British standards, civil contingencies law, the FCA and PRA operational resilience rules, and the cyber resilience regime, with how ADVOX can help.
The UK adopts ISO 22301 as a British Standard, published by BSI. It is the main standard for a business continuity management system and the one UK organisations certify against. ISO 22313 gives guidance on putting it into practice.
ISO 22301 overviewBritish guidance on organisational resilience. It sets business continuity within a wider view of how an organisation anticipates, prepares for, responds to and adapts to change and disruption.
BSI ↗Category 1 responders, such as local authorities, emergency services and NHS bodies, must keep business continuity plans so they can carry on their functions in an emergency. Local authorities must also give business continuity advice to local businesses and voluntary organisations. The UK Government Resilience Framework (2022) sets the wider national approach.
Civil Contingencies Act on legislation.gov.uk ↗ UK Government Resilience Framework ↗In force since 31 March 2022, with firms required to stay within their impact tolerances from 31 March 2025. Firms must identify their important business services, set an impact tolerance for each, map the people, processes, technology, facilities, information and third parties behind them, test against severe but plausible scenarios, and complete a Board-approved self-assessment.
FCA PS21/3 ↗Rules published in March 2026 (FCA PS26/2, PRA PS7/26) create a single regime for reporting operational incidents and material third-party arrangements, starting in March 2027. Separately, the critical third parties regime (PS16/24) lets HM Treasury designate key suppliers to the sector, such as major cloud providers, for direct oversight. Firms remain responsible for their own resilience either way.
Bank of England: PRA ↗The NIS Regulations require operators of essential services, such as energy, transport, health and water, and relevant digital service providers to manage the security and resilience of their network and information systems. The Cyber Security and Resilience Bill, which will update them, was still before Parliament in November 2026. It would bring managed service providers and data centres into scope and add stricter incident reporting.
NIS Regulations on GOV.UK ↗ Bill on parliament.uk ↗BCI CBCI certification training and specialist courses in business continuity, incident response, crisis management and resilience.
Tailored awareness and role-based training for leadership, continuity teams, business owners and operational staff.
A structured review of your BCM programme against the central-bank or sector rules that apply to you, with a prioritised plan to close the gaps.
Scenario-based exercises, plan validation, programme reviews, maturity assessments and continual-improvement support.
Business continuity standards, central-bank rules and other regulatory requirements for the countries ADVOX supports.