CBCLA cheat sheet

BIA purpose: identify time-critical business functions and the resources they depend on, and quantify the impact of their loss over time; it is the foundation for recovery objectives, not a risk list.

Recovery Time Objective (RTO) = maximum tolerable downtime before the impact becomes unacceptable; Recovery Point Objective (RPO) = maximum tolerable data loss measured in time.

Maximum Tolerable Downtime (MTD) is set by the business owner and must exceed RTO plus recovery time; RTO + recovery time <= MTD is the governing inequality.

Impact categories typically assessed: financial, regulatory/legal, operational, reputational, contractual, and safety; each is plotted against elapsed downtime to find the point of unacceptable impact.

Function prioritization tiers: critical (must restore within MTD), essential/degraded-tolerant, and deferrable; tiering drives strategy selection and resource allocation.

Dependency mapping captures upstream/downstream interdependencies (internal departments, suppliers, utilities, IT, people, facilities, records) because a low-impact function can gate a critical one.

Quantitative inputs include revenue per hour of downtime, transaction volume, SLA penalties, and recovery cost; qualitative inputs use owner judgment and impact ratings where data is absent.

BIA data collection methods: structured questionnaires, workshops, interviews with process owners, and review of process maps and financial records; validation by the function owner is required.

BIA outputs feed directly into strategy selection: MTD/RTO/RPO per function, prioritized function list, dependency map, and gap analysis against current capabilities.

Strategy selection rule: choose the lowest-cost option that satisfies the stated MTD/RTO/RPO; if no affordable option meets RTO, the business owner must accept, change, or fund the gap.

Recovery site types ranked by cost and speed: hot site (near-zero RTO, highest cost), warm site (hours to days), cold site (days to weeks), reciprocal agreement, and mobile/containerized solutions.

Data strategies: backups (RPO governed by backup frequency), replication (synchronous = near-zero RPO, asynchronous = minutes), snapshots, and journaling; verify restore capability, not just backup completion.

Workforce strategies: alternate site, work-from-home capability, cross-training, succession depth for key roles, and manual workaround procedures for degraded mode.

Supplier and technology strategies: redundant suppliers, contractual continuity clauses, alternate logistics routes, cloud multi-region deployment, and diverse telecommunications carriers.

Manual workarounds are a legitimate interim strategy for short MTDs; they must be documented, tested, and time-bounded because they usually cannot sustain operations indefinitely.

Strategy cost-benefit compares cost of the strategy against expected loss (annualized loss expectancy = single loss expectancy x annualized rate of occurrence).

Interdependencies constrain strategy: a strategy for one function is invalid if a shared dependency (identity system, network, building) has a longer recovery time.

Regulatory and contractual drivers (notification deadlines, data residency, sector rules) can mandate a strategy regardless of cost-benefit outcome.

Plan structure: purpose/scope, assumptions, roles and authority, activation and escalation criteria, communications, function-level procedures, dependencies, and appendices (contact lists, maps, vendor data).

Plan hierarchy: enterprise-level plan, business unit/functional plans, and incident-specific annexes (IT disaster recovery, crisis communications, pandemic, facility loss).

Roles must be named with at least two backups per role; the plan defines who declares a disaster, who has spending authority, and the succession order.

Activation criteria are objective thresholds (e.g., outage duration, casualties, facility inaccessibility), not subjective judgments, so activation is not delayed by debate.

Emergency operations center (EOC) location and an alternate EOC must be specified, along with equipment, connectivity, and a call-tree or notification tool.

Communications plan segments audiences: employees, customers, regulators, media, suppliers, and families; each has an owner, channel, message template, and approval path.

Plan writing standard: plain language, action verbs, role-based tasking, and version control with document owner, effective date, and distribution list.

Implementation requires awareness training for all staff, role-specific training for responders, and distribution of controlled copies or access to an online repository.

Assumptions must be documented and validated; an untested assumption (e.g., staff availability, vendor response) is a plan gap, not a plan feature.

Exercise types by increasing rigor: plan review/walkthrough, tabletop, functional drill, simulation, and full-scale live exercise; each validates different objectives.

Exercise program design: use a multi-year cycle that alternates types so every critical function and strategy is validated at least annually or per policy.

Exercise lifecycle: define scope and objectives, develop scenario, conduct, capture observations, produce after-action report (AAR), assign corrective actions with owners and due dates, track to closure.

Objectives must be observable and measurable (e.g., 'restore order entry within 4 hours'), otherwise results cannot be evaluated.

Tabletop exercises validate decision-making, roles, and communications; they do not validate technical recovery capability, which requires functional or full-scale tests.

Call-tree and notification tests measure contact-data accuracy; success rate below target indicates stale contact records requiring update.

Testing IT recovery requires actual restoration from backups to alternate infrastructure; a successful backup job is not evidence of recoverability.

Findings must feed the corrective action program; repeat findings across exercises indicate a systemic failure in plan maintenance or governance.

Exercise records (objectives, participants, timeline, findings, actions) provide audit evidence and support regulatory or certification requirements.

Maintenance triggers: scheduled review (typically annual), organizational change (merger, reorganization, new site), technology change, new critical supplier, audit findings, and post-incident lessons.

Plan review cycle must include re-validation of contact lists, RTO/RPO values, dependency maps, and vendor capabilities, not just document edits.

Program maturity models assess stages from ad hoc to optimized; assessment scores capability areas such as governance, BIA, strategy, plan, exercises, and maintenance.

Performance metrics: percentage of critical functions with validated RTOs, exercise completion rate, corrective actions closed on time, plan currency, and training completion.

Audit and assessment evidence includes approved plans, BIA reports, exercise AARs, corrective action logs, training records, and management review minutes.

Governance requires executive sponsorship, a defined program owner, documented policy, and periodic management review of program effectiveness.

Change management integration: a change process must trigger continuity review for changes affecting critical functions, dependencies, or recovery capabilities.

Gap analysis compares current capability against MTD/RTO/RPO requirements; unresolved gaps must be documented with risk acceptance at the appropriate authority level.

Third-party assessment: obtain and review supplier continuity evidence (certifications, test results, contractual commitments) and reassess at contract renewal or on material change.

BIA scope defines which products, services, and processes are analyzed; scope must align with the continuity program's stated mission and be approved by leadership.

Time-based impact curve: impact is measured at intervals (1 hour, 4 hours, 24 hours, 1 week) until it reaches the unacceptable threshold that sets MTD.

Data collection should separate 'as-is' capability from 'required' tolerance to expose the gap between current recovery and business need.

BIA results are invalid without owner sign-off; the function owner, not the continuity professional, owns the MTD and impact ratings.

Dependency on people includes key-person risk, required headcount, and specialized skills that cannot be quickly replaced.

Regulatory impact assessment identifies statutory reporting deadlines and penalties that may impose a shorter MTD than financial loss alone.

Strategy must be validated against the dependency chain: the slowest dependency sets the achievable RTO for the function.

Reciprocal agreements are low cost but fragile; they require written terms, capacity verification, and periodic testing to remain credible.

Cloud and virtualization strategies shift cost from capital to operating expense but require attention to data residency, provider outage risk, and exit plans.

Alternate workforce strategies must account for transportation disruption, childcare, and infrastructure loss affecting remote work.

Strategy documentation records the chosen approach, cost, assumptions, residual risk, and owner approval for each prioritized function.

Every procedure names the responsible role, the trigger, the steps, and the expected outcome so it can be executed by a backup.

Contact lists include primary and alternate channels and are stored offline as well as online because primary systems may be unavailable.

Plans must state assumptions about available staff, facilities, and supplier response so exercise results can test those assumptions explicitly.

Version control records document owner, approver, effective date, and revision history; uncontrolled copies are recalled on revision.

Plan activation authority is delegated in writing with a defined succession order to prevent delay when senior leaders are unavailable.

Scenario selection should target plausible, high-impact events and rotate scenarios across exercises to avoid validating only one threat.

Facilitators inject events to test decision-making; evaluators record observations against pre-defined objectives using a standard observation form.

A no-fault environment encourages honest reporting of failures, which improves the value of findings.

After-action reports state what was planned, what occurred, the gap, the root cause, and the corrective action with owner and due date.

Full-scale exercises require safety plans, participant briefings, and coordination with external responders; they are scheduled least frequently due to cost.

Exercise results should be reported to executive management to sustain sponsorship and fund corrective actions.

Plan currency metric: elapsed time since last review versus policy interval; overdue plans are a reportable governance finding.

Corrective action tracking requires status, owner, due date, and verification of effectiveness, not just closure marking.

Management review should assess changes in risk environment, exercise results, audit findings, and resource adequacy at planned intervals.

Training records demonstrate that responders were trained for their assigned roles within the required period.

Supplier reassessment is triggered by contract renewal, material service change, or a supplier incident affecting critical functions.

Risk acceptance for unresolved gaps must be documented, time-bound, and approved at a level with authority to accept the residual risk.

Certification and audit schemes require evidence of an annual maintenance cycle covering BIA, risk assessment, strategy, plan update, and exercise.