Fundamental principles and concepts of a business continuity management system
This domain tests the vocabulary and mental model behind a business continuity management system (BCMS): what continuity means, how a BCMS differs from a plan, and the principles that make it auditable and effective. Expect definition-based questions plus short scenarios that ask you to identify the principle being applied or violated.
Definitions that carry marks
Business continuity is the capability of an organization to continue delivery of products and services at acceptable predefined levels after a disruptive incident. A disruption is an incident that causes an unplanned, negative deviation from expected delivery. The BCMS is the part of the overall management system that establishes, implements, operates, monitors, reviews, maintains and improves business continuity. It is a management system, not a document.
Principles in practice
- Leadership and commitment: top management sets policy, objectives and responsibilities; continuity is not delegated solely to IT or facilities.
- Risk-based and evidence-based: decisions rest on business impact analysis (BIA) and risk assessment, not intuition.
- Proportionate: controls and plans fit the organization's size, context and legal obligations.
- Lifecycle and continual improvement: plan, implement, operate, review and improve; exercises and reviews keep it current.
- Holistic: includes people, suppliers, technology, facilities, information and dependencies.
Concepts to distinguish
A BIA identifies prioritized activities and their maximum tolerable period of disruption (MTPD), then derives recovery time objectives (RTOs). Risk assessment identifies threats to those activities. Strategies and solutions reduce risk and meet RTOs; plans and procedures codify response; exercises validate them.
Worked example
A payroll provider has a BCP stored on a shared drive but no BIA, no MTPD and no exercise record. Asked whether it has an effective BCMS, the answer is no. The plan may contain useful tasks, but without a BIA there is no evidence that prioritized activities and recovery priorities were determined; without exercises there is no evidence the plan works. The gap is not the absence of a document but the absence of the management-system processes.
Traps
Do not equate business continuity with disaster recovery: DR is mainly IT recovery, while continuity covers the whole organization. Do not treat the BCP as the BCMS. Do not assume certification is a one-off; it depends on continual improvement. Do not ignore suppliers and dependencies.