CBCLA study plan

Map the full BIA lifecycle (initiate, gather data, analyze, document, obtain sign-off, maintain) and write a one-page flow of the steps and their inputs and outputs

Define and distinguish BIA terms precisely: business function, process, activity, criticality tier, RTO, RPO, MTD/MAO, dependency, and single point of failure

Practice deriving RTO from MTD using a worked example with a stated financial and operational impact curve, showing the calculation steps

Build a reusable data-collection template (interview questions plus a questionnaire) that captures function owner, dependencies, volume drivers, and impact over time

Construct a fictional organization with 8-10 business functions and rank them into criticality tiers using documented impact criteria

Quantify impact across categories (financial, regulatory, reputational, operational, safety) at 1-hour, 4-hour, 24-hour, and 72-hour outage intervals

Identify upstream and downstream dependencies for two functions and note where a single vendor or system creates concentrated risk

Draft the sections of a BIA report: scope, methodology, findings, prioritization table, assumptions, and recommendations

Compare continuity strategy options for people, facilities, technology, data, and suppliers, stating cost, recovery speed, and risk tradeoffs for each

Select a recovery tier (for example cold, warm, hot, or cloud-based) for three functions and justify the choice against their RTO and RPO

Design alternate site and remote-work arrangements, including workspace capacity, connectivity, and travel or notification logistics

Define data backup and restoration strategy elements: frequency, retention, offsite or immutable copies, encryption, and restoration testing cadence

Evaluate third-party and supply-chain continuity strategies, including contractual requirements, alternate suppliers, and vendor BIA review

Write strategy-level assumptions and dependencies that must be validated later, and flag which ones are unverified

Translate the strategy matrix into a plan outline: purpose, scope, assumptions, roles, activation criteria, and appendices

Identify the plan's core team roles and define decision authority for activation and escalation

Write detailed recovery procedures for two critical functions, sequenced by time and including decision points and owners

Draft the notification and escalation section, including call trees, alternate contact methods, and a message template for staff, customers, and regulators

Build the emergency operations center and alternate-location section, covering setup, equipment, and shift handover

Integrate the plan with related documents (crisis communications, IT disaster recovery, incident response) and note interfaces and conflicts

Complete the plan with appendices: contact rosters, resource inventories, vendor lists, maps or site details, and forms

Define the plan maintenance process, including review triggers, version control, distribution list, and document ownership

Write an implementation roadmap that sequences awareness training, plan distribution, and exercise scheduling

Review the plan against a self-built quality checklist covering completeness, clarity, actionability, and traceability to BIA findings

Design an exercise program with a progression from plan review to tabletop to functional drill, stating objectives and success criteria for each

Write a tabletop exercise scenario with injects, a facilitation guide, and observable evaluation criteria tied to RTOs and decisions

Create an after-action report and corrective action template with owners, due dates, and severity levels

Define maintenance metrics such as exercise completion rate, corrective action closure rate, and plan review currency

Run a self-facilitated tabletop on the week 6 plan and record observations against the evaluation criteria

Convert exercise findings into a corrective action log and update the plan where gaps were confirmed

Revisit BIA prioritization, strategy choices, and plan procedures to confirm consistency after the exercise changes

Complete timed practice questions across all four domains and log weak areas with a targeted review list