BCB-PMD key terms

A documented framework of policies, roles, processes, and resources that an organization uses to build resilience and keep delivering priority products and services through disruption.

A top-level statement approved by senior leadership that defines the scope, objectives, authority, and commitment of the continuity program and the principles guiding recovery priorities.

The repeating sequence of program activities-analysis, strategy, plan development, validation, and review-that keeps continuity capability aligned with a changing organization and risk landscape.

The decision rights, oversight bodies, reporting lines, and accountability structures that direct the continuity program and ensure it meets legal, regulatory, and stakeholder expectations.

A senior executive who champions the continuity program, secures funding and staff, resolves cross-functional conflicts, and is accountable for the program's overall effectiveness.

A cross-functional oversight group of senior managers that reviews program progress, approves priorities and budgets, and removes obstacles spanning multiple business units.

A structured study that identifies priority activities, quantifies the operational and financial effects of their disruption over time, and sets recovery targets for each.

The process of identifying threats and vulnerabilities, estimating likelihood and consequence, and comparing results against tolerances to prioritize treatment decisions.

A maintained log recording each identified risk, its owner, assessed likelihood and impact, existing controls, planned treatments, and current status.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, which sets the threshold for when continuity treatment is required.

The selection and application of options-avoid, reduce, transfer, or accept-to bring a risk within tolerance, together with a plan and owner for implementation.

The level of risk that remains after existing controls and planned treatments are applied, which must be compared with the organization's risk appetite.

A potential cause of an unwanted incident-such as fire, flood, cyberattack, or supplier failure-that could disrupt activities if it materializes.

A weakness in people, process, technology, or facilities that makes an organization more likely to suffer harm when a threat occurs.

The defined boundaries-units, locations, products, and systems-covered by an impact study, which determines the data collected and the participants interviewed.

A process, function, or service whose interruption would cause unacceptable harm to people, obligations, finances, or reputation and therefore must be recovered within defined targets.

The longest time an organization can tolerate a disruption to a critical activity before the consequences become unacceptable to stakeholders, regulators, or the business.

The target duration within which a critical activity, system, or resource must be restored after disruption, set at or inside the maximum tolerable period.

The maximum acceptable amount of data loss measured in time, defining how far back a restored system may return when service resumes.

Documenting the internal and external resources-suppliers, systems, people, facilities, and utilities-that a critical activity relies on, so single points of failure become visible.

A component, person, or supplier whose loss alone would halt a critical activity because no alternative or redundancy exists.

The selected approach-such as alternate site, redundancy, manual workaround, or outsourcing-for restoring each critical activity within its recovery targets at acceptable cost.

The concrete arrangement of people, technology, facilities, and data-including contracts and procedures-that implements a chosen recovery strategy in practice.

Deliberate duplication of capacity, data, staff skills, or supply sources so that one failure does not interrupt a critical activity.

A prepared or contracted location-hot, warm, or cold-where staff and systems can operate if the primary facility becomes unusable.

Provision of usable workspace, equipment, and connectivity for displaced staff so that critical activities can continue at an alternate location or from home.

Copies of data kept separately from production systems, with defined frequency, retention, and restoration testing, so information can be recovered to a required point.

Managing the risk that external suppliers and partners fail to deliver, using qualification, contractual continuity requirements, monitoring, and alternate sourcing arrangements.

Exposure created when critical goods or services depend on a small number of suppliers, locations, or technologies, so a single event can disrupt many activities at once.

A documented set of procedures and information that guides an organization to respond to, recover from, and resume priority activities during and after a disruption.

The scheduled cycle of reviewing, updating, re-approving, and redistributing continuity documentation so it stays accurate after organizational, technical, or personnel change.

The authorized decision and defined steps that put continuity plans into effect, including who may declare an incident and how teams are notified.

A framework for strategic decision-making, communication, and coordination during a major incident, covering leadership roles, escalation, and stakeholder messaging.

Prepared processes, channels, and pre-approved messages for informing employees, customers, regulators, and media accurately and consistently during a disruption.

A tool that rapidly sends alerts and instructions to staff, responders, and sometimes stakeholders through multiple channels, with confirmation of receipt.

A designated physical or virtual location where the response team assembles, coordinates information, makes decisions, and manages resources during an incident.

A planned activity that tests plans, skills, and arrangements against realistic conditions, ranging from discussion-based walkthroughs to full operational simulations.

A discussion-based session in which participants talk through a scenario and their roles, revealing gaps in plans and coordination without moving real resources.

A document summarizing what happened during an exercise or incident, what worked, what failed, and the corrective actions assigned with owners and due dates.

A tracked list of fixes arising from exercises, audits, or real incidents, each with an accountable owner, target date, and verification of completion.

The assessed level of sophistication of a continuity program across governance, analysis, planning, testing, and improvement, used to plan staged capability growth.

A quantified indicator, such as plan coverage or exercise completion rate, that shows whether the continuity program is achieving its objectives and where attention is needed.

An independent review function that evaluates whether the continuity program's controls, documentation, and testing meet policy, standards, and regulatory requirements.

The principles of honesty, confidentiality, objectivity, and competence that continuity practitioners apply when reporting findings and advising decision-makers.