CBCI (Business Continuity Certifications) key terms

A documented management system that establishes, implements, operates, monitors, reviews, maintains, and improves business continuity across an organization. It includes policies, objectives, processes, roles, and resources.

A formal statement from top management that sets the organization’s business continuity intent, principles, and commitments. It authorizes the programme and provides a framework for setting continuity objectives.

The coordinated set of ongoing activities, responsibilities, and resources an organization uses to build, maintain, and improve its business continuity capability. It is broader than a single plan.

The defined boundaries of the business continuity management system, including organizational units, locations, products, services, activities, and exclusions. Clear scope prevents gaps and overlap in continuity planning.

Visible leadership support and accountability for business continuity, shown through policy approval, resource allocation, role assignment, and participation in reviews and exercises.

A periodic, top-management evaluation of the business continuity management system’s suitability, adequacy, and effectiveness. It considers performance, risks, audit results, and opportunities for improvement and leads to decisions.

An independent, systematic examination of the business continuity management system against planned arrangements and requirements. It identifies conformity, gaps, and improvement opportunities before external audits or incidents.

Action taken to eliminate the cause of a detected nonconformity or undesirable situation so it does not recur. It includes investigating the cause, planning action, and reviewing effectiveness.

The recurring process of enhancing business continuity performance and the management system. It uses objectives, monitoring, audit findings, reviews, exercises, and corrective actions to drive lasting change.

A four-step improvement cycle: Plan establishes objectives and processes; Do implements them; Check monitors results; Act addresses differences and improves. It underpins many business continuity management system standards.

Integrating business continuity into everyday organizational values, decisions, processes, and behaviors so it becomes routine rather than a standalone project. It relies on leadership, communication, training, and performance incentives.

Ensuring staff understand the business continuity policy, their roles, and how to respond to disruption at a basic level. Awareness builds recognition and prompts appropriate action without requiring deep technical knowledge.

Structured learning that develops the specific knowledge and skills people need to perform business continuity roles and tasks. It is planned, recorded, and matched to responsibilities and identified needs.

The demonstrated ability to apply knowledge and skills to perform business continuity responsibilities effectively. It is built through education, training, experience, and assessment against defined role requirements.

The shared values, beliefs, and behaviors that determine how seriously an organization treats disruption and continuity. A strong culture encourages reporting, learning, preparedness, and challenge rather than blind compliance.

A process that identifies and evaluates the effects of disruption on business activities over time. It determines criticality, dependencies, and recovery priorities, supporting decisions on continuity strategies and resource needs.

A systematic process of identifying, analyzing, and evaluating risks to business activities and continuity capabilities. It considers likelihood, impact, existing controls, and whether further treatment is needed.

The target time within which an activity, service, or resource must be restored after disruption to keep impacts within acceptable limits. It drives recovery design and is usually shorter than the maximum tolerable period.

The maximum acceptable amount of data loss measured in time before a disruption. It guides backup and replication design, especially for information systems supporting critical business activities.

The longest time an organization can tolerate disruption to an activity before unacceptable consequences occur. It sets the outer limit for recovery and helps derive recovery time objectives.

The minimum level of product or service, and supporting capacity, that must be restored within a defined time after disruption. It defines acceptable recovery output rather than full normal service.

A business function or process whose disruption would cause unacceptable harm to the organization, stakeholders, or obligations. It receives priority in impact analysis, strategy selection, and recovery planning.

A reliance of one activity, resource, or organization on another to deliver expected outputs. Dependencies may be internal or external and must be mapped to understand disruption exposure.

A two-way reliance where activities, systems, or organizations depend on each other. Interdependencies can create cascading failures and complicate recovery sequencing and prioritization.

A person, component, supplier, system, or location whose failure would disrupt a critical activity because no adequate alternative exists. Identifying these focuses resilience and recovery investment.

The chosen approach for protecting critical activities and achieving recovery objectives. It specifies capabilities, resources, and arrangements such as alternate sites, supplier options, and technology resilience.

A pre-identified location or work environment used to continue or recover critical activities when the normal site is unavailable. It may be dedicated, shared, or provided through remote working arrangements.

The people, facilities, technology, information, suppliers, and equipment needed to execute continuity strategies and plans. They must be identified, available, and maintained for recovery to be credible.

Documented procedures and information that guide an organization to respond to and recover from disruption within agreed objectives. It covers roles, activation, communications, resources, and recovery steps.

The coordinated response to an unplanned event, focusing on containment, assessment, escalation, and restoration of normal operations. It provides structure and clear roles during the early disruption phase.

The strategic coordination of an organization’s response to a major disruption, including decision-making, stakeholder communication, and reputation protection. It addresses wider consequences beyond operational incident handling.

Immediate actions taken to protect life, health, property, and the environment during an emergency. It precedes or overlaps with business continuity and crisis response and often follows emergency services guidance.

The decision and process of putting a business continuity plan into effect. It includes trigger criteria, authority to invoke, notification, and initial actions to mobilize the response team.

A planned activity that rehearses business continuity arrangements to build competence, test assumptions, and identify improvements. Exercises range from discussion-based reviews to full simulations and should be evaluated.

A controlled evaluation of a specific component, system, or procedure against expected performance, often with pass or fail criteria. Testing verifies technical recovery and operational readiness rather than broader team behavior.

The overall process of confirming that business continuity arrangements are fit for purpose and can achieve recovery objectives. It combines exercises, tests, reviews, and assurance activities to build justified confidence.

The ongoing review and updating of business continuity arrangements to keep them accurate, available, and effective as the organization, risks, and dependencies change. It includes ownership, change triggers, and scheduled reviews.

Insights captured after an exercise, test, or actual disruption about what worked, what failed, and what should change. They are turned into actions, assigned owners, and tracked to completion.