MBCP key terms

A structured process that identifies time-sensitive business functions and quantifies the effect of their disruption over time, producing recovery priorities and requirements that drive continuity strategy selection.

The longest period a business function can be unavailable before the organization suffers unacceptable harm, such as irreversible financial loss, regulatory breach, or loss of reputation.

The target elapsed time within which a function, system, or process must be restored after disruption, set at or inside the maximum tolerable downtime to leave room for decision-making.

The maximum acceptable amount of data, measured in time, that may be lost in a disruption, which determines backup frequency and replication design.

The demonstrated or measured time a recovery capability actually takes, validated through exercises and tests, as opposed to the time the plan assumes it will take.

The ongoing, organization-wide management system of policies, roles, processes, and resources that builds and sustains resilience capability across the full lifecycle from analysis to continuous improvement.

Documented procedures and information that guide an organization in responding to and recovering from disruption, covering roles, communications, resource requirements, and prioritized restoration of critical functions.

The selected combination of approaches, such as alternate sites, redundancy, manual workarounds, and third-party arrangements, chosen to meet the recovery requirements identified for prioritized functions.

The decision process that weighs cost against risk reduction and recovery capability to choose strategies that satisfy recovery objectives within the organization's risk appetite and budget.

A pre-identified location or capability, such as a cold, warm, or hot site or a mutual aid arrangement, used to continue prioritized operations when the primary facility is unavailable.

The strategy and arrangements that provide usable workspace, technology, and equipment for staff whose normal location is inaccessible, including seating capacity and connectivity provisions.

The process of identifying threats and hazards, estimating likelihood and impact, and evaluating resulting risk against tolerances so that continuity effort is directed where it matters most.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, which sets the boundary for accepting, treating, transferring, or avoiding continuity risks.

The chosen response to an identified risk, such as mitigation, avoidance, transfer through insurance, or acceptance, recorded with an owner and target date.

The systematic cataloguing of natural, technological, human-caused, and supply-related events that could disrupt operations, used as input to risk and impact analysis.

A process or activity whose disruption would cause unacceptable harm to the organization within a defined period, and which therefore receives priority for recovery resources.

The documentation of internal and external relationships on which a function relies, including suppliers, systems, people, facilities, and utilities, used to expose single points of failure.

The capability to anticipate, absorb, and recover from disruption affecting suppliers, logistics, or service providers, achieved through visibility, diversification, and contractual continuity requirements.

The assurance that external providers can meet the organization's recovery requirements, verified through due diligence, contractual service levels, and joint testing.

The documented structure for strategic decision-making, escalation, and stakeholder communication during a significant disruption, distinct from the operational recovery procedures in the business continuity plan.

The pre-planned processes, channels, spokespeople, and message templates used to inform employees, customers, regulators, and media accurately and consistently during a disruption.

The structured flow of information to internal and external parties with an interest in the organization's continuity status, including timing, ownership, and escalation paths.

The immediate actions taken to detect, contain, and stabilize an event, forming the front end of the continuity lifecycle before recovery procedures are invoked.

The life-safety actions taken at the moment of an incident, such as evacuation, sheltering, and medical assistance, which take precedence over all recovery activity.

The authorized decision, based on defined triggers and thresholds, to invoke the business continuity plan and mobilize the response and recovery teams.

The scheduled and event-driven process of reviewing, updating, and re-approving continuity documentation so it remains accurate as people, systems, and risks change.

A planned activity that validates plans, capabilities, and team readiness, ranging from discussion-based formats such as tabletop sessions to operations-based formats such as drills and full simulations.

A discussion-based session in which participants work through a scenario and make decisions in a low-stress setting to surface gaps in plans, roles, and coordination.

An operations-based exercise that replicates realistic conditions and stressors, often with live systems or role players, to test recovery capability under pressure.

A controlled verification that a specific component, such as a backup restoration, generator start, or failover, performs as designed, producing a pass or fail result.

The document produced after an exercise or real incident that records observations, identifies capability gaps, and assigns corrective actions with owners and due dates.

A tracked list of remediation items arising from exercises, audits, or incidents, with assigned responsibility, target dates, and status reporting to management.

A measure of how embedded, measured, and continuously improved the continuity capability is, often assessed against a staged model from ad hoc activity to optimized practice.

Independent or structured review of the continuity program against policy, standards, and regulatory expectations, producing findings and assurance for governance bodies.

Quantitative indicators, such as recovery capability against objectives, exercise completion, and gap closure rates, used to demonstrate and steer program effectiveness.

The ongoing program that builds staff understanding of continuity roles and equips responders with the specific skills needed to execute their assigned responsibilities.

Documented evidence that personnel have received and retained the training required for their continuity roles, supporting auditability and succession planning.

The structures, policies, and accountability mechanisms through which leadership directs, oversees, and is answerable for the continuity program's performance and risk decisions.

A senior-level statement defining the organization's continuity intent, scope, principles, and responsibilities, and authorizing the program that implements it.

The shared values and behaviors through which employees at all levels recognize, prepare for, and respond to disruption as part of normal work rather than an isolated specialist duty.

The comparison of the cost of a continuity measure against the reduction in expected loss it delivers, used to justify strategy and investment decisions.