CBCP flashcards
CBCP · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Business continuity program lifecycle
- Ten-phase sequence running from project initiation and management through risk evaluation, business impact analysis, strategies, emergency response, plan development, awareness and training, exercising and maintenance, crisis communications, and external coordination.
- Steering committee
- Cross-functional group of senior leaders that sponsors the continuity program, approves scope and budget, resolves conflicts between business units, and provides authority for program decisions.
- Continuity versus disaster recovery
- Business continuity restores all critical business functions after a disruption, while disaster recovery specifically restores IT infrastructure, systems, and data within defined recovery objectives.
- Annualized loss expectancy
- Calculated as annualized rate of occurrence multiplied by single loss expectancy; it estimates expected yearly financial loss from a specific risk and supports justification of mitigation spending.
- Risk treatment options
- Four standard responses to an identified risk: avoid the activity, transfer it through insurance or contracts, mitigate it with controls, or accept it with documented management approval.
- Residual risk
- The risk remaining after existing controls and mitigation measures are applied; it is compared against the organization's documented risk tolerance to decide if further action is required.
- Likelihood-impact matrix
- Qualitative risk tool that plots probability against consequence to rank risks as high, medium, or low, enabling prioritization of mitigation and continuity investment.
- Recovery time objective
- The maximum acceptable duration to restore a business function or system after disruption; it must always be shorter than the maximum tolerable downtime for that function.
- Maximum tolerable downtime
- The total time a business function can be unavailable before its impact becomes unacceptable; the BIA derives it from time-based impact analysis conducted with function owners.
- Recovery point objective
- The maximum acceptable amount of data loss measured in time before an incident; it determines backup frequency and replication method for supporting systems and applications.
- Business impact analysis
- Process that identifies time-critical functions, quantifies operational and financial impacts of their loss over time, and establishes recovery priorities, dependencies, and recovery objectives.
- Hot site
- Fully equipped alternate facility with hardware, connectivity, and replicated data ready to assume operations almost immediately; suited to functions with recovery time objectives of hours or less.
- Warm site
- Alternate facility with partial infrastructure and connectivity but no live data or fully configured systems; typically supports recovery within days rather than hours.
- Reciprocal agreement
- Arrangement in which another organization agrees to provide space or resources during a disaster; low cost but unreliable because both parties may be affected by the same event.
- Backup 3-2-1 rule
- Keep at least three copies of data on two different media types with one copy stored offsite, so a single incident cannot destroy all recoverable data.
- Life safety priority
- Fixed emergency response ordering: protect people first, then stabilize the incident and protect assets, and only then begin business continuity recovery activities.
- Emergency operations center
- Designated facility where the crisis team convenes with communications, information displays, and decision authority to manage the response; a backup EOC location must also be named.
- Incident command system
- Standardized, scalable command structure with incident commander, operations, planning, logistics, and finance roles used to manage emergencies, employing unified command for multi-agency events.
- Plan assumptions
- Documented conditions the plan presumes true, such as staff availability or an intact alternate site; they must be validated because invalid assumptions invalidate recovery capability.
- Document control
- Practice of assigning each plan a version number, owner, approval authority, distribution list, and revision history so responders use only the current approved procedures.
- Offsite plan access
- Requirement that plans stay retrievable when primary systems and buildings are unavailable, satisfied through hard copies, offsite storage, cloud repositories, or mobile applications.
- Awareness versus training
- Awareness builds general continuity understanding across all staff, while training develops the specific skills and procedures required by recovery teams, plan owners, and executives.
- Training triggers
- Events that require refresher training: new hire onboarding, role change, plan revision, exercise findings, and at minimum an annual cycle for every assigned team.
- Tabletop exercise
- Discussion-based exercise in which participants walk through a scenario and make decisions against the plan; low cost and effective for validating roles and interdependencies.
- Full-scale exercise
- Most complex exercise type, simulating a realistic incident with actual mobilization of people, systems, and alternate facilities to test recovery capability end to end.
- After-action report
- Document produced after an exercise or incident that records observations, strengths, gaps, and corrective actions with assigned owners and completion dates.
- Corrective action plan
- Tracked list of fixes derived from exercise or incident findings, each with a named owner, due date, and status, reviewed until every item is closed.
- Holding statement
- Pre-approved preliminary message released early in a crisis to acknowledge the event and commit to further updates before all facts have been confirmed.
- Crisis spokesperson
- Single designated and media-trained individual authorized to speak for the organization, ensuring consistent messaging and preventing unauthorized or speculative public statements.
- Dark site
- Pre-built but unpublished web page or website held ready to publish crisis information when the primary site is unavailable or overwhelmed by traffic.
- Mutual aid agreement
- Formal arrangement among organizations or jurisdictions to share resources and assistance during an emergency, defining request procedures and cost responsibilities in advance.
- Liaison officer
- Incident command role responsible for coordinating with external agencies, government representatives, and assisting organizations during an emergency response.