BCPMP key terms

A documented, ongoing system of governance, planning, and activity that keeps an organization able to deliver priority products and services at acceptable levels during disruption. It covers the full lifecycle from initiation through maintenance and improvement.

A top-level statement approved by senior leadership that defines the program's scope, objectives, authority, and commitment. It sets expectations for all business units and is the basis for resourcing and accountability decisions.

A senior executive who provides visible authority, funding, and strategic direction for the continuity program. The sponsor removes organizational barriers and ensures continuity obligations are integrated into decision making.

A cross-functional oversight body that reviews program progress, resolves competing priorities, and approves plans and investments. It links business units, technology, facilities, and risk functions to the continuity effort.

The person responsible for the day-to-day management of the continuity program, including planning schedules, documentation, training, and reporting. The role often combines program management with facilitation of impact analyses and exercises.

The interconnected set of policies, processes, roles, and records that together govern continuity work. It provides structure so that planning is repeatable, measurable, and subject to audit rather than ad hoc effort.

A staged framework describing progressive levels of continuity capability, from informal and reactive to optimized and continuously improving. Organizations use it to benchmark current state and set realistic improvement targets.

A structured process that identifies threats and hazards, evaluates the likelihood and consequences of each, and determines which risks need treatment. Results inform strategy selection and prioritize continuity investment.

An analysis that determines the operational and financial consequences of disrupting each business process over time. It identifies dependencies, sets recovery priorities, and derives recovery objectives used to design strategies.

The target elapsed time within which a business process, application, or resource must be restored after disruption to avoid unacceptable consequences. RTO drives strategy and technology design decisions.

The maximum acceptable amount of data loss measured in time before a disruption, expressed as how far back the last usable copy may be. RPO governs backup frequency and replication design.

The longest time a disruption can continue before its consequences become unacceptable to the organization and its stakeholders. It represents the outer boundary within which recovery must be achieved.

The practice of documenting internal and external relationships on which a process relies, such as suppliers, systems, people, facilities, and utilities. Mapping reveals single points of failure and cascading risk.

A systematic effort to enumerate natural, technological, human-caused, and health-related events that could disrupt operations. The resulting list supports scenario selection for planning and exercises.

The selection and application of options to address assessed risk, such as avoiding, reducing, transferring, or accepting it. In continuity work, treatment often takes the form of resilience strategies and recovery capabilities.

A chosen approach for protecting or recovering a priority activity, such as alternate sites, manual workarounds, redundant technology, or outsourced capacity. Strategies must be feasible, cost-justified, and validated against recovery objectives.

A pre-identified location or environment used to continue operations when the primary facility is unavailable. Options range from hot sites with live systems to cold sites requiring build-out, each with different cost and recovery speed.

An arrangement in which two organizations agree to host each other's operations or staff during a disruption. These agreements are inexpensive but carry risks such as conflicting demand and unverified capacity.

A temporary manual or alternative method used to deliver a process while normal systems or resources are unavailable. Workarounds bridge the gap until restoration and must be documented and rehearsed.

The practice of copying data to separate media or locations and verifying that it can be reliably recovered. Effective programs test restoration, protect copies from the same incident, and align frequency with recovery point objectives.

Any component, person, supplier, or location whose failure alone halts a critical process. Identifying these points directs redundancy and diversification investment.

Duplication of capacity, systems, people, or suppliers so that a single failure does not stop delivery. Redundancy can be active, standby, or geographic and should be proportionate to the impact of loss.

Procedures for protecting life safety and property during the immediate response to an incident, including evacuation, sheltering, accounting for people, and notification. It addresses the first minutes and hours before recovery begins.

A designated group of senior leaders who coordinate strategic decisions, communications, and resource allocation during a significant disruption. The team operates from a defined location or virtual platform with clear roles.

A standardized, scalable structure for managing response resources and roles across agencies and jurisdictions. It clarifies command, operations, planning, logistics, and finance functions during complex events.

A structure in which multiple responding organizations share decision-making authority for a single incident. It reduces conflicting direction when several agencies or business units have jurisdiction or stake.

Planned messaging to employees, customers, regulators, media, and partners during and after a disruption. It requires pre-approved templates, designated spokespeople, and pre-established channels to maintain trust and accuracy.

A technology or process used to rapidly alert staff and stakeholders with instructions during an incident. Effectiveness depends on redundant channels, current contact data, and periodic testing.

Documented procedures and information that guide an organization in responding to and recovering from disruption. A good plan defines scope, roles, activation criteria, recovery steps, dependencies, and contact details.

The individual accountable for the content, accuracy, and maintenance of a specific continuity plan. Ownership ensures the plan is reviewed, exercised, and updated as the business changes.

The formal decision and process by which a plan is invoked, including who may declare an incident and what thresholds apply. Clear activation criteria prevent delay and inconsistent response.

A documented step-by-step method for performing work without automated systems, used when technology is unavailable. Manual procedures must be accessible offline and practiced so staff can execute them under stress.

Structured activities that build knowledge of continuity roles, expectations, and procedures across the workforce. It ranges from general awareness for all staff to role-specific training for responders and plan owners.

A planned cycle of increasingly complex activities, from plan reviews and tabletops to full simulations, that tests capabilities and reveals gaps. The program schedules, scopes, and evaluates each exercise against defined objectives.

A discussion-based session in which participants talk through a scenario and their responses without deploying real resources. It is low cost and effective for testing decision making, roles, and coordination.

An exercise built around a specific plausible disruption, such as a cyberattack, flood, or supplier failure, to test relevant capabilities. Scenarios should be derived from risk assessment and impact analysis findings.

A document produced after an exercise or incident that records what happened, what worked, what failed, and recommended improvements. It converts observations into tracked corrective actions.

Instruction designed around demonstrable skills and knowledge required for specific continuity roles rather than general familiarity. Learners are assessed against defined performance criteria.

The ongoing process of reviewing, updating, and re-approving continuity documentation to reflect organizational, technological, and risk changes. It includes scheduled reviews, change triggers, and version control.

A tracked process for resolving gaps identified through exercises, audits, incidents, and reviews. Each action has an owner, due date, and verification step so improvements are actually completed.

Quantitative and qualitative measures used to judge whether the continuity program is effective and improving. Examples include exercise completion, action closure rates, and recovery objective attainment.

The practice of building working relationships with emergency services, regulators, utilities, and government bodies before an incident. Pre-established contacts and shared protocols speed response and reduce confusion.

A formal arrangement in which organizations agree to share resources, personnel, or facilities during an emergency. Terms should define request procedures, cost sharing, and liability.

The capability of a supply network to anticipate, absorb, and recover from disruption while maintaining delivery of priority goods and services. It relies on visibility, diversification, and tested contingency sourcing.

Evaluation of third parties for their likelihood of failure and the impact that failure would have on the organization. It considers financial health, geographic exposure, concentration, and their own continuity capability.