Standards
Does it cover mine?
Eight assessment models, each built from a published standard. Their categories map to eight resilience domains, so results from different standards add up to one picture of the program.
Continuity and recovery
ISO 22301:2019
Business continuity management systems. 105 questions, 13 categories.
ISO 27031:2025
ICT readiness for business continuity. IT disaster recovery. 56 questions, 6 categories.
NIST 800-53r5 Contingency Planning
The CP control family. 76 questions, 10 categories.
Crisis management and security
ISO 22361:2022
Crisis management. 197 questions, 14 categories.
ASIS WPV-AA:2020
Workplace violence prevention and active assailant. 129 questions, 15 categories.
Information security
Regulatory
FFIEC 2019
Business continuity management handbook for financial institutions. 96 questions, 8 categories.
FINRA Rule 4370
Business continuity planning for broker-dealers. A nine-question compliance check.
Standards in the library
- ISO 22301:2019 Business continuity
- ISO 22361:2022 Crisis management
- ISO 27001:2022 Information security
- ISO 27031:2025 IT disaster recovery
- NIST 800-53r5 Contingency planning
- FFIEC 2019 Business continuity
- FINRA Rule 4370
- ASIS WPV-AA:2020 Workplace violence and active assailant
Eight resilience domains
- Business continuity
- Crisis management
- IT disaster recovery
- Information security
- Risk management
- Third-party risk and resilience
- Emergency response and life safety
- Reputation management
The maturity scale
| Score | Level | What it means |
|---|---|---|
| 0 | Non-existent | No recognizable practice in place. |
| 1 | Initial / ad hoc | Done reactively, by individuals, without a defined approach. |
| 2 | Repeatable but intuitive | Practices repeat but depend on people rather than a defined program. |
| 3 | Defined process | Documented, standardized, and communicated across the organization. |
| 4 | Managed and measurable | Monitored and measured, with action taken when performance slips. |
| 5 | Optimized | Continuously improved and integrated into how the organization runs. |
Full rubric on the Maturity scale page.