda@theicor.org.

 

If you would like to submit an article or presentation for a future ICORrespondence Newsletter submit it to Lynnda@theicor.org.
 
Sincerely,
 
Lynnda Nelson, President
The International Consortium for Organizational Resilience
Save 10%
Did you know that you can save 10% on all ICOR courses if you are a member of one of the following organizations?  Contact them to find out how or email info@theicor.org.
  • ICOR
  • ACP
  • AFCOM
  • ASIS
  • BRPA
  • BRPA SW
  • IAEM
  • IFMA
  • NEDRIX 
Become an ICOR Member Today!