CBCI (Business Continuity Certifications) cheat sheet

ISO 22301 uses the harmonised structure: clause 4 Context, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement.

The BC policy is approved by top management and states scope, objectives, principles, commitment to meet applicable requirements and commitment to continual improvement.

Typical governance layers: a steering committee (direction and funding), a BC manager (owns the BCMS day to day), and business unit coordinators (deliver locally).

The scope statement must name the products and services, locations, activities, dependencies and interfaces included, and record any exclusions with justification.

Management review happens at planned intervals; inputs include audit results, performance metrics, risk status, incidents and exercise findings, and outputs include decisions on resources and improvement.

Documentation hierarchy: policy, then BCMS scope and framework, then BIA and risk assessment results, then strategies, then plans, then evidence records.

Programme health indicators include BIA coverage of priority activities, plan coverage of critical activities, exercise completion rate and closure rate of corrective actions.

Decision rule: the BC policy is reviewed at least annually and additionally after significant organisational, regulatory or technological change, or after a major incident.

Embedding means BC is understood and applied by everyone, evidenced by behaviour, decisions and records, not only by the existence of plans.

ISO 22301 clause 7.2 competence: determine required competence, provide training or other action, evaluate effectiveness of that action, and retain documented evidence.

ISO 22301 clause 7.3 awareness: personnel know the BC policy, how they contribute to BCMS effectiveness, and the implications of not conforming.

ISO 22301 clause 7.4 communication: determine what to communicate, when, with whom and how, for both internal and external communication.

Three training tiers: general awareness for all staff, role-specific training for plan holders and crisis team members, and specialist training for BIA, risk and exercise design.

Embedding levers include induction programmes, job descriptions, personal objectives, supplier and contract requirements, intranet content and periodic awareness campaigns.

Effectiveness measures include training completion percentage, exercise participation rate, awareness survey scores, and the proportion of staff able to locate the plan and their role in it.

The BIA identifies activities that support products and services, assesses how impact grows over time if they fail, and sets priorities and recovery objectives.

Impact dimensions to assess: financial, operational, legal and regulatory, reputational, health and safety, and environmental.

Relationship rule: RTO must be less than or equal to the MTPD; the MTPD is the point at which impact on the organisation becomes unacceptable.

RPO is the acceptable data loss measured in time and directly determines the required backup or replication frequency.

The MBCO states the minimum acceptable level of product or service output during and after a disruption and constrains strategy selection.

Impact is scored at increasing intervals (for example 1 hour, 4 hours, 12 hours, 24 hours, 72 hours, 1 week) so that the changing urgency of each activity is visible.

Dependency mapping covers people and skills, premises, technology, data, suppliers and third parties, utilities, and other internal activities.

Risk assessment output is expressed as likelihood against impact; risks above tolerance require treatment, and accepted risks must be documented with rationale.

Strategy options per prioritised activity: avoid, reduce or mitigate, transfer (for example insurance), or accept, each compared on cost against recovery time achieved.

Site options: hot (fully equipped and ready), warm (partial capability, some installation required), cold (space and utilities only), reciprocal, mobile, and remote working.

Technology options: high availability clustering, data replication, backup and restore, and dedicated disaster recovery environments.

Decision rule: the chosen strategy must meet the RTO and RPO derived from the BIA; any shortfall is recorded as residual risk requiring sign-off.

Plan structure: purpose and scope, roles and responsibilities, activation and escalation, communications, recovery steps, interdependencies, and appendices with contact and resource data.

Incident management operates at three levels: strategic (crisis team), tactical (coordination and prioritisation) and operational (execution of recovery tasks).

Single points of failure identified during design are removed through redundancy or replaced by an alternative arrangement recorded in the plan.

Implementation covers delivering the chosen strategies, writing plans, assigning resources and building an incident response capability.

Plan types: business continuity plans, incident and crisis management plans, crisis communications plans, IT disaster recovery plans, and supplier continuity plans.

Activation criteria are pre-agreed thresholds such as impact severity, disruption duration or number of affected sites, and a named individual holds authority to invoke the plan.

Call trees and automated notification systems must retain multiple contact routes per person and be tested periodically.

Resource requirements are derived from the BIA and cover people and skills, workspace, technology, data, transport and suppliers.

Documents are version-controlled with a named owner, approval record, distribution list, issue date and review cycle.

Stakeholder communication plans identify audiences, spokespeople, message templates, approval routes and holding statements.

Validation combines exercises, tests, reviews, audits, post-incident reviews and management review to confirm plans and capabilities work as intended.

Exercise types: discussion-based (seminar, workshop, tabletop, game) and operations-based (drill, functional, full-scale).

The exercise programme is progressive: simple discussion exercises first, then increasing frequency and complexity in each subsequent cycle.

Each exercise records objectives, scope, scenario, participants and an evaluation report with lessons learned and assigned actions.

ISO 22301 clause 9.2 internal audit: planned intervals, defined criteria and scope, impartial auditors, results reported to management.

ISO 22301 clause 9.3 management review inputs include audit results, performance metrics, nonconformities, risk changes, exercise outcomes and improvement status.

Clause 10 improvement sequence: react to nonconformity, correct it, determine root cause, take corrective action, review effectiveness, and update documentation and plans.