CBCI (Business Continuity Certifications) flashcards
CBCI · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Business continuity policy
- A top-management-approved statement of the organisation's BC scope, objectives, principles and roles, committing to meeting requirements and continual improvement. It authorises the BCMS and is reviewed at planned intervals.
- BCMS scope statement
- Defines which products, services, locations, activities, dependencies and interfaces are covered by the business continuity management system, and explicitly records any exclusions together with their justification.
- Management review
- A planned top-management evaluation of the BCMS covering audit results, performance metrics, risks, incidents and improvement status; outputs include decisions on resources, corrective actions and continual improvement.
- BC programme governance
- The structure of accountability, decision rights and oversight for the BC programme, typically a steering committee, a BC manager and business unit coordinators reporting through agreed metrics.
- Continual improvement
- A recurring ISO 22301 requirement to enhance BCMS performance by analysing performance data, audits, exercises and incidents, then implementing, reviewing and recording corrective and improvement actions.
- Business continuity coordinator
- A named individual in each business unit responsible for maintaining local plans, keeping contact data current, running local exercises and reporting BC status to the programme.
- Competence versus awareness
- Competence is the demonstrated ability to apply knowledge and skills to achieve intended results; awareness is knowing the policy exists and how one's work contributes. ISO 22301 requires both.
- BC awareness training
- Communication activity ensuring all staff understand the BC policy, their role during disruption and the consequences of non-conformance, usually delivered at induction and refreshed periodically.
- Embedding business continuity
- Integrating BC into everyday culture, processes and decisions so it becomes normal practice, evidenced by staff behaviour, management priorities, supplier requirements and routine operational procedures.
- BC competency matrix
- A tool mapping roles against required BC knowledge and skills, recording current capability and identifying training gaps; used to plan role-specific training and evaluate its effectiveness.
- BCMS internal communication
- Planned exchange of BC information within the organisation covering what to communicate, when, to whom and how, including policy updates, exercise schedules, plan changes and lessons learned.
- Maximum tolerable period of disruption
- The time by which a disruption's impact becomes unacceptable if the activity is not resumed. It is set by management and acts as the upper limit for the recovery time objective.
- Recovery time objective
- The target duration for resuming a prioritised activity or resource after a disruption. It must be shorter than or equal to the maximum tolerable period of disruption set in the BIA.
- Recovery point objective
- The maximum acceptable amount of data, measured in time, that may be lost in a disruption; it determines the required backup frequency and replication design.
- Business impact analysis
- A process identifying activities that support products and services, assessing how impact grows over time if they fail, and setting priorities, MTPDs, RTOs and minimum objectives.
- Minimum business continuity objective
- The minimum level of product or service output, and the minimum resources, that the organisation must maintain during and immediately after a disruption; it shapes strategy selection.
- Impact scoring over time
- Rating the consequences of an activity failure at increasing intervals such as one hour, four hours, one day and one week, revealing when impact crosses acceptable thresholds.
- Business continuity strategy
- The chosen approach for protecting and recovering a prioritised activity, selected by comparing options such as redundancy, relocation, outsourcing or manual workaround against cost and required recovery time.
- Hot site
- An alternate facility fully equipped with systems, data and infrastructure ready to operate immediately, giving the shortest recovery time but the highest ongoing cost.
- Cold site
- An alternate facility providing space and basic utilities only, with equipment and data installed after activation; the cheapest option but with the longest recovery time.
- Reciprocal agreement
- An arrangement where two organisations agree to host each other's operations during a disruption; low cost but risky because both parties may be affected by the same event.
- Manual workaround
- A documented procedure allowing an activity to continue using paper-based or alternative methods while technology is unavailable; usually short-term and resource-intensive.
- Plan activation criteria
- Pre-agreed thresholds such as impact severity, disruption duration or number of affected sites that authorise a named individual to invoke the plan and escalate to crisis level.
- Crisis management team
- A strategic group, led by a senior executive, responsible for decision-making, resource authorisation, and stakeholder and media communications during a major disruption.
- Call tree
- A cascading contact structure in which each person notifies several others, used to alert staff out of hours; it requires current numbers and periodic testing.
- Business continuity plan
- Documented procedures and information enabling an organisation to respond to and recover from disruption at an acceptable predefined level, including roles, activation, communications and recovery steps.
- BCMS document control
- Version management ensuring BC documents have an identified owner, approval, distribution list, review date and change history, so users rely on current approved information.
- Tabletop exercise
- A discussion-based exercise where participants talk through a scenario and their response against plans, testing decision-making, roles and communications without deploying real resources.
- Full-scale exercise
- An operations-based exercise that mobilises actual people, facilities and systems to test end-to-end response and recovery, typically the most complex and costly type.
- Exercise programme
- A scheduled cycle of exercises of increasing complexity, each with defined objectives and scope, designed to validate plans and progressively build organisational capability.
- Internal BCMS audit
- An independent, planned evaluation of the BCMS against defined criteria and scope, conducted by impartial auditors, whose findings are reported to management and feed corrective action.
- Post-exercise review
- A structured debrief after an exercise or incident that captures what worked, what failed, root causes and assigned corrective actions with owners and deadlines.