On 23 September 2025, ASIS International released the first ANSI-accredited Executive Protection Standard. For directors, general counsel, CFOs, and audit committee members, that sentence matters more than it sounds.
Until that release, there was no recognized industry standard for what a competent executive protection program actually contains. A board that wanted to ask "is our CEO security up to standard?" had no standard to point to. The answer was a vendor's word, a consultant's opinion, or — most often — a quiet assumption that the security team had it handled.
That gap is now closed. And once a recognized standard exists, the governance posture shifts: "we didn't know what good looked like" stops being a defensible answer.
This is the plain-English version of what the standard is, why it matters for corporate and finance principals, and what your board should do with it.
What the Standard Is
The ASIS Executive Protection Standard is a structured framework — accredited by the American National Standards Institute (ANSI) — that defines the program areas, processes, and management commitments an organization should have in place when it protects executives or other high-profile individuals.
It does not prescribe one model (armored car, three-agent detail, control room). It defines the program competencies an organization should be able to demonstrate, regardless of size, industry, or geography. Five areas:
- Leadership and Governance — clear ownership, reporting lines, and management commitment.
- Risk Assessment — a documented, current understanding of the threats facing each covered principal.
- Program Design — a written program covering routine operations, travel, events, residence, and crisis response.
- Operations and Resources — competent people, vetted vendors, and aligned insurance/legal/HR.
- Continuous Improvement — incidents reviewed, lessons learned, program updated, periodic third-party review.
If any of those five reads like the structure of a SOX-style controls framework or an ISO management system, that's not an accident — it's the family the EP standard now belongs to.
Why It Matters Right Now
Three reasons it landed on the boardroom agenda quickly.
The threat picture justifies it. Industry reporting through 2025 documented a roughly doubled volume of executive-targeting incidents year over year, including high-profile attacks on senior corporate principals. Boards have seen what an under-funded program looks like when it fails publicly.
The standard makes oversight tractable. Before September 2025, "are we doing enough?" was an opinion question. With an ANSI-accredited reference framework, it becomes a checklist question. A board can ask whether the program addresses each of the five areas, can request evidence, and can record that the question was asked and answered.
The legal posture changed the moment the standard published. Plaintiffs' counsel, regulators, and insurance underwriters all benchmark against recognized standards. Once a standard exists, the practical question in any post-incident proceeding becomes "did the organization meet it?" That is exactly the dynamic that played out in cybersecurity after NIST CSF and in financial controls after SOX. Executive protection is now in that lineage.
What This Means for Corporate and Finance Principals
For the CFO, the General Counsel, the Chief Audit Executive, and the directors of audit and risk committees, the ASIS standard is a tool — not another obligation. It gives a board a structured way to oversee a category of enterprise risk that previously had no good vocabulary.
Three practical implications:
Program conversations change. "Does our program demonstrate competence in each of the five ASIS program areas, scoped to our assessed risk?" If the answer is no, the program conversation follows from that gap analysis, not the other way around.
Insurance conversations change. Kidnap-and-ransom, business travel accident, and directors-and-officers underwriters increasingly ask about program structure. A program that can document its alignment to the ASIS standard sits in a different conversation with underwriters than one that cannot.
Disclosure conversations change. For public companies, the materiality question around executive-security risk has been quietly maturing. The existence of a recognized standard makes it easier — not harder — to argue that the company's risk-factor disclosures and ERM processes are appropriately mature. The companies that benchmark against the standard now will be better positioned in that disclosure conversation than the ones that wait.
Five Questions to Ask in the Next Meeting
These are the questions the audit committee or risk committee should be asking in its next session, with the corporate security lead and the CFO in the room.
- Have we benchmarked our executive protection program against the ASIS Executive Protection Standard (September 2025)? If yes, what did the gap analysis show? If no, when will we?
- Do we have a current, documented threat and vulnerability assessment for each named executive officer — refreshed at least annually and after any material change in role, public profile, or company event?
- Who owns the executive protection program, to whom does that person report, and does this committee receive a substantive written briefing at least annually?
- Are our insurance coverages — kidnap-and-ransom, business travel accident, key-person, D&O — aligned with the program as actually operated, and have the policy conditions been confirmed by counsel?
- What is our coverage and response posture for predictable high-risk moments (earnings calls, layoffs, M&A, regulatory actions, contentious public statements, international travel)?
If the answers are crisp and evidenced, the program is in a defensible posture. If they are not, the committee now has a clear next step.
What AMERINE Sees, Practically
In the months since the standard was published, three patterns have emerged in conversations with corporate clients.
First, the biggest gap is rarely operational — it is documentation and governance. Many programs are operationally competent but have no written charter, no current written risk assessment, and no record of board-level briefing. Closing those gaps dramatically improves the defensibility of the program.
Second, the second-biggest gap is family and household scope. Programs designed around the principal's office and travel often have nothing to say about the spouse, children, household staff, or residential security — even when the threat picture clearly includes them. The ASIS standard pushes that scope conversation into the open.
Third, mid-cap and pre-IPO companies are over-represented in the "no program at all" category. The ASIS standard makes the absence of a program more visible — and harder to defend. We expect this to drive a wave of program stand-ups across the mid-market in 2026.
The Bottom Line
The ASIS Executive Protection Standard is the first time a board has had a recognized framework to point to when it asks whether its CEO security program is up to standard. That changes the oversight conversation, the insurance conversation, and — in due course — the disclosure conversation.
The companies that benchmark against the standard now are not chasing a regulatory deadline. They are getting out in front of one.
If your organization has not yet done a structured comparison of its program to the ASIS standard, contact AMERINE for a confidential gap analysis. We work with boards, audit committees, general counsel, and CFOs — and the deliverable is built for that audience, not for a security operations center.
Sources & Further Reading
- ASIS International — Executive Protection Standard. Standard overview and access. asisonline.org — Executive Protection Standard
- ASIS International — Press Release (23 September 2025). "ASIS International Introduces Groundbreaking Executive Protection Standard." asisonline.org press room
- ASIS International — Introducing the ASIS Executive Protection Standard: 10 Things to Know. asisonline.org PDF
- SDM Magazine — ASIS International Introduces Executive Protection Standard. Independent industry coverage of the release. sdmmag.com
- ANSI — American National Standards Institute. Accreditation body context. ansi.org
- Companion AMERINE article: [Executive Protection Is Now a Board-Level Governance Issue](/blog/executive-protection-board-level-governance-issue) — the broader governance framing of which this piece is the operational complement.
---
A note on terminology: ANSI accreditation applies to the ASIS Executive Protection Standard itself, which was developed through the ANSI consensus process. It is not a credential issued to security firms. AMERINE is not an "ANSI-accredited" or "ANSI-certified" provider — no such designation exists for EP firms — and uses the ASIS standard as a reference framework for program design and gap analysis.
General governance and security-planning commentary for directors and senior corporate officers. Not legal, accounting, or fiduciary advice; readers should consult counsel and qualified advisors regarding the specific application of these topics to their organization.
