MBCP flashcards
MBCP · Build recall with a focused review session.
34 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Business continuity management
- A holistic management process that identifies potential threats and builds organizational resilience to protect stakeholders, reputation, brand, and value-creating activities.
- BCM program mandate
- A documented policy or charter approved by top management that grants authority, scope, and resources to the business continuity program.
- BCM steering committee
- A governance body of senior leaders that oversees the continuity program, approves strategy and budget, and resolves cross-functional issues.
- ISO 22301
- The international standard specifying requirements for a business continuity management system, used for certification and program conformance.
- Risk assessment
- The process of identifying threats, estimating likelihood and impact, evaluating existing controls, and ranking risks to inform continuity decisions.
- Risk register
- A record of identified risks with likelihood, impact, existing controls, residual risk, owner, and planned treatment actions.
- Single point of failure
- A dependency with no alternate or redundancy whose failure alone can disrupt a critical process; prioritized for mitigation.
- Risk appetite versus tolerance
- Risk appetite is the amount of risk an organization is willing to accept; tolerance is the acceptable deviation from that appetite.
- Recovery time objective
- The maximum acceptable time to restore a process or system after disruption; it must be less than or equal to the MTPD.
- Maximum tolerable period of disruption
- The outer limit of time a disruption can last before impacts become unacceptable to the organization and its stakeholders.
- Recovery point objective
- The maximum acceptable amount of data loss measured in time, which drives backup frequency and replication design.
- Minimum business continuity objective
- The minimum acceptable level of service an organization must provide during a disruption, which may be below normal service levels.
- BIA data collection
- Structured interviews, workshops, and questionnaires completed by process owners, then validated and signed off by management.
- Hot site
- A fully equipped alternate facility with systems and infrastructure ready for near-immediate occupancy and operations.
- Warm site
- A partially equipped alternate facility requiring hours to days to become operational after activation.
- Cold site
- A shell facility with basic infrastructure but no pre-installed equipment, requiring days to weeks to become operational.
- Synchronous replication
- Data is written to the primary and secondary sites simultaneously, achieving an RPO of zero but requiring low latency.
- Strategy selection criteria
- Recovery options are evaluated on cost, risk reduction, feasibility, and time to recover against the BIA-derived RTO.
- Plan hierarchy
- Emergency response for life safety, crisis management for coordination, business recovery for processes, and IT disaster recovery for technology.
- Activation criteria
- Predefined threshold events and authorized roles that determine when a continuity plan is formally invoked.
- Crisis management team
- A senior cross-functional group that coordinates the overall response, sets priorities, and communicates during a disruption.
- Call tree
- A documented notification cascade specifying who contacts whom, by what method, and within what timeframe, with confirmation of receipt.
- Role cards
- Documents describing each recovery role's duties, authority, reporting lines, and named primary and alternate assignees.
- Training versus awareness
- Training builds competence to perform recovery tasks; awareness builds general understanding of what to do and whom to contact.
- Plan distribution
- Storing and providing plans in multiple accessible physical and electronic locations that survive the disruption they address.
- Tabletop exercise
- A discussion-based exercise that validates plans, roles, and decision-making without activating systems or facilities.
- Full-scale exercise
- A realistic exercise that tests the entire plan and all critical capabilities under simulated operational conditions.
- After-action report
- A post-exercise document capturing performance against objectives, identified gaps, and corrective actions with owners and due dates.
- Exercise program cycle
- A multi-year schedule of progressively complex exercises designed to test all plan components and critical processes over time.
- BCM audit independence
- Assessment rigor increases from self-assessment to peer review to internal audit to external audit, with independence rising accordingly.
- Plan maintenance triggers
- Events requiring plan updates: restructuring, new services, technology or facility changes, supplier changes, and exercise findings.
- Crisis communication plan
- A plan defining spokespersons, message approval authority, templates, channels, and timing for stakeholder communication during disruption.
- Supply chain continuity
- Extending continuity requirements to critical suppliers through contracts, due diligence, alternate sourcing, and joint exercises.
- BCM maturity model
- A framework that assesses continuity capability across progressive levels, from ad hoc practices to optimized continuous improvement.