BCI Good Practice Guidelines (GPG 7.0) Explained

Business continuity teams are often asked to "follow the BCI GPG" without being told which edition, which practices or how it relates to ISO 22301. The Good Practice Guidelines (GPG) are the Business Continuity Institute's guide to professional practice in business continuity, organised around six Professional Practices. This short explainer sets out what the BCI publishes about the current edition, how the six practices fit together, how the GPG sits next to ISO 22301, and how to use it without duplicating work. It is for continuity managers, resilience leads and security teams who share continuity duties. It is based only on the BCI's public pages, checked in November 2026, and does not reproduce the purchased guide.

Key takeaways

The current edition is GPG 7.0. The BCI reported that Edition 7.0 launched on 1 November 2023, and its GPG page still calls it the latest edition.
Six Professional Practices, two kinds. The BCI splits the six practices into two management practices and four technical practices.
Guidance, not requirements. ISO 22301:2019 sets the requirements for a business continuity management system (BCMS); the GPG gives practical methods that help meet them.
Access is by membership or purchase. Members download the PDF free; non-members buy a digital copy, and a free condensed GPG Lite edition is available.
It is reviewed every year. The BCI says the GPG will be reviewed annually, so record the edition you work to.

What the GPG is

The BCI describes GPG 7.0 as the latest edition of its global guide to good practice in business continuity, drawing on practitioners worldwide and on information in International Standards. It is written to apply to organisations of any size, sector or geography. The 7.0 edition replaced the earlier term "Business Continuity Management Lifecycle" with "Business Continuity Management System", which the BCI describes as more scalable and holistic, and which matches the language of ISO 22301.

The previous edition, GPG 2018, was released on 7 November 2017 at the BCI World Conference, according to CIR Magazine, which reported that its Analysis practice was aligned with ISO/TS 22317:2015 on business impact analysis. For the requirements side see the ISO 22301 Business Continuity Guide.

The six Professional Practices

The BCI renamed four of the six practices in Edition 7.0. The table lists the names as the BCI gives them. The BCI page does not state which two are the management practices; the stage descriptions below are a plain-language summary, not BCI text.

Practice	Edition 7.0 name	Previous name	What the stage is about
PP1	Establishing a Business Continuity Management System	Policy and Programme Management	Policy, scope, governance and roles for the BCMS
PP2	Embracing Business Continuity	Embedding Business Continuity	Building continuity into culture and business as usual
PP3	Analysis	Analysis	Understanding priorities and impacts, including business impact analysis
PP4	Solutions Design	Design	Choosing continuity solutions to meet those priorities
PP5	Enabling Solutions	Implementation	Putting solutions, plans and response structures in place
PP6	Validation	Validation	Confirming the BCMS meets its policy objectives through exercising, maintenance and review

The BCI has published detail on PP6. It says Validation confirms that the BCMS meets the objectives in the organisation's policy and supports awareness, exercising, maintenance and review programmes. Edition 7.0 revisions to PP6 include exercise considerations for supplier continuity arrangements, especially key suppliers, a virtual exercise option for remote participants, and post-incident review as a review method.

GPG and ISO 22301 compared

Question	BCI GPG 7.0	ISO 22301:2019
Type	Professional good-practice guidance	Requirements standard for a BCMS
Certification	None for organisations; the BCI runs individual credentials	Accredited organisational certification
Language	Six Professional Practices	Management system clauses
Access	Free to BCI members; £70 digital copy for non-members when checked; free Lite edition	Purchased standard
Update	Annual review stated by the BCI	ISO revision cycle

Use ISO 22301 when you need certification or a requirements baseline that auditors recognise. Use the GPG for the "how": methods for analysis, solution design and exercising that sit under those requirements. Individual BCI credentials are covered in the Business Continuity Certifications guide.

How to use the GPG in a programme

Get the right edition lawfully. Start with the free GPG Lite edition for orientation; members download the full PDF, non-members buy it. The BCI licence for the download is for the buyer's sole use and prohibits printing.
Set PP1 first. Agree policy, scope and governance before any analysis. Use the Business Continuity Policy Template.
Run analysis before buying solutions. Complete business impact analysis and risk assessment (PP3) before choosing recovery options (PP4).
Write plans from the chosen solutions. Build response structures and plans in PP5. See the Business Continuity Plan Template.
Exercise with suppliers. Include key suppliers in exercises and run post-incident reviews after real events, as the 7.0 Validation revisions describe.
Feed results back. Treat PP2 and PP6 as continuous: awareness, exercise findings and reviews drive the next cycle.

Small and large organisations

Small organisations: the BCI states the method applies to any size. A light PP1, one business impact analysis and an annual tabletop exercise give most of the value. The Lite edition may be enough to start.
Large or regulated organisations: anchor on ISO 22301 and sector rules, and use the full GPG as the method library for each site or business unit. See the Business Continuity and Disaster Recovery Guide for the IT recovery side.

Measuring the programme

Analysis coverage: share of in-scope activities with a current business impact analysis.
Exercise completion: planned exercises run per year, including those with key suppliers.
Action closure: percentage of exercise and post-incident actions closed by their due date.
Plan currency: plans reviewed within the agreed period.

Framework mapping

GPG practice	NIST CSF 2.0	NIST SP 800-53 Rev 5	ISO/IEC 27001:2022 Annex A
PP1 Establishing a BCMS	GV.PO-01, GV.RR-02	CP-2	5.29
PP3 Analysis	GV.OC-01, ID.RA-04	CP-2	5.30
PP4 and PP5 Solutions	PR.IR-03, ID.IM-04	CP-2, CP-10	5.30
PP6 Validation	ID.IM-02	CP-4	5.30

Common failure patterns

Quoting old practice names. Policies still cite "Policy and Programme Management" or the "BCM Lifecycle" after the move to Edition 7.0 terms.
Solutions before analysis. Recovery tooling is bought before impact analysis sets priorities.
Exercises that leave out suppliers. Key supplier arrangements are assumed rather than tested.
Claiming GPG certification. Organisations certify to ISO 22301; the GPG is guidance.
Sharing licensed copies. Circulating a purchased PDF breaches the sole-use licence.

Practitioner checklist

Confirm you are working to GPG Edition 7.0 and note the date checked.
Download the free GPG Lite edition for anyone new to the discipline.
Obtain the full guide through membership or purchase; do not share it.
Update policy and plan wording to Edition 7.0 practice names.
Complete impact analysis before selecting solutions.
Include key suppliers in at least one exercise a year.
Run a post-incident review after every significant disruption.
Map each practice to your ISO 22301 clauses if you certify.

BCI Good Practice Guidelines Explained: The six Professional Practices and how to use them