CBCI (Other exams) key terms

A holistic management process that identifies potential threats to an organization and builds resilience to safeguard the interests of key stakeholders, reputation, brand, and value-creating activities.

The documented framework of policies, processes, roles, and resources an organization uses to establish, implement, operate, monitor, review, maintain, and improve business continuity across its lifecycle.

The capability of an organization to continue delivering products or services at acceptable predefined levels following a disruptive incident, protecting its most critical activities and obligations.

A top-management statement defining the organization's commitment, objectives, scope, and accountability for continuity, providing the mandate and governance framework for the entire continuity programme.

The documented boundaries of the continuity programme, specifying which business units, locations, products, services, and dependencies are included or excluded, and the justification for those decisions.

Visible leadership support that authorizes the continuity programme, allocates resources, assigns accountability, and integrates continuity into the organization's strategy, culture, and decision-making.

The structures, roles, and decision rights that direct and control the continuity programme, ensuring clear accountability, oversight, and alignment with organizational objectives and stakeholder expectations.

The recurring process of assessing continuity performance, identifying gaps, and enhancing the BCMS through corrective actions, management review, and lessons learned from events and exercises.

A process that analyzes activities and dependencies to determine the consequences of disruption over time, identifying time-critical outputs, tolerable outage limits, and recovery priorities.

A structured process of identifying threats and vulnerabilities, analyzing likelihood and impact, and evaluating resulting risk against defined criteria to prioritize treatment.

The selection and application of options to modify risk, such as avoiding, reducing, transferring, or accepting it, with residual risk documented and accepted by accountable owners.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, providing the benchmark against which assessed risks are evaluated and prioritized.

The risk that remains after existing controls and planned treatments have been applied, which must be documented and formally accepted by an authorized risk owner.

A potential cause of an unwanted incident that could disrupt operations, such as natural hazards, cyberattacks, supply failures, or human error, assessed for likelihood and potential impact.

A weakness in processes, systems, facilities, or people that a threat could exploit, increasing the likelihood or severity of disruption to critical activities.

The longest time an organization can tolerate disruption to an activity before unacceptable harm to stakeholders, finances, reputation, or compliance occurs.

The target time set for resuming an activity or restoring a resource after disruption, chosen to be shorter than the MTPD to leave a protective margin.

The maximum acceptable amount of data loss, expressed as time, that an activity can sustain, which drives backup frequency and replication design for supporting systems.

The practice of documenting internal and external relationships, such as suppliers, systems, utilities, and people, on which critical activities rely, revealing hidden single points of failure.

A component, supplier, person, or location whose failure alone would halt a critical activity, warranting redundancy, diversification, or alternative arrangements in continuity strategy.

The selected approach for restoring critical activities and resources within required timeframes, covering people, facilities, technology, data, suppliers, and communications options.

The provision of duplicate or backup capacity, such as alternate sites, spare equipment, or cross-trained staff, so a failure does not interrupt delivery of critical activities.

A pre-identified location used to continue operations when the primary facility is unavailable, ranging from cold to warm to hot configurations based on required recovery speed.

The strategy of assessing and securing external suppliers and logistics so that critical inputs remain available during disruption, through diversification, contractual obligations, and supplier continuity requirements.

The assurance that outsourced and vendor-provided services meet the organization's recovery requirements, verified through due diligence, contractual clauses, and periodic testing of supplier capabilities.

A documented plan describing how an organization will sustain its most essential functions during and after disruption, including authorities, delegations, relocation, and resource requirements.

Documented procedures and information that guide an organization to respond to disruption, continue or recover critical activities, and return to normal operations within defined timeframes.

The defined trigger, authority, and process for declaring an incident and putting continuity arrangements into effect, including notification of teams and escalation criteria.

The coordinated process of detecting, assessing, responding to, and communicating about a disruptive event, coordinating resources and decisions until normal operations are restored.

A group of senior leaders with authority to make strategic decisions, allocate resources, and manage stakeholder communication during a significant disruption affecting the organization.

The immediate actions taken to protect life, safety, and property at the onset of an incident, such as evacuation, first aid, and containment, before continuity procedures begin.

The planned processes and pre-prepared messages for informing employees, customers, regulators, media, and other stakeholders accurately and promptly during and after a disruptive event.

A structured activity that validates plans, capabilities, and team performance against realistic scenarios, ranging from discussion-based walkthroughs to full-scale simulations with participants.

A discussion-based session in which participants talk through a simulated scenario, testing decision-making, roles, and plan assumptions without actually deploying resources or systems.

A controlled verification that a specific component, such as a backup restoration, alternate site, or notification system, performs as designed under defined conditions.

A structured debrief after an exercise or incident that captures what worked, identifies gaps, and assigns corrective actions with owners and deadlines for plan improvement.

A documented change made to eliminate the cause of an identified deficiency, tracked to completion and verified for effectiveness to prevent recurrence.

Programmes that build general continuity awareness for all staff and role-specific competence for responders, ensuring people know their responsibilities before an incident occurs.

The scheduled review, update, and re-approval of continuity documentation to reflect organizational, personnel, technology, and risk changes, keeping plans current and usable.

A periodic top-management evaluation of the BCMS's suitability, adequacy, and effectiveness, resulting in decisions on improvement, resources, and strategic direction.