BCB-PMD flashcards
BCB-PMD · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Business Impact Analysis
- A process that identifies critical business activities and quantifies the operational and financial impact of their disruption over time, producing RTO, RPO, and MTD values.
- Recovery Time Objective
- The maximum acceptable time to restore a process, system, or resource after a disruption, derived from the BIA and used to select recovery strategies.
- Recovery Point Objective
- The maximum tolerable amount of data loss measured in time, which determines backup frequency and replication design for a system or process.
- Maximum Tolerable Downtime
- The total time a business activity can be unavailable before its impact becomes unacceptable to the organization, customers, or regulators.
- Risk Treatment Options
- Four standard responses to identified risk: mitigate by reducing likelihood or impact, transfer via insurance or contract, avoid by eliminating the activity, or accept with documented approval.
- Business Continuity Policy
- A top-management-approved statement defining the organization's commitment, scope, objectives, and responsibilities for business continuity, authorizing the BCMS.
- BCMS Scope Statement
- A documented definition of the organizational units, products, services, locations, and exclusions covered by the business continuity management system, with justification for exclusions.
- Plan-Do-Check-Act
- The continuous improvement cycle underlying ISO 22301: establish BCMS (Plan), implement and operate (Do), monitor and review (Check), and maintain and improve (Act).
- RACI Matrix
- A responsibility assignment tool that labels each BC activity as Responsible, Accountable, Consulted, or Informed to clarify ownership across the program.
- Hot Site
- A fully equipped alternate facility with redundant systems, data, and network connectivity that enables near-immediate recovery, typically for the shortest RTOs.
- Warm Site
- A partially equipped alternate facility with some hardware and connectivity but requiring configuration and data restoration, supporting recovery in hours to days.
- Cold Site
- An alternate facility providing only space, power, and basic infrastructure, requiring full equipment and data setup, suited to longer RTOs of days to weeks.
- Synchronous Replication
- A data protection method that writes to primary and secondary storage simultaneously, achieving near-zero RPO at the cost of latency and bandwidth.
- Asynchronous Replication
- A data protection method that transmits changes to a secondary site with a delay, producing a small RPO measured in minutes while tolerating distance and network constraints.
- Recovery Sequencing
- The documented order in which systems, data, facilities, and people are restored, respecting dependencies so that foundational services recover before dependent processes.
- Plan Activation Criteria
- Pre-defined thresholds such as facility unavailability beyond a set duration or system outage exceeding its RTO, which trigger invocation of the continuity plan without debate.
- Crisis Management Team
- A cross-functional group led by a designated crisis leader, including operations, communications, legal, HR, and IT, responsible for strategic decisions during a disruption.
- Incident Command System
- A scalable command structure separating command, operations, planning, logistics, and finance functions to coordinate emergency response across multiple responding teams.
- Crisis Communications Plan
- A documented approach naming spokespersons, pre-approved holding statements, stakeholder channels, and update cadence for communicating during a crisis.
- Tabletop Exercise
- A discussion-based exercise where participants walk through a scenario and their plan responses to test decision-making, roles, and coordination without live systems.
- After-Action Report
- A written exercise or incident evaluation documenting objectives, observations, strengths, gaps, and corrective actions with owners and due dates.
- Functional Drill
- An exercise that tests specific capabilities, such as notification systems or alternate site connectivity, in a controlled setting short of full-scale simulation.
- Corrective Action Program
- A tracked process for recording exercise and audit findings, assigning owners and deadlines, verifying closure, and reporting status to management.
- Management Review
- A planned top-management evaluation of BCMS performance, audit results, risks, and improvement opportunities that produces decisions on resources and priorities.
- BCM Maturity Model
- A staged framework rating the continuity program from ad hoc through defined, managed, and optimized levels to benchmark capability and guide investment.
- Key Performance Indicator
- A quantifiable measure tied to BC objectives, such as exercise completion rate or corrective action closure percentage, used to monitor program effectiveness.
- Residual Risk
- The risk remaining after treatment controls are applied, which must be documented and formally accepted by the accountable risk owner.
- Single Point of Failure
- A component, supplier, or dependency whose failure alone can disrupt a critical process, identified during dependency mapping and targeted for redundancy.
- Mutual Aid Agreement
- A formal arrangement between organizations to share facilities, equipment, or personnel during a disruption, providing a low-cost recovery option with coordination risks.
- Conflict of Interest
- A situation where professional judgment could be influenced by personal or financial interests, requiring disclosure and recusal under ethical codes.
- Third-Party Governance
- Oversight of suppliers and partners through due diligence, contractual BC clauses, right-to-audit provisions, and periodic assurance reviews.
- Internal Audit Independence
- The principle that audit functions evaluating the BCMS report outside program management to preserve objectivity and avoid self-assessment bias.