Business Continuity and Crisis Management
Business Continuity and Crisis Management
This domain tests whether you can keep critical administrative services running during disruption and manage the crisis response. Expect questions on business impact analysis, recovery time objectives, recovery point objectives, plan testing, and crisis communication.
Core rules
- Business continuity is the capability to continue delivery at acceptable predefined levels after disruption. Crisis management is the command, communication and decision structure for a high-impact event.
- A business impact analysis identifies critical activities, dependencies, maximum tolerable downtime, recovery time objective (RTO) and recovery point objective (RPO).
- Plans should cover people, premises, technology, suppliers and records. Alternate arrangements may be manual workarounds, remote work or third-party sites.
- Test the plan: tabletop, walkthrough and live exercise. Record lessons and update the plan. Crisis communication needs pre-approved spokespersons and stakeholder lists.
Worked example
A fire damages the records room. The business impact analysis shows statutory registers and board minutes are critical; the maximum tolerable downtime is 24 hours. The RTO is 24 hours and the RPO for scanned records is 4 hours. The plan activates off-site backup retrieval, a temporary registry at another office, and a communication script for the board and regulator. A tabletop exercise reveals that the backup index is outdated; the team fixes it before the next test. Reasoning: the plan is only credible if the RTO is matched by a tested recovery capability.
Traps
- Presenting a plan with no test evidence.
- Confusing disaster recovery (IT systems) with business continuity (critical services).
- Setting an RTO without a business impact analysis.
- Forgetting crisis communication and regulatory notification.