I85PREP
⌘ K
CBCP study materials
CBCP study resources

CBCP practice questions

One question at a time. Build your CBCP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Program Initiation and Management

Which document establishes the authority, scope, and objectives of an organization's business continuity program and is typically approved by senior management?

  1. The completed business impact analysis report
  2. The crisis communications plan
  3. The business continuity policy Correct answer.
  4. The exercise and maintenance schedule

Explanation

The policy statement is the founding document of the program: it records top management's intent, defines scope and objectives, assigns authority and responsibility, and mandates the program across the organization. Plans, analyses, and schedules are later artifacts produced under that authority.

Question 2Program Initiation and Management

Which role is primarily accountable for securing executive support, funding, and organizational commitment for the business continuity program?

  1. The business continuity coordinator
  2. The facilities manager
  3. The recovery team leader
  4. The executive sponsor Correct answer.

Explanation

The executive sponsor provides sponsorship at the senior level: securing budget, removing organizational obstacles, and lending authority to the program. The coordinator runs the program day to day under that sponsorship.

Question 3Program Initiation and Management

A newly appointed continuity manager is defining program scope. Which action best accomplishes this?

  1. Adopting the previous manager's plan templates
  2. Identifying the units, sites, and third parties covered Correct answer.
  3. Selecting a recovery software vendor
  4. Inventorying every server, network device, and application in the data center

Explanation

Scope defines which parts of the organization - business units, facilities, geographies, and critical third parties - the program is accountable for, and that boundary drives the BIA and planning effort. Detailed asset data supports later analysis but does not define the boundary.

Question 4Program Initiation and Management

What is the primary function of a business continuity steering committee?

  1. Writing detailed recovery procedures for each department and all of its key suppliers
  2. Providing governance, setting priorities, and resolving cross-functional issues Correct answer.
  3. Conducting the business impact analysis interviews
  4. Operating the alternate recovery site during an incident

Explanation

A steering committee is a governance body: it sets direction, approves policy and priorities, allocates resources, and breaks deadlocks across departments. Execution work such as writing procedures or conducting interviews belongs to the working teams.

Question 5Program Initiation and Management

An organization must satisfy business continuity requirements from regulators, customers, and a standard it has voluntarily adopted. Which approach is most effective?

  1. Wait until the industry consolidates its requirements
  2. Harmonize requirements into one framework mapped to each source Correct answer.
  3. Maintain a separate, dedicated program for each individual source
  4. Comply only with the most stringent of the regulator requirements

Explanation

Requirements from different sources overlap heavily but are worded differently, so mapping them into a single framework avoids duplicated effort and conflicting controls while preserving demonstrable compliance with each source. Separate programs multiply cost and produce inconsistent responses to the same disruption.

Question 6Program Initiation and Management

Approval of the organization's business continuity policy is the responsibility of:

  1. The facilities and security manager
  2. Top management and the governing body Correct answer.
  3. The external audit firm
  4. The continuity coordinator

Explanation

Policy expresses top management's intent, so approval must come from the highest level of the organization; that authority is what makes the program binding across departments. Coordinators draft and maintain the policy but cannot approve it.

Question 7Program Initiation and Management

Which basis provides the strongest justification for funding a business continuity program?

  1. It was recommended by the recovery software vendor
  2. It reflects common practice among peer organizations
  3. It quantifies the financial and operational impact of disruption Correct answer.
  4. It was requested by the internal audit department

Explanation

Funding competes with other investments, so the case must be expressed in the terms executives use: quantified loss exposure, regulatory and contractual exposure, and risk reduction. Peer practice may support a proposal but does not justify an investment on its own.

Question 8Program Initiation and Management

Which behavior best demonstrates the top management commitment required by ISO 22301?

  1. Establishing policy and integrating continuity into processes Correct answer.
  2. Leading every exercise and documenting the results
  3. Personally authoring recovery procedures for all critical systems
  4. Conducting all business impact analysis interviews

Explanation

ISO 22301 places leadership with top management: establishing policy and objectives, integrating continuity into business processes, providing resources, and directing improvement. Execution activities are delegated; accountability is not.

Question 9Program Initiation and Management

Which measure best indicates the health of a business continuity program?

  1. Total number of pages in the plan documents
  2. Plans exercised against defined objectives Correct answer.
  3. Number of staff assigned to the continuity office
  4. Number of servers covered by backup software

Explanation

Program health is judged by whether plans work when tested against stated objectives and whether identified gaps get closed. Activity counts and documentation volume do not show whether the organization could actually recover.

Question 10Program Initiation and Management

Which event should trigger a review and update of business continuity plans?

  1. The quarterly all-staff meeting
  2. A change in the marketing communications campaign
  3. The annual budget approval cycle for the organization
  4. A merger or a new critical system implementation Correct answer.

Explanation

Plans describe the organization as it was when written, so anything altering critical functions, dependencies, technology, or key people invalidates parts of them. Significant change such as a merger, new critical system, restructure, or new site must trigger review.

Question 11Program Initiation and Management

A continuity manager must justify a resilience investment. Which comparison best supports the business case?

  1. The number of vendor proposals received for the project
  2. Headcount of the departments that would be affected
  3. Expected loss avoided versus total investment cost Correct answer.
  4. The duration of the previous year's exercise

Explanation

A defensible business case compares the risk reduction produced by the investment with its cost, typically expected loss avoided over a period against total cost of ownership. That places the proposal on the same footing as competing capital requests.

Question 12Program Initiation and Management

Which set of items belongs in a business continuity program charter?

  1. The emergency contact list for all staff
  2. Scope, objectives, milestones, roles, resources, and deliverables Correct answer.
  3. Detailed findings from the most recent BIA
  4. Recovery scripts for the payroll and ERP systems

Explanation

The charter authorizes the program and defines what will be delivered, by whom, when, and with what resources, which enables governance and progress tracking. Technical procedures, contact data, and analysis findings are produced later in the lifecycle.

Question 13Program Initiation and Management

Which activity is a core responsibility of the business continuity coordinator?

  1. Conducting the independent external audit
  2. Serving as the sole author of every recovery procedure
  3. Approving the organization's annual operating budget and capital plan
  4. Managing day-to-day program planning, scheduling, and reporting Correct answer.

Explanation

The coordinator is the program's operating manager: maintaining the plan set, scheduling BIAs and exercises, tracking corrective actions, and reporting status to management. Budget approval and independent audit sit outside the role by design.

Question 14Program Initiation and Management

Which approach most effectively builds lasting business continuity awareness?

  1. Requiring staff to memorize the emergency contact list
  2. Role-based training with periodic refreshers Correct answer.
  3. Posting the continuity policy on the intranet home page
  4. Emailing the complete plan to all staff once a year

Explanation

Awareness persists when content is relevant to the individual's role and repeated over time, such as induction training, role-specific material, and refreshers tied to exercises. One-off distribution of a document produces little retention.

Question 15Program Initiation and Management

An organization has limited funding and no continuity capability yet. Which initiative should be funded first?

  1. Certification of the program to an international standard
  2. Alternate workspace for every department
  3. A business impact analysis to identify priorities Correct answer.
  4. A full-time recovery team for each business unit

Explanation

Priorities must be set from evidence about which functions and dependencies matter most, and the BIA and risk assessment supply that evidence. Without them, limited funds are likely to be committed to low-value recovery capability.

Question 16Program Initiation and Management

Why should a program plan include defined milestones and a timeline?

  1. To reduce the frequency of plan exercises
  2. To satisfy the terms of software license agreements
  3. To sequence work and track progress Correct answer.
  4. To record recovery time objectives for each process

Explanation

Milestones convert program scope into a sequenced plan that can be tracked, resourced, and reported, which sustains sponsor confidence and surfaces slippage early. They do not substitute for other program activities such as exercising or status reporting.

Question 17Program Initiation and Management

How does a business continuity program differ from a business continuity plan?

  1. The program is written by auditors; the plan is written by IT
  2. The program applies only in incidents; the plan applies daily
  3. The program is the ongoing process; the plan is its output Correct answer.
  4. The program covers only IT; the plan covers everything

Explanation

The program is the continuous management system - governance, policy, BIA, planning, exercising, maintenance, and improvement - and plans are among its products. Confusing the two leads organizations to treat continuity as a document rather than a capability.

Question 18Program Initiation and Management

Which third parties should be included within the scope of a business continuity program?

  1. Those whose failure would disrupt critical functions Correct answer.
  2. Only suppliers named in the annual audit report
  3. Only vendors that hold a valid continuity certification
  4. Only vendors located within the same country

Explanation

Scope follows dependency: any supplier, outsourcer, or service provider whose failure could interrupt a critical function belongs in the program, regardless of certification status or location. Certification may reduce assurance effort but is not the test for inclusion.

Question 19Program Initiation and Management

Senior management asks how much confidence the organization can place in its continuity program. Which action provides the most objective answer?

  1. Counting the number of recovery exercises conducted
  2. Surveying staff on how prepared they feel
  3. Reviewing the plan documents for completeness
  4. An independent assessment against a recognized standard Correct answer.

Explanation

Independent assessment against a recognized standard or framework tests the program against external criteria and produces evidence rather than opinion, which is the most defensible basis for a confidence statement. Self-review and perception surveys are weaker forms of assurance.

Question 20Program Initiation and Management

A customer contract requires continuity capability. How should this requirement be handled during program initiation?

  1. Delegate the obligation to the sales account manager
  2. Capture it as a program requirement Correct answer.
  3. Record it in the plan without further action
  4. Renegotiate the contract to remove the obligation

Explanation

Contractual obligations act as requirements on the program just as regulations do, so they must be captured during initiation and reflected in scope, objectives, and reporting. Ignoring them creates legal and commercial exposure.

Question 21Risk Evaluation and Control

A facility has a single loss expectancy of $200,000 for a flood event and an annualized rate of occurrence of 0.1. What is the annualized loss expectancy?

  1. $2,000,000
  2. $2,000
  3. $20,000 Correct answer.
  4. $200,000

Explanation

Annualized loss expectancy equals single loss expectancy multiplied by the annualized rate of occurrence. Here, $200,000 multiplied by 0.1 yields $20,000. This figure expresses the expected loss per year from that threat and is used to justify control spending.

Question 22Risk Evaluation and Control

An organization purchases a cyber insurance policy to cover potential breach costs. Which risk treatment option does this represent?

  1. Risk acceptance
  2. Risk transfer Correct answer.
  3. Risk mitigation
  4. Risk avoidance

Explanation

Risk transfer shifts the financial consequence of a risk to a third party, commonly through insurance or contractual arrangements. The organization retains accountability for the risk even though the loss is shared with the insurer. Transfer does not by itself reduce the likelihood of the event.

Question 23Risk Evaluation and Control

What is residual risk?

  1. The total risk present before any controls are applied
  2. The risk that is documented only in audit findings
  3. The risk remaining after controls and treatment are applied Correct answer.
  4. The risk found during the asset inventory stage

Explanation

Residual risk is what remains once existing controls and chosen treatments have been applied. It is the figure management compares against risk tolerance when deciding whether further action is needed. Inherent risk, by contrast, is assessed before controls are considered.

Question 24Risk Evaluation and Control

Which term describes the amount of risk an organization is willing to accept at a high level in pursuit of its objectives?

  1. Risk appetite Correct answer.
  2. Risk capacity
  3. Risk tolerance
  4. Residual risk

Explanation

Risk appetite is the broad, board-level statement of how much risk the organization is willing to take on to achieve its objectives. Tolerance translates that appetite into specific, measurable limits at operational levels. Capacity is the maximum risk the organization could bear before failure.

Question 25Risk Evaluation and Control

What is the primary purpose of a business impact analysis within a risk evaluation program?

  1. To identify time-sensitive processes and the impact of their disruption Correct answer.
  2. To assign a monetary value to each identified threat source
  3. To catalogue every hardware asset and record its purchase cost
  4. To test whether firewalls and intrusion detection are correctly tuned

Explanation

A business impact analysis identifies critical business processes and quantifies the operational and financial consequences of their disruption over time. Its outputs, such as maximum tolerable downtime and recovery objectives, drive continuity and control decisions. It is not an asset inventory or a technical control test.

Question 26Risk Evaluation and Control

A 5 by 5 risk matrix typically plots which two dimensions?

  1. Cost and schedule
  2. Threat and control cost
  3. Likelihood and impact Correct answer.
  4. Vulnerability and asset value

Explanation

A risk matrix places likelihood on one axis and impact on the other so that each risk receives a rating from the intersection of the two. This supports consistent prioritization and visual comparison of risks. Both scales are usually defined by documented criteria to reduce subjectivity.

Question 27Risk Evaluation and Control

Which statement best describes a qualitative risk analysis?

  1. It requires actuarial data on the frequency of past events
  2. It derives annualized loss expectancy from historical incident data
  3. It ranks risk using descriptive scales such as high, medium, and low Correct answer.
  4. It produces a monetary loss figure for every assessed asset

Explanation

Qualitative analysis uses descriptive or ordinal scales to rank risk without calculating precise monetary values. It is fast and useful where reliable loss data is unavailable. Quantitative approaches, by contrast, express risk in financial terms using frequency and loss estimates.

Question 28Risk Evaluation and Control

An asset is valued at $500,000. A threat event is expected to destroy 40 percent of the asset's value. What is the single loss expectancy?

  1. $200,000 Correct answer.
  2. $40,000
  3. $500,000
  4. $1,250,000

Explanation

Single loss expectancy equals asset value multiplied by the exposure factor. Here, $500,000 multiplied by 0.40 equals $200,000. The annualized loss expectancy would then multiply this figure by the annualized rate of occurrence.

Question 29Risk Evaluation and Control

Which of the following is a detective control?

  1. Restoring systems from backup after an outage
  2. Reviewing alerts generated by an intrusion detection system Correct answer.
  3. Requiring badge access at the data centre entrance
  4. Encrypting data at rest on production servers

Explanation

Detective controls identify and report events after or while they occur, enabling a response. Alert monitoring by an intrusion detection system is a classic example. Preventive controls stop events, while corrective controls restore operations afterwards.

Question 30Risk Evaluation and Control

Which element is essential in a risk register entry?

  1. The risk owner and the current risk rating Correct answer.
  2. The physical floor plan of the data centre
  3. The vendor's published product roadmap
  4. The number of employees in each department

Explanation

A risk register must record who owns each risk and what its current rating is so that accountability and monitoring are clear. Entries also typically include the risk description, affected assets, existing controls, and treatment plans. Supporting reference material may be attached but is not essential to the entry.

Question 31Risk Evaluation and Control

An organization discontinues an online payment feature rather than accept the fraud exposure it creates. Which risk treatment option has been applied?

  1. Risk transfer
  2. Risk avoidance Correct answer.
  3. Risk mitigation
  4. Risk acceptance

Explanation

Avoidance eliminates the risk by removing the activity that generates it. Discontinuing the feature means the associated fraud exposure no longer exists in that form. Mitigation would instead retain the activity while reducing likelihood or impact.

Question 32Risk Evaluation and Control

A risk heat map is primarily used to:

  1. Communicate the relative severity of risks to decision makers Correct answer.
  2. Calculate the annualized cost of each implemented control
  3. Verify that backups restore within the recovery time objective
  4. Document the technical configuration of servers

Explanation

A heat map plots risks by likelihood and impact to give a visual summary of relative severity. Its main value is communication, helping executives and risk committees see where exposure concentrates. It does not itself compute control costs or validate recovery capability.

Question 33Risk Evaluation and Control

Which statement correctly distinguishes a threat from a vulnerability?

  1. A threat exists only after an incident; a vulnerability exists only before it
  2. A threat can cause harm; a vulnerability is a weakness a threat may exploit Correct answer.
  3. A threat is a measured loss; a vulnerability is the probability of that loss
  4. A threat is a weakness in a control; a vulnerability is an external attacker

Explanation

A threat is any potential source of harm, such as an attacker, malware, or a natural hazard. A vulnerability is a weakness in an asset, process, or control that a threat could exploit. Risk arises from the interaction of threats, vulnerabilities, and impact.

Question 34Risk Evaluation and Control

The recovery point objective for a system defines:

  1. The maximum acceptable amount of data loss measured in time Correct answer.
  2. How long a system may be unavailable before harm occurs
  3. The project milestone at which risk is reassessed
  4. The elapsed time needed to rebuild the primary data centre

Explanation

The recovery point objective sets the acceptable data loss expressed as a period of time before the disruption, which drives backup frequency. The recovery time objective, by contrast, addresses how quickly service must be restored. Both are derived from business impact analysis findings.

Question 35Risk Evaluation and Control

A proposed control costs $30,000 per year and is expected to reduce annualized loss by $50,000. What is the appropriate conclusion?

  1. The control provides no measurable benefit because losses are uncertain
  2. The control is cost-beneficial and should be recommended for approval Correct answer.
  3. The control should be rejected because controls are not evaluated financially
  4. The control should be rejected because its cost exceeds the asset value

Explanation

Cost-benefit analysis compares the annual cost of a control with the annualized loss it is expected to prevent. Here the reduction of $50,000 exceeds the $30,000 cost, producing a positive net benefit. Residual risk after implementation should also be confirmed as within tolerance.

Question 36Risk Evaluation and Control

Which activity is normally performed first when conducting a risk assessment?

  1. Reporting the aggregate risk position to the board
  2. Calculating residual risk for the risk register
  3. Selecting compensating controls for each identified risk
  4. Identifying and valuing the assets within scope Correct answer.

Explanation

Risk assessment begins by defining scope and identifying the assets and processes that could be affected, since threats and impacts cannot be evaluated without them. Threat and vulnerability identification follows, then analysis and evaluation. Treatment selection, residual calculation, and reporting come later.

Question 37Risk Evaluation and Control

An asset is valued at $2,000,000. A threat is expected twice per year and would destroy 10 percent of the asset each time. A control costing $50,000 per year would prevent the loss entirely. What is the net annual benefit of the control?

  1. $350,000 Correct answer.
  2. $300,000
  3. $150,000
  4. $400,000

Explanation

Single loss expectancy is $2,000,000 multiplied by 0.10, or $200,000; multiplied by an annualized rate of occurrence of 2 gives an annualized loss expectancy of $400,000. Subtracting the $50,000 annual control cost yields a net benefit of $350,000. The control is therefore strongly justified on financial grounds.

Question 38Risk Evaluation and Control

During aggregation, a business unit's combined risk exposure is found to exceed the tolerance set by the board. What is the most appropriate action for the risk practitioner?

  1. Remove low-rated individual risks until the total falls within tolerance
  2. Escalate the aggregated exposure to senior management for a decision Correct answer.
  3. Purchase insurance and close the risk without further review
  4. Lower the rating in the register so it aligns with tolerance

Explanation

Aggregated exposure above tolerance is a governance matter that requires a decision by those with authority to accept risk or fund treatment. The practitioner's role is to present the exposure clearly and escalate it, not to alter the data. Risk ratings must reflect evidence, and closing risks administratively defeats the purpose of the register.

Question 39Risk Evaluation and Control

A business impact analysis establishes a maximum tolerable downtime of 12 hours for a critical process. Which recovery time objective is consistent with that finding?

  1. 8 hours Correct answer.
  2. 48 hours
  3. 24 hours
  4. 18 hours

Explanation

The recovery time objective must be shorter than the maximum tolerable downtime, leaving margin for recovery to complete before intolerable harm occurs. An objective of 8 hours sits inside the 12-hour threshold. Objectives that exceed the threshold would permit the organization to breach its own tolerance.

Question 40Risk Evaluation and Control

After treatment, a residual risk remains above the organization's appetite. Who is normally accountable for deciding whether to accept it?

  1. The internal audit function
  2. The external auditor engaged by the board
  3. The business risk owner with delegated authority Correct answer.
  4. The technician who implemented the control

Explanation

Risk acceptance is an accountability of the business owner who has delegated authority over the activity and its consequences. Practitioners and auditors provide analysis and assurance but do not own the risk. Acceptance should be documented with a rationale and reviewed at defined intervals.

Question 41Business Impact Analysis

What is the primary purpose of a business impact analysis?

  1. To document the security controls that protect each production application
  2. To estimate the likelihood that each identified threat will affect the organization
  3. To calculate the insurance limits needed for each business unit and site
  4. To identify time-critical functions and measure the impact of their loss Correct answer.

Explanation

A BIA identifies which business functions are time-sensitive and quantifies the consequences of their disruption across time. Likelihood estimation and control documentation belong to risk assessment and security reviews, not to the BIA.

Question 42Business Impact Analysis

How is the recovery time objective (RTO) best defined?

  1. The target time to restore a function before impact becomes unacceptable Correct answer.
  2. The interval between the last successful backup and the point of failure
  3. The volume of data, expressed in hours, that may be lost during an outage
  4. The total time required to rebuild the primary data center after a disaster

Explanation

The RTO is the target elapsed time within which a function and its supporting resources must be restored so that impact stays within tolerance. It is derived from business impact, not from the technical duration of a rebuild.

Question 43Business Impact Analysis

The recovery point objective (RPO) expresses which of the following?

  1. The maximum data loss the business can tolerate, expressed as time Correct answer.
  2. The point during an outage at which management declares a disaster
  3. The elapsed time allowed to bring an application back into service
  4. The share of transactions that may be reprocessed manually after recovery

Explanation

The RPO defines the maximum acceptable data loss measured in time, which in turn sets the required backup or replication frequency. It is a business tolerance for lost data, not a restoration duration.

Question 44Business Impact Analysis

What does the maximum tolerable downtime (MTD) represent?

  1. The longest outage a function can absorb before unacceptable harm Correct answer.
  2. The downtime permitted for non-critical systems during maintenance windows
  3. The duration of the longest outage recorded for the function to date
  4. The time needed to fail over to the alternate processing site and back

Explanation

The MTD is the outer boundary of disruption a function can endure before the consequences become unacceptable, such as irreversible financial or regulatory harm. Recovery objectives must be set so that restoration occurs within this window.

Question 45Business Impact Analysis

Who is best positioned to provide BIA input about a business function's time sensitivities?

  1. The manager who owns and operates that business function Correct answer.
  2. The corporate legal counsel responsible for regulatory filings
  3. The network operations team that monitors the supporting servers
  4. The external audit firm engaged to review the continuity program

Explanation

The business owner understands the workflow, the customers, and the consequences of interruption, so that person supplies the impact judgments. Technical teams and auditors supply supporting evidence and assurance rather than the business tolerance itself.

Question 46Business Impact Analysis

Which of the following best defines the scope of a business impact analysis?

  1. The set of recovery strategies pre-approved by executive management
  2. The catalog of threats, probabilities, and vulnerabilities affecting the enterprise
  3. The processes and units analyzed and the depth of analysis Correct answer.
  4. The list of hardware assets and their replacement costs at each location

Explanation

BIA scope states which business processes and organizational units are in the analysis and how detailed the analysis will be. Threat catalogs, asset inventories, and strategy choices are separate products that may consume BIA output.

Question 47Business Impact Analysis

Which grouping represents the impact categories commonly assessed in a BIA?

  1. Preventive, detective, corrective, and compensating
  2. Financial, operational, legal and regulatory, and reputational Correct answer.
  3. Probability, threat, vulnerability, and exposure
  4. Confidentiality, integrity, availability, and non-repudiation

Explanation

Impact categories describe the kinds of harm a disruption causes, typically financial, operational, legal and regulatory, and reputational. The other groupings describe risk factors, information security attributes, and control types.

Question 48Business Impact Analysis

Why does a BIA document internal and external dependencies for each function?

  1. To assign accountability for outages to the responsible vendor or department
  2. To satisfy the licensing requirements of the primary software vendor
  3. To reduce the organization's cyber insurance premiums at renewal
  4. To expose shared resources and single points of failure Correct answer.

Explanation

Dependency mapping reveals the people, systems, suppliers, and facilities a function relies on and highlights shared resources whose loss would cascade across functions. This information shapes recovery strategies and reveals concentration risk.

Question 49Business Impact Analysis

Which data collection approach yields the most consistent, comparable results across many business units?

  1. A single workshop attended by the executive team only
  2. A standardized questionnaire, followed by validation interviews Correct answer.
  3. Reviews of prior incident tickets submitted by each unit
  4. Reliance on the recovery time targets already published by vendors

Explanation

A common questionnaire applies identical definitions and scales to every unit, and follow-up interviews validate and clarify the responses. Incident tickets and vendor targets describe different things and cannot be compared on a common scale.

Question 50Business Impact Analysis

In a BIA, how is a function's recovery time objective derived?

  1. From the point where impact over time becomes unacceptable Correct answer.
  2. From the frequency of the backup cycle maintained by the IT department
  3. From the average duration of the function's three longest past outages
  4. From the response time guaranteed in the supporting vendor's contract

Explanation

The BIA builds an impact-over-time curve for each function; the point at which impact crosses the tolerance threshold establishes the recovery deadline. Technical constraints and contractual service levels are then tested against that business-derived target.