Professional Documents
Culture Documents
Self-Assessment: Checklist
Self-Assessment: Checklist
PREPAREDNESS, LLC
Telephone 781.784.0672
https://preparednessllc.com | [email protected]
© 2019 Preparedness, LLC All Rights Reserved
Introduction
Background
This checklist was prepared by Donald L. Schmidt, ARM, CBCP, MCP, CBCLA, CEM®, CEO of Preparedness, LLC and Past
Chair of NFPA’s Technical Committee on Emergency Management and Business Continuity, which is responsible for NFPA
1600, “Standard on Continuity, Emergency, and Crisis Management.” He lead the technical committee during the
development of the 2010, 2013, and 2016 editions. He is the editor of “Implementing NFPA 1600 National Preparedness
Standard,” which was published by the National Fire Protection
Mr. Schmidt co-developed DRI International’s Certified Business Continuity Auditor and Lead Auditor professional
certification course (CBCA or CBCLA) for auditors of emergency management and business continuity programs. The
course, which he also instructs, is accredited by the American National Standards Institute for auditors of the certifying
bodies evaluating private sector preparedness programs under “PS-Prep™.” Mr. Schmidt is past instructor of NFPA’s
two-day course on NFPA 1600, Visiting Full Professor in the Master of Science in Emergency Management program at
Massachusetts Maritime Academy, and contract instructor for Massachusetts Emergency Management Agency.
This tool is based on the 2019 edition of NFPA 1600 “Standard on Continuity, Emergency, and Crisis Management”
published by the National Fire Protection Association and available online for free download at www.nfpa.org/1600. This
checklist is not “official,” and it was not developed in conjunction with NFPA. The only “official” self-assessment
checklist is contained within Annex B “Self-Assessment for Conformity with NFPA 1600, 2019 Edition.” By committee
decision, Annex B was limited to text from the standard. This checklist, which is aligned closely with NFPA 1600,
provides detailed criteria to evaluate a preparedness program.
NFPA 1600, an American National Standard, has been adopted by U.S. Department of Homeland Security (DHS). It has
also been designated by the DHS/Federal Emergency Management Agency for use as criteria for the certification of
private sector preparedness programs under “PS-Prep™.”
Instructions for Use
Users of this checklist should assemble a team with the required knowledge of the entity’s vision, mission, goals and
objectives, facilities, operations, products, services, hazards, resources, policies, plans, procedures, and other program
elements covered by NFPA 1600. Appropriate expertise is needed to understand each question posed within this
checklist and properly evaluate the entity’s preparedness efforts. The author provides no guarantee or warrantee that
use of this checklist will ensure conformity with NFPA 1600, the PS-PREP program, or any other requirement—legal or
otherwise.
If you have questions regarding NFPA 1600 or your preparedness program, please call us (781.784.0672) or email us
([email protected]). We develop, evaluate, and help implement emergency management, business continuity,
and crisis management programs using NFPA 1600. We also develop and deliver educational programs and design and
facilitate exercises.
Additional information on NFPA 1600 can be found on the “NFPA 1600” page of the Preparedness, LLC website. Links to
numerous documents that can help with the development of your preparedness program can be found on the “Links to
Program Resources” page of the Preparedness, LLC website [https://preparednessllc.com].
All questions are written so that a conforming response would be answered “Yes.” Any answer marked “No” or
“Unknown” would indicate a nonconforming response or an area requiring further study. The check boxes are arranged
so that you can quickly scan down the page to see the “No” or “Unknown” which are aligned closest to the right margin.
Self-Assessment Checklist Contents
Note: Numbering begins with 4 to coincide with the chapter numbering in NFPA 1600-2019.
Note: Numbering begins with 4 to coincide with the chapter numbering in NFPA 1600-2019.
4. Program Management
4.3.3. Does the Program Committee have a charter endorsed that defines
its role for providing input or assisting with the development,
implementation, evaluation, and revision of the program? ........... Yes No Unknown
4.3.4. Does the Program Committee include knowledgeable
representation from all functions and departments of the entity? . Yes No Unknown
4.3.4.1. Management
4.3.4.2. Finance
4.3.4.3. Operations (manufacturing and service delivery)
4.3.4.4. Facilities
4.3.4.5. Engineering
4.3.4.6. Purchasing/Supply Chain/Logistics
4.3.4.7. Sales & Marketing/Customer Service
4.3.4.8. Information Technology
4.3.4.9. Human Resources
4.3.4.10. Legal
4.3.4.11. Communications or Public Affairs
4.3.4.12. Environmental, Health & Safety
4.3.4.13. Security
4.3.4.14. Risk Management or Insurance
4.3.4.15. Labor Relations
4.3.4.16. Collective bargaining representative
4.3.5. Do all members of the Program Committee participate regularly in
committee activities? ..................................................................... Yes No Unknown
4.3.6. Has the committee solicited “external” representatives or
consulted with the following? ......................................................... Yes No Unknown
4.3.6.1. Law Enforcement
4.3.6.2. Fire department
4.3.6.3. Emergency Medical Services
4.3.6.4. Rescue service
4.3.6.5. Public Health
4.3.6.6. Emergency Management Agency or Homeland Security
4.3.6.7. Local Emergency Planning Committee
4.3.6.8. Environmental authorities
4.3.6.9. Contractors
4.3.6.10. Vendors & Suppliers
4.3.6.11. Infrastructure providers (utilities, telecommunications, etc.)
4.3.6.12. Key customers
E MERGENCY M ANAGEMENT , B USINESS C ONTINUITY & C RISIS M ANAGEMENT P ROGRAM E VALUATION 3
4.5.4. Has the entity implemented a strategy for addressing the need for
revisions to laws, regulations, standards, and industry codes of
practice? ......................................................................................... Yes No Unknown
5. Planning
5.1.2. Have the entity's vision, mission, and goals been incorporated into
the objectives of the program? ....................................................... Yes No Unknown
5.1.3. Does the entity have a crisis management plan that addresses
issues that could have the potential to severely impact the entity’s
operations, reputation, market share, ability to do business, and
relationships with key stakeholders? ............................................. Yes No Unknown
5.1.4. Does the planning process ensure that prevention, mitigation,
emergency operations/response, business continuity, crisis
communications, and crisis management plans are sufficiently
integrated? ..................................................................................... Yes No Unknown
5.1.5. In there a process to involve interested stakeholders where
applicable? ..................................................................................... Yes No Unknown
5.2.8. Were the following hazards evaluated during the risk assessment?
........................................................................................................ Yes No Unknown
5.2.8.1. Natural hazards (geological, meteorological, and biological)
5.2.8.2. Human-caused events (accidental and intentional)
5.2.8.3. Technology caused event
For an expanded list of potential hazards and threats, review NFPA 1600-2019, 5.2.2.1.
5.2.9. Has the frequency or probability of occurrence for all hazards been
estimated or quantified, where possible? ...................................... Yes No Unknown
5.2.10. Have the vulnerabilities of people, property, operations, the
environment, and the entity been identified and evaluated? ......... Yes No Unknown
5.2.11. Are the vulnerabilities of people, property, operations, the
environment, and the entity monitored on an ongoing basis? ....... Yes No Unknown
5.2.12. Have the potential impacts of hazards on the following been
analyzed and quantified? ............................................................... Yes No Unknown
5.2.12.1. Health and safety employees and visitors on-site
5.2.12.2. Health and safety of the community surrounding each facility
5.2.12.3. Health and safety of emergency responders
5.2.12.4. Buildings, facilities, and supporting infrastructure
5.2.12.5. Loss, corruption, or disruption to vital records, critical information,
information technology, and connectivity
5.2.12.6. Business operations (e.g., production, service delivery, etc.)
5.2.12.7. Supply chain
5.2.12.8. Environment
5.2.12.9. Work and labor arrangements
5.2.12.10. Regulatory and contractual obligations
5.2.12.11. Financial condition of the entity
5.2.12.12. Reputation and image of the entity
5.2.13. Have the potential effects of regional, national, or international
incidents that could have cascading impacts been identified? ........ Yes No Unknown
5.2.14. Is the risk assessment documented and communicated to the
program committee, program coordinator, and senior
management? ................................................................................. Yes No Unknown
5.2.15. Has the adequacy of existing prevention and mitigation strategies
been evaluated as part of the risk assessment? ............................ Yes No Unknown
5.4.13. Have all mutual aid and partnership arrangements been reviewed
by legal counsel and others with responsibility for review of
contracts? ....................................................................................... Yes No Unknown
5.4.14. Are the resources available from mutual aid and partnership
arrangements agreements documented in program plans? ........... Yes No Unknown
5.4.15. Are the facilities capable of supporting response, continuity, and
recovery operations been identified? ............................................. Yes No Unknown
6. Implementation
6.1.5. Are the lines of succession clearly defined? ................................... Yes No Unknown
6.1.6. Are Liaisons to external entities clearly defined? .......................... Yes No Unknown
6.1.7. Are resource and logistical requirements defined in each plan? .... Yes No Unknown
6.1.8. Are plans accessible during emergencies when buildings may be
inaccessible or uninhabitable? ....................................................... Yes No Unknown
6.1.9. Does each plan specify when and who has authority to activate the
plan? .............................................................................................. Yes No Unknown
6.1.10. Are there clearly defined thresholds to guide the notification and
escalation sequence for emergency response, business continuity,
crisis management, and recovery activities? ................................. Yes No Unknown
6.1.11. Are procedures established for communicating information and
coordinating decision making between the senior leadership team,
emergency response teams, business continuity teams, or
managers that might become involved in the incident? ................. Yes No Unknown
6.1.12. Have plans been distributed to or do those with defined
responsibilities in the plans have access to plans? ........................ Yes No Unknown
6.2. Prevention
6.2.1. Have prevention strategies been developed to prevent incidents
that threaten life, property, and the environment? ........................ Yes No Unknown
6.2.2. Is there an ongoing process of information collection and
intelligence techniques for developing threats and emerging
hazards to keep prevention strategies current? ............................ Yes No Unknown
6.2.3. Are prevention strategies based on the results of hazard
identification and risk assessment, an analysis of impacts,
program constraints, operational experience, and a cost- benefit
analysis? ........................................................................................ Yes No Unknown
6.2.4. Is there a process to monitor identified hazards and adjust the
level of preventive measures to be commensurate with the risk? . Yes No Unknown
6.3. Mitigation
6.3.1. Have mitigation strategies been documented in a plan that
includes measures to limit or control the consequences, extent, or
severity of an incident that cannot be prevented? ......................... Yes No Unknown
6.3.2. Do mitigation strategies include interim and long-term actions to
reduce vulnerabilities? ................................................................... Yes No Unknown
E MERGENCY M ANAGEMENT , B USINESS C ONTINUITY & C RISIS M ANAGEMENT P ROGRAM E VALUATION 11
6.7.13. Does the IMS include procedures for development and use of an
incident action plan or management by objectives to guide
response/recovery? ....................................................................... Yes No Unknown
6.7.14. Does the IMS include the following resource management tasks? . Yes No Unknown
6.7.14.1. Describing, inventorying, requesting, and tracking resources
6.7.14.2. Typing/categorizing resources by size, capacity, capability, and
skill
6.7.14.3. Mobilizing and demobilizing resources
6.7.14.4. Planning for resource deficiencies
6.7.14.5. Maintaining an inventory of internal and external resources
6.7.14.6. Managing donations of human resources, equipment, material, and
facilities
6.7.15. Is there a system to inventory, acknowledge, maintain, distribute,
retain, and return solicited or unsolicited donations including
goods, services, personnel, and facilities? ..................................... Yes No Unknown
6.7.16. Is this donations management system coordinated with public and
nonprofit organizations? ................................................................ Yes No Unknown
6.7.17. Do plans define the process for managing the flow of information
internally and externally? .............................................................. Yes No Unknown
6.7.18. Have criteria been established and procedures documented for
notification of governmental and regulatory authorities when
required by statute or regulation (e.g., notification of
environmental authorities for a hazardous materials spill or
notification of OSHA if a workplace fatality occurs.) ....................... Yes No Unknown
6.7.19. Have primary and alternate emergency operations centers (EOCs)
been established to support response and recovery efforts? ........ Yes No Unknown
6.7.20. Are the primary and alternate EOCs located or arranged so both
are not rendered inaccessible or unusable as a result of the same
incident? ......................................................................................... Yes No Unknown
6.7.21. Are EOCs property constructed, configured, equipped, staffed, and
supported to meet the needs of the entity to manage response and
recovery operations for an extended period? ................................ Yes No Unknown
6.7.22. Is the location of or access to [virtual] EOCs provided to all
emergency response, business continuity, and crisis management
teams and others who must have access? ...................................... Yes No Unknown
7. Execution
8.1. Curriculum
8.1.1. Has a training and educational curriculum been established to
support all who have a role in the program? ................................. Yes No Unknown
8.1.2. Does the curriculum address the needs of the following? .............. Yes No Unknown
8.1.2.1. Persons who may be impacted by hazards (i.e., hazard awareness
and protective actions training for all employees, contractors, and
visitors on-site)
8.1.2.2. Emergency response and business continuity teams
8.1.2.3. Crisis management team including senior management
8.1.2.4. Crisis communications team including all media spokesperson(s)
8.1.2.5. Others who support the program?
8.1.3. Is training provided for all employees to make them aware of
emergency response plans, business continuity procedures, vital
records protection, security, etc.? .................................................. Yes No Unknown
8.5. Recordkeeping
8.5.1. Are records of training and education maintained as required by
the entity’s records management program and in accordance with
regulatory requirements? .............................................................. Yes No Unknown
9.3.1.12. Assess the ability of the team to identify, assess, and manage an
incident
9.3.1.13. Practice the deployment of teams and resources to manage an
incident
9.3.1.14. Improve individual performance
9.3.2. Does the scope and frequency of exercises reflect the nature,
scale, and complexity of the entity; its operational environment;
and its exposure to hazards? ......................................................... Yes No Unknown
9.3.3. Are exercises crafted by competent persons experienced in the
design and conduct of exercises and knowledgeable in the policies,
plans, and procedures of the entity? .............................................. Yes No Unknown
9.3.4. Are exercise objectives clearly defined and documented? ............. Yes No Unknown
9.3.5. Are exercise assumptions adequately defined and aligned with the
exercise objectives? ....................................................................... Yes No Unknown
9.3.6. Are exercise scenarios realistic and customized to the entity’s
facilities, operations, and resources? ............................................. Yes No Unknown
9.5. Frequency
9.5.1. Are exercises and tests conducted on the frequency needed to
establish and maintain required capabilities? ................................ Yes No Unknown
9.5.2. Does the frequency of exercises reflect the nature, scale, and
complexity of the entity; its operational environment; and its
exposure to hazards? ..................................................................... Yes No Unknown
9.5.3. Are protective action drills (e.g., evacuation, shelter-in-place, and
lockdown) conducted at least annually or as frequently as required
by law? ........................................................................................... Yes No Unknown
E MERGENCY M ANAGEMENT , B USINESS C ONTINUITY & C RISIS M ANAGEMENT P ROGRAM E VALUATION 23
PREPAREDNESS, LLC
Telephone 781.784.0672
https://preparednessllc.com | [email protected]