ASIS and BEPP executive protection standards compared through scope, implementation, state regulation and professional competency

Two Executive Protection Standards: The Question Joe LaSorsa Asked

ASIS vs BEPP Executive Protection Standards: From Paper to Proof — Part 2 of 6

By Matthew C. Parker
Independent Security Advisors (ISA) | EPTraining.us

Abstract

In July 2026, executive protection professional Joe LaSorsa asked which standard the industry should follow: ASIS International’s 2025 Executive Protection Standard or BEPP’s ANSI/BEPP EPS-2026. The differences between the two publications were introduced in Part 1 of this series. This article examines what those differences mean for employers and protective-service providers deciding which requirements to adopt, how compliance can be established, the limits of ANSI approval, and the continuing authority of state regulators. It also briefly considers why adopted standards and procedures must be reviewed as operating conditions change.

Bottom Line Up Front

Neither ASIS nor BEPP should become the profession’s exclusive authority simply because it has published a standard. ASIS primarily addresses the establishment and management of executive protection programs. BEPP addresses the provision of protective services. Their requirements overlap, and both may be useful.

BEPP’s ANSI approval establishes that the applicable consensus-development procedures were satisfied. It does not constitute independent technical validation of every protective procedure. Employers should compare the actual requirements, determine which apply to their operations and establish how compliance will be measured.

The Question Joe LaSorsa Asked

On July 12, 2026, executive protection professional Joe LaSorsa published Choosing Between the ASIS and BEPP Executive Protection Standards. He asked which standard practitioners and organizations should follow now that two substantial publications were available.

ASIS International released its Executive Protection Standard on September 23, 2025. The Board of Executive Protection Professionals (BEPP) followed with ANSI/BEPP EPS-2026, approved as an American National Standard on June 8, 2026.

Joe recommended selecting a primary standard based on the client’s needs, applicable law, operating environment, risks and available resources. He also suggested examining the other standard for additional useful requirements.

I agree with that approach. An employer should not disregard a relevant provision simply because it was published by a different organization. However, I would take the comparison further. We need to establish precisely what each document requires, where those requirements overlap, whether any provisions conflict and how an organization can demonstrate compliance.

The question is not which publisher should control executive protection. It is which standards or policies will actually serve the protective agent or organization.

Professional Security Standards Did Not Begin in 2025

The executive protection industry had published standards addressing close protection and private-security operations long before ASIS released its 2025 standard or BEPP received ANSI approval in 2026.

The British Standards Institution published BS 8507-1:2008, addressing close protection services within the United Kingdom, and BS 8507-2:2009, covering services outside the United Kingdom. These codes address management, staffing, operational accountability and related responsibilities involved in providing close protection.

In September 2015, the International Organization for Standardization published ISO 18788:2015, Management System for Private Security Operations — Requirements with Guidance for Use. It establishes a management-system framework for organizations conducting or contracting private-security operations, including risk management, legal responsibilities, accountability and continuing improvement.

These publications are not identical to ASIS or BEPP and should not be treated as substitutes without examining their scope and requirements. They do, however, establish that private-security and close-protection standards existed well before the current American debate.

That history raises a relevant question: What specific requirements have ASIS and BEPP added, improved or adapted for American executive protection operations?

The value of a new standard should be measured by its contribution, not by an implication that meaningful professional standards did not previously exist.

Sources: BS 8507-1:2008 | BS 8507-2:2009 | ISO 18788:2015

ANSI Approval Does Not Choose the Winner

ANSI’s Board of Standards Review expressly states that it does not evaluate the technical content of standards. That distinction is critical, and there is also a significant difference between the ANSI recognition associated with ASIS and BEPP.

ASIS International is an ANSI-accredited standards-development organization, meaning ASIS’s accreditation does not automatically make every standard it publishes an American National Standard.

While BEPP’s EPS-2026 received approval as an ANSI American National Standard, we need to understand what that approval actually means. Basically, ANSI recognizes that BEPP followed its rules for developing the standard.

These are different forms of recognition, and BEPP’s approval does not establish that its operational requirements are technically superior to ASIS.

Something else to remember: the actual technical content of the standards remains the responsibility of BEPP and ASIS, the standards developers, and the participants who write and approve them. A committee may conduct extensive technical review, but the ANSI designation does not independently establish that a particular protective standard or procedure has been field-tested or demonstrated to improve operational performance.

What does that mean? Well, consider a standard that establishes procedures for conducting a protective advance, moving a principal through a crowd or responding to an emergency. The members of a committee will submit their opinions on what right looks like, review those methods and procedures, debate them and agree on what they determine represents acceptable professional practice. That is the standards-development process.

But expert consensus, however valuable, does not ensure that a procedure will produce the intended result in the field.

We need evidence from practical application and testing. Can qualified agents consistently perform the procedures? Are they effective with different protective teams, clients and operating environments? Do they improve security, or do they introduce problems that were not anticipated?

BEPP reports that more than 280 contributors participated on its committees in developing EPS-2026. Their experience is relevant, but the number of contributors does not independently establish the effectiveness of a standard or operational requirement.

Members of those committees may have government protective experience, which can also be extremely valuable, although privately employed agents may not possess the same authority, staffing or resources as their government counterparts. Those differences matter when deciding whether a requirement is appropriate for private protective operations.

Source: ANSI — Board of Standards Review

ASIS and BEPP: Different Purposes, Overlapping Requirements

The ASIS Executive Protection Standard establishes minimum criteria for developing, implementing, operating and maintaining executive protection programs using risk-management principles. Its focus includes organizational responsibilities, program planning, protective operations and continuing management.

BEPP’s Standard for Providing Executive Protection addresses the provision of protective services. Its published description includes threat assessment, risk mitigation, protective movements, advance procedures, transportation, contingency planning and professional responsibilities.

These are different approaches to many of the same subjects. ASIS addresses how an organization establishes and manages its program, while BEPP provides a framework for delivering protective services. But ASIS also addresses operational responsibilities, and BEPP includes matters associated with planning and management.

An employer should not assume that the two standards are interchangeable or that one automatically replaces the other.

Consider a protective advance. A company managing an executive protection program must determine when an advance is required, who will conduct it, what procedures apply, what information must be collected and how findings will influence the protective plan. The agent assigned to perform the advance must be capable of carrying it out and providing information the protective team can use. These are related responsibilities, but they involve different people and different expectations.

Both organizational management and operational performance are involved. The same issue arises with emergency procedures. An organization must establish its emergency responsibilities, communications and plans, while individual agents must understand their assignments and be prepared to carry out their duties.

A company could have excellent written procedures but poorly prepared personnel. Another might employ experienced agents while having inadequate program management, documentation or supervision. Neither situation is satisfactory, and both management and operational responsibilities need to be addressed.

We must also recognize differences in the size and resources of protective organizations. A large corporate security department may have dedicated protective-intelligence personnel, transportation specialists, medical support and management staff. A small private-family detail may rely on a handful of agents performing several responsibilities.

A requirement appropriate for one organization may need to be applied differently by another, particularly when government procedures are considered for private-sector assignments.

This is why Joe LaSorsa’s recommendation to consider the client’s needs, operating environment and available resources is important. The objective is not to make every protective organization operate identically. It is to establish appropriate requirements and determine whether the organization and its personnel can meet them.

When comparing ASIS and BEPP, we should examine the specific provisions governing these responsibilities and determine whether they complement each other or establish different expectations. A standards comparison should identify what an employer is being asked to implement and what the agent needs to be able to perform, not simply count the number of subjects covered by each publication.

Which BEPP Provisions Are Required to Meet the Standards?

BEPP’s public-review procedures identify an important distinction between mandatory requirements and advisory material.

BEPP states that certain sections of its publication are excluded from the conformity requirements of the ANSI American National Standard. Those sections include the cover, notices and disclaimer, foreword, glossary and appendix. BEPP explains that excluded material may provide additional information or best-practice recommendations and may not have undergone the same public-review and consensus procedures.

That distinction matters to employers adopting EPS-2026.

A recommendation may be useful without being mandatory for conformity with the standard. An employer may choose to incorporate it into company policy, but that does not automatically make it a requirement for conformity with EPS-2026.

The applicable provisions must be identified before a company represents that its protective services comply with the standard.

I have questioned whether portions of BEPP’s publication would be more appropriate in a professional reference manual than a standards document. Professional guidance has value, but it should be distinguishable from requirements that an organization must satisfy.

The same examination should be applied to ASIS. Employers need to know what is required, what is recommended and what evidence demonstrates compliance.

Source: BEPP — Public Review and Comment

What NIST Says About Effective Standards

The National Institute of Standards and Technology (NIST) is a federal agency within the U.S. Department of Commerce. Its responsibilities include supporting and coordinating federal activities involving voluntary consensus standards and conformity assessment.

In February 2012, NIST presented congressional testimony identifying principles of effective standards development. These included transparency, broad participation, relevance to actual needs, consistency with existing standards, responsiveness to technological developments and benefits that justify adoption.

These principles are directly applicable when examining ASIS and BEPP.

Where both publications address the same protective responsibility, are their provisions consistent or conflicting? Do they establish requirements appropriate for the private-sector environment? Are those requirements capable of responding to changes in threats, technology and protective practices? Can employers determine whether implementation produces the intended result?

NIST does not endorse either executive protection standard. Its guidance provides an established federal reference for examining standards beyond their organizational affiliations and approval designations.

Source: NIST — Principles for Effective Domestic and International Standards Development, February 29, 2012

An Employer Should Know What It Is Agreeing to Follow

A company can announce that it follows ASIS, BEPP or both, but that announcement tells us very little about what the company has actually done. Has it examined the publications and adopted their applicable requirements? Has it established policies and procedures based on those requirements, assigned responsibility for carrying them out and determined how compliance will be evaluated? Or has someone decided that identifying the company with a recognized professional standard would be useful for marketing?

I would expect a company claiming compliance with a standard to identify the applicable requirements and maintain evidence that they are being followed. That becomes particularly important when standards are incorporated into contracts.

Consider an executive protection contractor submitting a proposal to provide services for a corporate client. The contractor states that its services comply with ANSI/BEPP EPS-2026, and the client may reasonably expect the contractor to meet the applicable requirements of that publication. Before making such a commitment, the contractor should understand which provisions are required for conformity, which are advisory and how the requirements apply to the personnel and services being provided.

The same applies when a corporation adopts ASIS for its internal executive protection program. Simply naming the standard in company policy does not establish that the program has been reviewed or brought into compliance. The organization should be able to explain what it has adopted, how those requirements are implemented and who is responsible for verifying that they are being met.

An employer may review both publications and incorporate selected requirements into its protective operations. That is different from representing that the organization complies with an entire standard. A company claiming conformity with ASIS or EPS-2026 should identify the applicable requirements, establish procedures for meeting them and maintain evidence that those procedures are followed.

That obligation becomes especially important when a protective-services contractor includes a standard in its agreement with a client. The contractor must understand what it has promised to provide. The client should understand which edition and requirements apply. Advisory material, additional company policies and contractual obligations should not be confused with the requirements of the published standard.

Examining the requirements before adopting them may also identify provisions that conflict with applicable law, existing contractual responsibilities or the operating conditions of an assignment. Those problems should be resolved before the company promises compliance, not discovered after a dispute or protective incident.

Nor does adopting either publication replace government regulation.

State laws determine licensing and registration requirements for regulated protective services. Virginia, for example, regulates Personal Protection Specialists through its Department of Criminal Justice Services. A private professional standard cannot authorize an individual to perform work that requires a government license or registration.

An employer must therefore satisfy applicable law and determine which additional professional requirements are appropriate for its operations.

A professional standard is not something an employer should merely claim to follow. It is something the employer must understand, implement and be prepared to demonstrate that it meets.

Standards Must Keep Pace with Changing Conditions

Even a well-developed standard or protective policy can become outdated as threats, technology and operating conditions change. A September 3, 2026 Government Accountability Office report found that eight of the Secret Service’s 22 protective policies had not been reviewed or updated within the required four-year period. GAO also identified earlier drone-related incidents that had not resulted in certain policy updates. These findings concern federal protective policies, not deficiencies established in either ASIS or BEPP. They illustrate why organizations adopting professional standards must periodically examine whether their procedures remain appropriate and make changes when necessary.

Source: U.S. Government Accountability Office — GAO-26-108455, September 3, 2026

What Should Professional Standards Cost?

The cost of obtaining a standard is relevant when the publication is intended for widespread professional use.

As of October 2026, BEPP advertises its printed ANSI/BEPP EPS-2026 standard for $595, plus $25 domestic shipping within the continental United States. ASIS lists its Executive Protection Standard in print for $90 to nonmembers and $45 to members. ASIS also offers its electronic edition to members without an additional charge.

These prices do not establish the technical quality of either publication, but they affect accessibility.

The October 2011 report Federal Engagement in Standards Activities to Address National Priorities, prepared by the National Science and Technology Council’s Subcommittee on Standards with NIST involvement, addressed both participation costs and access to published standards.

It stated that standards development should not impose undue financial barriers to participation. It also called for published standards to be reasonably accessible, while recognizing that monetary compensation may be appropriate.

That guidance does not require ASIS or BEPP to distribute their publications free of charge. It does provide a legitimate federal policy reference for examining whether the cost of a standard creates an unnecessary obstacle to its use.

I believe foundational executive protection standards should be available free of charge to individual practitioners and students. Educational institutions and training schools could reasonably pay licensing fees for permission to reproduce and distribute the material. Publishers could continue selling optional printed editions and other professional resources.

A standard intended to establish expectations throughout an occupation should be reasonably accessible to the people expected to follow it.

The broader issues of publication costs, accessibility and professional adoption are examined in my separate article, If Standards Matter, Who Gets to Read Them?.

Sources: Federal Engagement in Standards Activities to Address National Priorities, October 2011 | BEPP Printed Standard | ASIS Executive Protection Standard

Answering Joe LaSorsa’s Question

Joe LaSorsa asked which executive protection standard the profession should follow. I would not recommend treating either publication as the exclusive professional authority.

ASIS establishes requirements primarily concerned with creating and managing executive protection programs. BEPP addresses the provision of protective services and includes operational requirements and professional guidance. The publications overlap, but their stated purposes are not identical.

An organization establishing a corporate executive protection program may reasonably choose ASIS as its principal management framework. A protective-services provider may find BEPP particularly relevant to its operational responsibilities. Either should examine the other publication for requirements appropriate to its assignments.

But an employer should not claim compliance with either standard without examining its actual requirements and determining how compliance will be demonstrated.

The profession would benefit from a clause-by-clause comparison of the two final publications. That comparison should identify overlapping requirements, substantive differences, possible conflicts and the evidence needed to establish conformity.

I have not completed that full technical crosswalk, and I will not claim that either publication is technically superior without it.

ANSI recognition, professional reputations and contributor numbers are relevant to understanding how standards were developed. They do not replace examination of the requirements.

My answer to Joe’s question is that employers should adopt the requirements appropriate to their protective responsibilities, comply with the law and be able to demonstrate that those requirements are being met.

Neither organization needs exclusive control over executive protection for the profession to benefit from its work.

There is another question, however, that organizational and operational standards do not resolve simply by being published: How do we determine whether an individual executive protection agent possesses the competencies required to perform the assigned work?

That question leads to Part 3 of this series.

Next: Executive Protection Competency Survey: The Odd Man Out

Frequently Asked Questions

Which executive protection standard should employers follow, ASIS or BEPP?

Employers should select requirements appropriate to their responsibilities, operating environment and applicable law. ASIS focuses principally on executive protection program management, while BEPP addresses the provision of protective services. Both may provide relevant requirements.

Does ANSI approval make BEPP technically superior to ASIS?

No. ANSI approval establishes compliance with applicable standards-development procedures. ANSI’s Board of Standards Review does not independently evaluate technical content or operational effectiveness.

Is ASIS an ANSI-accredited standards-development organization?

Yes. ASIS is an ANSI-accredited standards-development organization. That accreditation is distinct from approval of an individual publication as an American National Standard.

Are all provisions in BEPP EPS-2026 required to meet the standard?

No. BEPP identifies sections excluded from the conformity requirements, including its foreword, glossary and appendix. Employers should distinguish requirements for conformity with the standard from advisory information.

Did close-protection standards exist before ASIS and BEPP?

Yes. The British Standards Institution published BS 8507-1 in 2008 and BS 8507-2 in 2009. ISO published ISO 18788 in 2015, addressing private-security operations management. These publications have different scopes but predate the current American executive protection standards.

Did the September 2026 GAO report endorse BEPP?

No. GAO interviewed BEPP as one of ten organizations involved in its examination of protective practices. The report did not approve EPS-2026, endorse BEPP over ASIS or make either publication a federal requirement.

Can a company adopt both ASIS and BEPP?

Yes. An organization may adopt compatible requirements from both publications. It should determine which provisions apply and resolve conflicts before representing that it complies with either standard.

Do ASIS or BEPP standards replace state licensing?

No. State regulators retain authority over licensing and registration requirements. Private professional standards may supplement those requirements but cannot independently authorize regulated protective work.

Does NIST require professional standards to be free?

No. Federal standards guidance calls for reasonable access while recognizing that payment may be appropriate. ISA advocates free access for individual practitioners and students as a professional policy, not a federal requirement.

What should an employer examine before claiming compliance?

The employer should identify the applicable requirements, determine who is responsible for implementing them, establish procedures for meeting them and maintain appropriate evidence of conformity. Contractual obligations and applicable law must also be considered.

About the Author

Matthew C. Parker is Chief Executive Officer of Independent Security Advisors LLC (ISA) and Director of Training for EPTraining.us. His professional experience spans more than three decades of military service, executive and dignitary protection operations and training, international security advising, and protective program development.

Before retiring from the U.S. Army in 2011, Parker conducted protective operations involving senior U.S. military leaders, trained U.S. and Iraqi protective-security personnel, managed military instructional programs and taught military science at Virginia Tech.

Since establishing ISA in 2011, he has directed executive protection operations in the United States for international government officials and trade delegations, provided protective services for corporate and private clients, and developed protective programs for financial institutions, insurance companies and private families.

His international experience includes security-advisory and protective assignments in Ukraine, training for Ukrainian police and Judicial Protection Service personnel, and advisory work concerning international commerce, diplomatic protection and democracy-support initiatives.