CBCI (Other exams) flashcards
CBCI · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Business continuity
- The capability of an organization to continue delivering products or services at acceptable predefined levels during and after a disruptive incident, supported by documented and validated arrangements.
- Business continuity management system
- A documented management system covering policy, objectives, processes, roles, and resources that an organization uses to establish, implement, operate, monitor, and improve business continuity.
- Plan-Do-Check-Act
- A continual improvement cycle applied to the BCMS: establish arrangements, implement them, monitor and review performance, then act on findings to improve capability.
- BCM policy
- A top-management statement defining continuity scope, objectives, commitment to continual improvement, and the principles governing how continuity arrangements are invoked and reviewed.
- BCMS scope statement
- Documentation identifying which products, services, locations, and organizational units are covered by the management system, together with any exclusions and their justification.
- Continual improvement
- A recurring process that uses audit results, exercise findings, incident lessons, and performance metrics to strengthen the BCMS and raise overall continuity capability over time.
- Business impact analysis
- An analysis identifying time-critical activities and quantifying the consequences of their disruption across time horizons, producing priorities, recovery objectives, and dependency information.
- Recovery time objective
- The target duration within which an activity, system, or resource must be restored after disruption so that consequences remain within acceptable limits.
- Recovery point objective
- The maximum acceptable amount of data loss, expressed as a period of time, that determines how frequently data must be captured or replicated.
- Maximum tolerable period of disruption
- The longest duration an organization can absorb disruption of an activity before consequences become unacceptable; recovery objectives must be set shorter than this limit.
- Minimum business continuity objective
- The minimum level of product or service output, and associated service quality, that an organization must maintain during a disruption.
- Risk assessment
- A process that identifies risks to prioritized activities, analyzes likelihood and consequence, evaluates results against risk criteria, and determines whether treatment is required.
- Residual risk
- The level of risk remaining after treatment measures have been applied; it is compared against risk tolerance to decide whether further action is needed.
- Dependency mapping
- Identification of the suppliers, systems, people, facilities, information, and utilities that each prioritized activity relies on, used to reveal single points of failure.
- Hot site
- An alternate facility fully equipped with infrastructure, systems, and connectivity that can support operations almost immediately after activation.
- Cold site
- An alternate facility providing space, power, and basic infrastructure only, requiring equipment and systems to be installed before it can support operations.
- Single point of failure
- A component, supplier, or dependency whose failure alone would disable a prioritized activity, requiring redundancy, diversity, or a substitute arrangement.
- Recovery strategy selection
- The process of choosing continuity solutions whose recovery capability satisfies each prioritized activity's recovery objectives at a cost justified by the avoided impact.
- Mutual aid agreement
- A formal arrangement in which two or more organizations agree to provide each other resources or facilities during disruption, with terms defined in advance.
- Incident management team
- A group of designated roles responsible for assessing an incident, deciding activation, coordinating response and recovery, and managing communications until normal operations resume.
- Activation criteria
- Predefined thresholds and conditions that authorize designated individuals to invoke continuity arrangements and escalate response to the appropriate level.
- Crisis communication plan
- Documented arrangements specifying audiences, channels, message templates, approval steps, and a designated spokesperson for communicating during and after a disruptive incident.
- Business continuity plan
- A documented set of procedures and information that guides an organization in responding to disruption, coordinating recovery of prioritized activities, and returning to normal operations.
- Call tree
- A structured contact sequence in which each person notifies named others, used to rapidly alert staff and confirm availability during an incident or exercise.
- Tabletop exercise
- A discussion-based exercise where participants talk through a scenario and their response decisions, testing plans and coordination without moving equipment or systems.
- Full-scale exercise
- A live exercise that activates facilities, systems, staff, and communications as realistically as possible to validate recovery capability against defined objectives.
- After-action report
- Documentation produced after an exercise or incident recording observations, strengths, gaps, root causes, corrective actions, responsible owners, and target completion dates.
- Training needs analysis
- A structured review identifying which roles require which continuity competences, then defining content, delivery method, frequency, and evidence of completion.
- Awareness programme
- Ongoing activities that build general staff understanding of continuity policy, individual responsibilities, and expected actions during disruption, distinct from role-specific training.
- Corrective action
- An action taken to eliminate the cause of a detected nonconformity or exercise gap, tracked to closure and verified for effectiveness.
- Internal audit
- An independent, planned review verifying that the BCMS conforms to its own requirements and applicable standards and is effectively implemented and maintained.
- Management review
- A scheduled top-management examination of BCMS performance, audit and exercise results, risk changes, and improvement opportunities, with decisions and actions recorded.