ABC CP key terms

The capability of an organization to continue delivering products or services at acceptable predefined levels following a disruptive incident. It is achieved through planning, preparation, and response arrangements rather than by preventing every incident.

A documented management system covering policy, objectives, processes, and governance that an organization uses to build, operate, monitor, and improve its continuity capability. It follows a continual improvement cycle and is subject to audit and management review.

A process that identifies activities supporting key products and services and quantifies the effect of disruption over time. It establishes recovery priorities, maximum tolerable outage, and minimum resource requirements that later drive strategy selection.

The longest duration an organization can tolerate the loss of a particular activity before its viability or stakeholder obligations are unacceptably harmed. It is set by senior management and acts as the outer limit for recovery planning.

The target duration within which a business process, resource, or system must be restored after a disruption. It is set below the maximum tolerable period of disruption and is used to design and test recovery solutions.

The maximum amount of data loss, measured in time, that an organization is willing to accept after an incident. It guides backup frequency and replication design for information systems supporting critical activities.

A process or function whose disruption would quickly cause unacceptable harm to the organization, its stakeholders, or its obligations. Critical activities are identified in the business impact analysis and receive priority for recovery resources.

A time-sensitive business activity ranked by the urgency of its recovery, usually derived from impact analysis findings. Rankings determine the sequence in which resources and staff are restored during and after an incident.

A structured process of identifying threats and vulnerabilities, then evaluating the likelihood and consequences of disruption. Its outputs inform which risks are treated, transferred, avoided, or accepted within the continuity programme.

The selection and implementation of measures that modify identified risks, such as avoidance, reduction, transfer, or acceptance. In continuity work, treatment options are chosen after assessment and recorded in the management system.

The set of pre-selected arrangements an organization will use to protect prioritized activities and recover them within agreed objectives. Strategies may involve redundancy, relocation, outsourcing, or manual workarounds, and must be cost-justified.

Documented procedures that guide an organization's response to and recovery from a disruption, including roles, communications, and resource activation. Plans are validated through exercises and updated after changes or lessons learned.

The defined roles, authorities, and coordination arrangements activated when a disruptive event occurs. It clarifies who declares an incident, who leads recovery, and how teams communicate across the organization.

The planned processes for delivering timely, accurate, and consistent information to internal and external stakeholders during and after a disruption. It covers message ownership, approval, channels, and spokesperson arrangements.

A structured activity that tests continuity arrangements against realistic scenarios to validate plans, develop competence, and reveal gaps. Exercises range from discussion-based walkthroughs to full simulation and are followed by documented review.

The documented review of an exercise or actual incident that identifies what worked, what failed, and what must change. Findings feed corrective actions and updates to plans, strategies, and the management system.

The ongoing process of enhancing the continuity management system through monitoring, measurement, audit, corrective action, and management review. It keeps arrangements aligned with changing risks, operations, and stakeholder expectations.

Arrangements that protect the flow of goods and services from external providers whose failure could disrupt prioritized activities. It includes supplier assessment, contractual resilience requirements, and contingency sourcing options.

A reliance of a prioritized activity on a resource, supplier, system, person, or facility that must be available for the activity to function. Dependencies are mapped during analysis and addressed through strategy selection.

Any person or group with an interest in, or affected by, an organization's continuity performance, including customers, staff, regulators, suppliers, and owners. Their requirements shape objectives, priorities, and communication plans.

The documented boundaries of the continuity management system, specifying which parts of the organization, locations, products, and services are covered. A clear scope prevents gaps and supports consistent application of requirements.

A periodic, senior-level evaluation of the continuity management system to confirm its continuing suitability, adequacy, and effectiveness. It considers performance data, audit results, and changes, and produces decisions on improvement.

An independent, systematic examination of the continuity management system against defined criteria and the organization's own requirements. Results are reported to management and feed corrective action and improvement.

The demonstrated ability of a person to apply knowledge and skills to achieve intended continuity outcomes. It is built through education, training, experience, and assessment, and records are maintained as evidence.

Verified, relevant work performed in continuity or related disciplines that demonstrates practical application of knowledge over time. It is typically documented with roles, dates, and specific activities for certification review.

Ongoing learning and development activities that maintain and enhance a practitioner's knowledge and skills after initial certification. It is usually evidenced through documented hours, courses, events, and reflective records.

The formal standards of conduct that certificants agree to uphold, covering integrity, objectivity, confidentiality, and professional behaviour. Breaches may be investigated and can lead to sanctions against a certification.

The behaviour expected of a practitioner when serving clients, employers, and the public, including honesty, competence, and disclosure of conflicts of interest. It is judged against the certifying body's ethical requirements.

The obligation to protect sensitive organizational information obtained during continuity work and to limit its disclosure to authorized parties. It applies to impact analyses, plans, test results, and client information.

An organization that sets competence standards, assesses candidates, and awards and maintains a professional credential. It administers examinations, verifies experience, monitors continuing development, and enforces ethical standards.

The periodic requirements a certificant must satisfy to keep a credential valid, such as development hours, fees, and adherence to ethical standards. Failure to maintain requirements can result in suspension or withdrawal.

The predefined criteria a candidate must meet before sitting an examination or being awarded a credential, such as knowledge, experience, or training. They are verified by the certifying body before certification is granted.

The process of renewing a professional credential after a defined cycle by demonstrating continued competence and compliance with maintenance requirements. It may include development reporting, fees, and affirmation of ethical conduct.

A situation where a practitioner's personal, financial, or other interests could improperly influence professional judgement or advice. It must be disclosed and managed, often by withdrawal from the affected decision.

The reasonable care and investigation a practitioner performs before giving advice, accepting an engagement, or relying on third-party arrangements. It supports defensible recommendations and protects clients and the public.