BCPMP flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Business continuity management system

The documented set of policies, processes, and responsibilities an organization uses to plan, operate, review, and continually improve its continuity capability across the full lifecycle.

Program charter

A formal document that establishes the continuity program, names its executive sponsor and manager, defines scope, and grants authority to activate plans and commit resources.

Steering committee role

A cross-functional body that oversees the continuity program, resolves competing priorities, approves strategies and budgets, and reviews exercise results and residual risk.

Continuity policy statement

A top-level commitment defining the program's objectives, mandatory requirements, scope, and staff accountability, reviewed annually or after significant organizational change.

Risk score calculation

Likelihood multiplied by impact, often on a five-by-five matrix producing scores from one to twenty-five, with defined thresholds that trigger treatment or escalation.

Risk treatment options

The four standard responses to identified risk: avoid the activity, reduce likelihood or impact, transfer through insurance or contract, or formally accept the residual risk.

Recovery time objective

The maximum acceptable elapsed time to restore a product, service, or activity after disruption, which must be shorter than or equal to the maximum tolerable downtime.

Recovery point objective

The maximum tolerable amount of data loss measured in time before a disruption, which determines backup frequency and replication design for each critical system.

Maximum tolerable downtime

The point in time at which the impact of not performing a critical activity becomes unacceptable to the organization, its customers, or its regulators.

Dependency mapping

Documenting the applications, data, people, facilities, utilities, and third parties each critical activity relies on, to expose single points of failure and constrain recovery design.

BIA impact categories

Standard lenses for assessing disruption harm over time: financial, regulatory and legal, operational, reputational, safety, and contractual, each rated across defined horizons.

Recovery priority ranking

Ordering activities by earliest recovery time objective combined with highest impact and dependency depth, rather than by organizational seniority or budget size.

Alternate site distance rule

The alternate site must sit outside the credible impact radius of the most likely regional hazard, such as flood plain, wildfire zone, hurricane track, or grid outage.

Synchronous replication tradeoff

Data is written to both sites before acknowledgment, giving near-zero recovery point objective but requiring low latency and higher write cost.

Warm site characteristics

A partially equipped alternate facility with power, network, and some hardware but no live data, requiring hours to days plus restoration effort to reach service.

Recovery time composition

Achievable recovery time equals site or service activation time plus data restoration time plus application start-up and verification time; ignoring any component misses the objective.

Manual workaround validity

A viable strategy for short recovery objectives only when forms, authority limits, supplies, and trained staff are pre-positioned and exercised before the disruption occurs.

Single point of failure

Any component whose failure alone halts a critical activity, such as one power feed, one carrier, one identity provider, or one key person without backup.

Incident command roles

A structured response organization with an incident commander and operations, planning, logistics, finance and administration, and liaison functions, each with a designated alternate.

Life safety precedence

The rule that evacuation, shelter-in-place, personnel accounting, and medical response always outrank asset protection and business recovery during an emergency.

Single-voice communication

A crisis communication principle designating one trained spokesperson and pre-approved holding statements, with a fixed update cadence, to prevent conflicting public messages.

Activation criteria

Objective, pre-agreed thresholds such as facility unavailability beyond a set duration or any serious injury, that trigger plan invocation and escalation without debate.

Notification cascade test

A drill measuring how quickly and completely critical staff are reached, typically targeting all contacts within thirty minutes using at least two independent channels.

Plan hierarchy

The layered set of documents from policy through enterprise continuity plan, business unit plans, IT disaster recovery, communications, emergency response, and supplier plans.

Plan minimum contents

Purpose, scope, assumptions, roles, activation authority, procedures, dependencies, contact lists, and version control, assembled so responders can act under stress.

Document control requirements

Unique identifiers, version numbers, approval signatures, distribution lists, and a defined review cycle, ensuring responders never use superseded procedures during an incident.

Offline plan availability

Maintaining printed or locally stored copies of plans and contact lists because the intranet, email, or primary repository may be unavailable during the very outage.

Exercise type progression

Increasing complexity from plan walkthrough and tabletop, through component tests and functional exercises, to full-scale simulation, each validating different objectives.

After-action report

A post-exercise document recording objectives, timeline, observations, root causes, and corrective actions with named owners and due dates, issued within a set window.

No-fault exercise ground rule

A stated rule that exercise findings are not used for discipline, which encourages honest reporting of failures and produces more useful corrective actions.

Corrective action register

A tracked list of findings from exercises, incidents, and audits, each with owner, due date, status, and verification of effectiveness, reviewed until formally closed.

Change-triggered plan review

A rule that any project altering critical applications, sites, suppliers, or organization structure requires a continuity impact check and plan update before go-live.

Supplier criticality tiering

Ranking suppliers by the impact of their failure on recovery-time-critical activities and dependencies, rather than by spend or contract value.