The law around the BCMS, in market order
The standard is guidance. The obligations around it are not. For each market the frameworks were chosen by a scan of the held library, not from a fixed list. The order is the United States, the European Union, the United Kingdom and Australia. Where a market's regime is not held, the page names it and does not state its duties.
The scan used the buyer's activity: business continuity, resilience, incident reporting, critical infrastructure and risk management. The chosen frameworks are the ones that genuinely apply to this buyer, not every framework that mentions continuity.
United States
The NIST framework is the primary federal reference for cyber resilience. NFPA 1600 supplies the continuity programme detail, and CIRCIA sets a reporting duty that reaches the response process.
| Framework held | Controls | Why it matters to this buyer |
|---|---|---|
| NIST Cybersecurity Framework 2.0 | 106 | The federal framework for managing cyber risk. Its govern, identify, protect, detect, respond and recover functions overlap the continuity processes, and recovery planning is explicit. |
| NFPA 1600, Continuity, Emergency and Crisis Management | 142 | A widely used continuity, emergency and crisis management standard. It gives the programme structure behind the plan set and the exercise programme. |
| CIRCIA, Cyber Incident Reporting for Critical Infrastructure | 22 | The federal incident reporting regime for covered critical infrastructure. It sets a reporting clock that the warning and communication process has to meet. |
European Union
NIS2 and DORA turn resilience expectations into enforceable duties for many buyers. The DORA technical standard is where the continuity and testing detail sits.
| Framework held | Controls | Why it matters to this buyer |
|---|---|---|
| NIS2 Directive (EU) 2022/2555 | 28 | The cyber risk management and reporting directive for essential and important entities. It makes governance, business continuity and incident reporting duties explicit. |
| DORA, Regulation (EU) 2022/2554 | 26 | The digital operational resilience regime for financial entities. It covers ICT risk, incident management, testing and third-party dependency. |
| DORA RTS on the ICT Risk Management Framework | 40 | The technical standard under DORA that details the ICT risk management framework, including business continuity policy and recovery testing for financial entities. |
United Kingdom
The operational resilience framework is the binding UK regime for financial firms. BS 65000 is guidance and is named as such.
| Framework held | Controls | Why it matters to this buyer |
|---|---|---|
| FCA and PRA Operational Resilience Framework | 22 | The UK operational resilience regime for financial firms. It requires important business services, impact tolerances and testing, which map directly to the impact analysis and exercise processes. |
| BS 65000:2014, Guidance on Organizational Resilience | 4 | The British guidance on organizational resilience. It gives the wider resilience context in which a BCMS sits. |
Australia
CPS 230 is the prudential standard for regulated entities. The SOCI Act and the CIRMP Rules set the critical infrastructure duties and the reporting clock.
| Framework held | Controls | Why it matters to this buyer |
|---|---|---|
| APRA CPS 230 Operational Risk Management | 44 | The APRA prudential standard for operational risk, including business continuity and service provider management. It binds APRA-regulated entities. |
| Security of Critical Infrastructure Act 2018 (SOCI) | 32 | The Commonwealth critical infrastructure regime, including cyber incident reporting and risk management duties for critical infrastructure assets. |
| Critical Infrastructure Risk Management Program (CIRMP) Rules 2023 | 41 | The rules that require a risk management program for critical infrastructure assets, with a named accountable entity and annual reporting. |