MBCP cheat sheet

Business continuity management (BCM) is a holistic management process that identifies potential threats and builds resilience to safeguard stakeholder interests, reputation, brand, and value-creating activities.

BCM lifecycle order: program initiation and management, risk and BIA, strategy selection, plan development, exercising and testing, assessment and maintenance, and embedding into culture.

BCM scope is set by the governing body and must cover all products, services, and locations; scope statements define boundaries, exclusions, and dependencies.

The BC professional's authority derives from a documented mandate (policy or charter) approved by top management; without sponsorship, the program lacks enforcement power.

Program governance typically uses a steering committee, a coordinator/manager, and business unit coordinators who own recovery for their functions.

BCM aligns with but is distinct from risk management, crisis management, emergency response, and IT disaster recovery; DR is a subset focused on technology recovery.

Key deliverables of the program phase: BCM policy, scope statement, governance structure, budget, awareness plan, and program schedule.

Standards landscape: ISO 22301 (requirements), ISO 22313 (guidance), and ISO 22300 (vocabulary) anchor professional practice.

Risk assessment identifies threats, likelihood, and impact, and evaluates existing controls; its output feeds BIA and strategy selection.

Risk = likelihood x impact; risks are ranked and treated via avoid, reduce, transfer, or accept.

Threat categories include natural, technological, human-caused, and supply-chain; each threat is mapped to affected assets, processes, and dependencies.

A risk register records threat, vulnerability, likelihood, impact, current controls, residual risk, owner, and treatment action.

Single points of failure are dependencies with no alternate; they are prioritized for mitigation regardless of aggregate risk score.

Interdependency analysis maps internal and external dependencies (suppliers, utilities, telecom, third parties) and their recovery requirements.

Risk appetite is the amount of risk an organization is willing to accept; risk tolerance is the acceptable deviation from that appetite.

The output of risk assessment is a prioritized list of risks and mitigation options that constrain subsequent BIA and strategy decisions.

BIA purpose: quantify the operational and financial impact of a disruption over time and identify time-sensitive processes and their recovery requirements.

RTO (Recovery Time Objective) = maximum tolerable downtime before impact becomes unacceptable; MTPD (Maximum Tolerable Period of Disruption) is the outer limit and RTO must be <= MTPD.

RPO (Recovery Point Objective) = maximum tolerable data loss, expressed as time; it drives backup and replication frequency.

Impact is assessed across dimensions: financial, operational, legal/regulatory, reputational, and safety; impacts escalate non-linearly with time.

Process criticality tiers commonly: critical (RTO hours to <1 day), essential (1-3 days), important (up to 1 week), and deferrable.

Minimum business continuity objective (MBCO) is the minimum acceptable service level during a disruption; it may be below normal service levels.

BIA data is gathered via structured interviews, workshops, and questionnaires completed by process owners, then validated and signed off by management.

Dependencies identified in the BIA (people, technology, facilities, suppliers, data) become inputs to strategy selection and plan development.

Strategy selection matches recovery requirements (RTO/RPO/MBCO) from the BIA to feasible, cost-justified recovery options for each critical process.

Recovery options are evaluated on cost, risk reduction, feasibility, and time to recover; the chosen option must meet the RTO at acceptable cost.

Facility strategies: hot site (fully equipped, near-instant), warm site (partially equipped, hours to days), cold site (shell, days to weeks), and reciprocal agreements.

Technology strategies: redundancy (active-active, active-passive), replication (synchronous meets RPO=0, asynchronous allows some data loss), and backup/restore (long RTO/RPO).

Workforce strategies: alternate locations, work-from-home, cross-training, and staff rotation; people recovery is often the binding constraint.

Supplier strategies: dual sourcing, buffer stock, contractual continuity requirements, and pre-qualified alternate vendors.

The strategy document states the selected approach per critical process, the rationale, dependencies, and estimated cost, and requires management approval.

Strategy selection is iterative: if no affordable option meets the RTO, the business may accept a longer RTO or reduce the required service level, documented as a management decision.

The BCP is a structured set of documents: policy, BIA and risk results, strategies, plans (emergency response, crisis communication, business recovery, IT DR), and appendices.

Plan hierarchy: emergency response (life safety) -> crisis management (coordination and communication) -> business recovery (process restoration) -> IT DR (technology restoration).

Each plan contains purpose, scope, assumptions, roles and responsibilities, activation criteria, procedures, contact lists, resource requirements, and appendices.

Activation criteria define the threshold events (e.g., facility unavailable, IT outage exceeding X hours) that trigger plan invocation and who may declare a disaster.

The crisis management team (CMT) coordinates the overall response; the incident commander or BC coordinator directs recovery operations.

Call trees and notification procedures must specify primary and alternate contact methods, escalation timing, and confirmation of receipt.

Plans must be written for the audience and usable under stress: clear steps, decision trees, checklists, and readily available in alternate formats/locations.

Plans reference but do not duplicate the BIA and strategy documents; version control and document ownership are defined for every plan component.

Plan development translates approved strategies into documented procedures, roles, resources, and timelines that can be executed during a disruption.

Implementation phases: finalize plans, obtain management approval, secure resources and budget, train staff, conduct awareness activities, and schedule exercises.

Roles must be assigned with named primary and at least one alternate for every critical function; role cards describe duties, authority, and reporting lines.

Training builds competence (how to perform recovery tasks); awareness builds general understanding (what to do and who to call) across all staff.

Resource requirements (facilities, systems, supplies, vendors, communications) are identified per strategy and confirmed as available before plan approval.

Plans must be distributed to those who need them and stored in multiple accessible locations (physical and electronic) that survive the disruption they address.

Approval and sign-off by business owners and senior management establish authority and accountability for the plan and its maintenance.

Lessons from exercises and incidents feed back into plan revisions through a documented change control process.

Exercise types increase in complexity: plan review/walkthrough, tabletop, simulation, functional drill, and full-scale exercise.

A tabletop exercise is discussion-based, low cost, and used to validate plans, roles, and decision-making without activating systems.

A functional exercise tests specific capabilities or systems in a controlled environment; a full-scale exercise tests the entire plan with realistic conditions.

Exercise program design uses a multi-year cycle that progressively tests all plan components and critical processes.

Each exercise has documented objectives, scope, scenario, participants, injects, and evaluation criteria defined before execution.

Evaluation captures observed performance against objectives, identifies gaps, and produces an after-action report (AAR) with corrective actions, owners, and due dates.

Metrics for exercise effectiveness include objective achievement rate, time to activate, time to recover tested functions, and closure rate of corrective actions.

Exercises test not only procedures but also assumptions, interdependencies, communications, and the adequacy of the strategies chosen.

Assessment verifies that the BCM program conforms to its policy and standards and is capable of meeting its objectives.

Assessment methods include self-assessment, peer review, internal audit, and external/third-party audit; independence increases with method rigor.

BCM performance metrics (KPIs) include BIA completion, plan coverage of critical processes, exercise completion, and corrective action closure rate.

Maintenance ensures plans, BIAs, and risk assessments are reviewed and updated on a defined cycle and after significant change.

Triggers for plan update include organizational restructuring, new products/services, new technology, facility changes, supplier changes, and lessons from exercises or incidents.

A change management process links business/IT changes to BCM impact assessment so plans are updated before the change goes live.

Corrective action tracking records each gap, its root cause, the assigned owner, due date, and verification of closure.

Management review at planned intervals evaluates BCM performance, audit results, and improvement opportunities, and directs program changes.

Crisis communication provides timely, accurate, approved information to internal and external stakeholders during a disruption.

Stakeholder groups include employees, customers, suppliers, regulators, media, investors, and the community; each has distinct information needs and channels.

A crisis communication plan defines spokespersons, approval authority for messages, message templates, channels, and escalation timing.

Communication must be coordinated with the crisis management team to ensure a single source of truth and consistent messaging.

Notification systems (mass notification, call trees, alerting tools) require redundancy and periodic testing of reachability.

Regulatory and contractual notification obligations (e.g., data breach, safety, financial) have defined time limits that must be built into the plan.

Pre-scripted holding statements and Q&A reduce response time and error during the first hours of an incident.

Post-crisis communication includes ongoing updates, stakeholder reassurance, and lessons learned communicated to the organization.

Embedding BCM into the organization's culture is a program objective; it requires awareness, training, and alignment with performance management.

Awareness activities include onboarding, intranet content, briefings, and role-based training that make BCM part of normal operations.

BCM competency requirements are defined per role; training records demonstrate that staff can perform their assigned recovery tasks.

Supply chain continuity requires extending BCM expectations to critical suppliers via contracts, due diligence, and joint exercises.

BCM should be integrated with related disciplines (risk management, security, emergency management, IT service continuity) to avoid duplication.

Performance management links BCM responsibilities to job descriptions and objectives so accountability is reinforced.

Maturity models assess BCM capability across levels (e.g., from ad hoc to optimized) and guide improvement planning.

Continuous improvement uses assessment results, exercise findings, and management review to prioritize and fund program enhancements.