CBCI (Other exams) cheat sheet

Business continuity is the capability of an organization to continue delivery of products or services at acceptable predefined levels after a disruptive incident.

The BCMS lifecycle follows the sequence: analysis, solution design, implementation, validation, and embedding into the organization's culture.

ISO 22301 structures the BCMS around Plan-Do-Check-Act, with management review and continual improvement closing each cycle.

Four elements underpin a BCMS: policy and objectives, competent people with defined roles, documented processes and procedures, and performance evaluation.

Top management must demonstrate leadership by setting policy, appointing roles, providing resources, and directing management reviews.

A business continuity policy states scope, objectives, commitment to continual improvement, and criteria for invoking continuity arrangements.

Scope definition identifies the products, services, locations, and organizational units the BCMS covers, plus exclusions and their justification.

Documented information must be controlled for creation, review, approval, version, distribution, retention, and protection.

Continual improvement uses evidence from exercises, incidents, audits, and metrics to correct gaps and raise capability maturity.

A BIA identifies time-critical activities and quantifies the operational and financial consequences of their disruption over time.

Recovery Time Objective (RTO) is the target time to restore an activity; Recovery Point Objective (RPO) is the acceptable data loss measured in time.

Maximum Tolerable Period of Disruption (MTPD) is the longest outage an organization can absorb before consequences become unacceptable; RTO must be shorter than MTPD.

Minimum Business Continuity Objective (MBCO) is the level of product or service output that must be maintained during disruption.

Impact categories typically include financial, regulatory, legal, reputational, customer, and safety; impact is scored across multiple time horizons.

Dependency mapping records upstream suppliers, systems, people, facilities, and information required by each prioritized activity.

Risk assessment combines likelihood and consequence to produce a risk rating, then compares it against defined risk criteria and tolerance.

Risk treatment options are avoid, reduce, transfer, and accept; residual risk is the risk remaining after treatment.

Outputs of the BIA drive strategy selection; activities with short MTPDs and high impact receive the most resilient solutions.

Strategy selection matches each prioritized activity to solutions whose recovery capability meets or beats its RTO and MBCO.

Recovery options include redundancy, failover, alternate sites (hot, warm, cold), manual workarounds, and third-party or mutual aid arrangements.

A hot site is fully equipped and ready for immediate use; a warm site is partially equipped; a cold site provides space and infrastructure only.

Strategy cost is weighed against the cost of disruption; the chosen option should not exceed the value of the loss it prevents.

Single points of failure are components whose loss disables an activity; they require redundancy, diversity of routes, or substitution.

Data strategies include replication, backup with defined restore times, journaling, and offsite or cloud storage tested for recoverability.

Supplier and outsourcing strategies require contractual continuity requirements, due diligence, and validation of supplier recovery capability.

People strategies address succession, cross-training, remote working, staff welfare, and communication during disruption.

Resource requirements derived from the chosen strategies define the gap between current capability and required capability.

Incident response follows a sequence: detect, assess and classify, activate, respond, recover, and return to normal operations.

An incident management team is organized by function, typically covering operations, communications, HR, IT, facilities, legal, and finance.

The plan defines activation authority, escalation thresholds, and criteria that trigger invocation of continuity arrangements.

Roles require named individuals and at least one alternate, with delegated authority documented for absence or unavailability.

Communication plans cover internal staff, customers, regulators, media, and suppliers, with pre-agreed channels and message templates.

Recovery plans are activity-specific procedures; the business continuity plan coordinates them and sets priorities and dependencies.

Plans are structured for use under stress: short action-oriented sections, checklists, contact lists, and clear decision points.

Crisis communications must designate a single authorized spokesperson and a process for verifying facts before release.

Plan maintenance includes version control, distribution lists, review triggers such as organizational change, and post-incident updates.

Exercise types escalate in rigor: plan walkthrough, tabletop discussion, simulation, and full live or functional exercise.

A test aims to verify a specific component works; an exercise validates plans, roles, and coordination through simulated conditions.

Every exercise requires documented objectives, scope, scenario, participants, safety controls, and success criteria before it begins.

A debrief and after-action report capture observations, root causes, corrective actions, owners, and due dates.

Corrective actions are tracked to closure and fed into the continual improvement process and the next exercise cycle.

Training builds competence in assigned roles; awareness builds general understanding of policy, roles, and response expectations across all staff.

A training needs analysis identifies who requires which competence, then defines content, frequency, and evidence of completion.

Exercise frequency is set by policy, regulation, or risk; high-impact activities and critical suppliers are exercised more often.

Maintenance is triggered by exercises, incidents, audits, organizational change, new suppliers, and scheduled periodic review.

Performance is measured with metrics covering RTO achievement, exercise completion, corrective action closure rate, and plan currency.

Internal audit verifies that the BCMS conforms to planned arrangements and is effectively implemented and maintained.

Management review examines audit results, exercise outcomes, incident trends, risk changes, and improvement opportunities, and records decisions.

Nonconformity requires correction, root cause analysis, corrective action, and verification that the action was effective.

Embedding BCM means continuity considerations are built into routine decisions, job descriptions, induction, and supplier management.

Maturity models assess progression from ad hoc response through defined, managed, integrated, and optimizing capability.

Records must provide evidence of competence, exercise results, reviews, and corrective actions, and be retained per policy.

Benchmarking and lessons learned from other organizations and sector incidents inform improvement priorities.

Business continuity is the capability of an organization to continue delivery of products or services at acceptable predefined levels after a disruptive incident.

The BCMS lifecycle follows the sequence: analysis, solution design, implementation, validation, and embedding into the organization's culture.

ISO 22301 structures the BCMS around Plan-Do-Check-Act, with management review and continual improvement closing each cycle.

Four elements underpin a BCMS: policy and objectives, competent people with defined roles, documented processes and procedures, and performance evaluation.

Top management must demonstrate leadership by setting policy, appointing roles, providing resources, and directing management reviews.

A business continuity policy states scope, objectives, commitment to continual improvement, and criteria for invoking continuity arrangements.

Scope definition identifies the products, services, locations, and organizational units the BCMS covers, plus exclusions and their justification.

Documented information must be controlled for creation, review, approval, version, distribution, retention, and protection.

Continual improvement uses evidence from exercises, incidents, audits, and metrics to correct gaps and raise capability maturity.

A BIA identifies time-critical activities and quantifies the operational and financial consequences of their disruption over time.

Recovery Time Objective (RTO) is the target time to restore an activity; Recovery Point Objective (RPO) is the acceptable data loss measured in time.

Maximum Tolerable Period of Disruption (MTPD) is the longest outage an organization can absorb before consequences become unacceptable; RTO must be shorter than MTPD.

Minimum Business Continuity Objective (MBCO) is the level of product or service output that must be maintained during disruption.

Impact categories typically include financial, regulatory, legal, reputational, customer, and safety; impact is scored across multiple time horizons.

Dependency mapping records upstream suppliers, systems, people, facilities, and information required by each prioritized activity.

Risk assessment combines likelihood and consequence to produce a risk rating, then compares it against defined risk criteria and tolerance.

Risk treatment options are avoid, reduce, transfer, and accept; residual risk is the risk remaining after treatment.

Outputs of the BIA drive strategy selection; activities with short MTPDs and high impact receive the most resilient solutions.

Strategy selection matches each prioritized activity to solutions whose recovery capability meets or beats its RTO and MBCO.

Recovery options include redundancy, failover, alternate sites (hot, warm, cold), manual workarounds, and third-party or mutual aid arrangements.

A hot site is fully equipped and ready for immediate use; a warm site is partially equipped; a cold site provides space and infrastructure only.

Strategy cost is weighed against the cost of disruption; the chosen option should not exceed the value of the loss it prevents.

Single points of failure are components whose loss disables an activity; they require redundancy, diversity of routes, or substitution.

Data strategies include replication, backup with defined restore times, journaling, and offsite or cloud storage tested for recoverability.

Supplier and outsourcing strategies require contractual continuity requirements, due diligence, and validation of supplier recovery capability.

People strategies address succession, cross-training, remote working, staff welfare, and communication during disruption.

Resource requirements derived from the chosen strategies define the gap between current capability and required capability.

Incident response follows a sequence: detect, assess and classify, activate, respond, recover, and return to normal operations.

An incident management team is organized by function, typically covering operations, communications, HR, IT, facilities, legal, and finance.

The plan defines activation authority, escalation thresholds, and criteria that trigger invocation of continuity arrangements.

Roles require named individuals and at least one alternate, with delegated authority documented for absence or unavailability.

Communication plans cover internal staff, customers, regulators, media, and suppliers, with pre-agreed channels and message templates.

Recovery plans are activity-specific procedures; the business continuity plan coordinates them and sets priorities and dependencies.

Plans are structured for use under stress: short action-oriented sections, checklists, contact lists, and clear decision points.

Crisis communications must designate a single authorized spokesperson and a process for verifying facts before release.

Plan maintenance includes version control, distribution lists, review triggers such as organizational change, and post-incident updates.

Exercise types escalate in rigor: plan walkthrough, tabletop discussion, simulation, and full live or functional exercise.

A test aims to verify a specific component works; an exercise validates plans, roles, and coordination through simulated conditions.

Every exercise requires documented objectives, scope, scenario, participants, safety controls, and success criteria before it begins.

A debrief and after-action report capture observations, root causes, corrective actions, owners, and due dates.

Corrective actions are tracked to closure and fed into the continual improvement process and the next exercise cycle.

Training builds competence in assigned roles; awareness builds general understanding of policy, roles, and response expectations across all staff.

A training needs analysis identifies who requires which competence, then defines content, frequency, and evidence of completion.

Exercise frequency is set by policy, regulation, or risk; high-impact activities and critical suppliers are exercised more often.

Maintenance is triggered by exercises, incidents, audits, organizational change, new suppliers, and scheduled periodic review.

Performance is measured with metrics covering RTO achievement, exercise completion, corrective action closure rate, and plan currency.

Internal audit verifies that the BCMS conforms to planned arrangements and is effectively implemented and maintained.

Management review examines audit results, exercise outcomes, incident trends, risk changes, and improvement opportunities, and records decisions.

Nonconformity requires correction, root cause analysis, corrective action, and verification that the action was effective.

Embedding BCM means continuity considerations are built into routine decisions, job descriptions, induction, and supplier management.

Maturity models assess progression from ad hoc response through defined, managed, integrated, and optimizing capability.

Records must provide evidence of competence, exercise results, reviews, and corrective actions, and be retained per policy.

Benchmarking and lessons learned from other organizations and sector incidents inform improvement priorities.