BCI CBCI - Certificate of the Business Continuity Institute (CBCI)

Solutions Design (PP4) uses BC requirements from Analysis (PP3)—including RTOs and minimum acceptable capacity—to decide which strategies and solutions must be implemented first and where investment provides the most protection to priority delivery. An urgent/short RTO means the organization has very limited time before impacts become unacceptable; therefore, solutions supporting those activities typically require earlier funding and stronger capability (e.g., automation, replication, standby arrangements, pre-positioned resources). Prioritising spend against the most urgent RTOs is a direct, requirement-led approach and aligns investment to what the organization must recover fastest to survive disruption.

Option B is poor practice: not all strategies carry equal criticality—some protect essential delivery while others are “nice to have.” Option C can create inconsistent priorities across departments and undermine enterprise-wide optimization; owners contribute, but prioritisation must be governed centrally against agreed requirements. Option D focuses on cost rather than necessity; “cheap” solutions may fail to meet recovery requirements. Therefore, the correct approach is A: prioritize solutions for the shortest and most urgent RTOs.

In CBCI 7.0 (based on the BCI GPG Edition 7.0), Solutions Design (PP4) is where the organization determines how it will meet its business continuity requirements identified in Analysis (PP3). PP3 outputs—especially risk assessment results—are key inputs into PP4 so that proposed strategies and solutions address real disruption risks and resource vulnerabilities.

Assessing viability is not only about whether a solution meets recovery requirements; it must also be justified and sustainable. The GPG highlights that strategies and solutions must meet BC requirements while remaining considerate of costs and benefits, noting that mitigation cost should not exceed disruption cost or create secondary risk.

Horizon scanning fits this same viability purpose: it helps anticipate emerging external threats, trends, and changes that could invalidate a solution over time, ensuring chosen strategies remain fit-for-purpose as the operating environment evolves. This is consistent with the GPG emphasis on designing solutions that remain appropriate to the organization’s needs and context, rather than selecting options in isolation.

In CBCI 7.0 (aligned with BCI GPG 7.0), PP1 – Establishing a BCMS includes defining the scope of the BCMS as a foundational activity. Scoping decisions must be rational, risk-informed, and aligned to what the organization must protect to survive disruption—especially the delivery of its products and services and achievement of organizational objectives.

Among the answer options, financial value is a legitimate scoping consideration because it directly relates to business objectives (income, margin, cashflow, contractual value, and critical revenue streams). A product/service that generates significant revenue or underpins strategic outcomes typically warrants inclusion, because disruption would quickly create unacceptable impacts and threaten viability.

By contrast, consultation with staff is an important method for gathering inputs, but it is not, by itself, a primary criterion for deciding scope. “Ease of incorporation” is not good-practice justification for inclusion (scope is set by business need, not convenience). Competitor approaches may be interesting context, but scope should be determined by the organization’s own objectives, obligations, and dependency landscape, not benchmarking alone.

The CBCI 7.0 course explains that defining the BCMS scope is a dynamic process, which means that the parameters set are not necessarily permanent and may be reviewed and revised as organizational needs, risks, and priorities evolve. While the scope provides clarity on which parts of the organization, products, services, and activities are included, it must remain flexible to adapt to change. Permanent or fixed parameters risk locking the BCMS into outdated or incomplete coverage, reducing effectiveness. Efficient use of time and resources is a benefit of appropriate scoping, but permanence is not a characteristic of good scope definition.

In CBCI 7.0 (aligned with GPG 7.0 practice), Validation includes exercising and testing to confirm that arrangements and plans work as intended and that people understand their roles. A discussion-based exercise is specifically designed as a low-pressure environment where participants talk through roles, decisions, and plan steps, often using a hypothetical situation to prompt discussion. This format is widely used to help teams explore issues, clarify responsibilities, and identify gaps without the cost, stress, or operational impact of a live simulation.

That is why option D is correct.

A scenario (table-top) exercise is often discussion-based, but the defining feature in the question is the exercise type that is explicitly low-pressure and walk-through in nature—this matches “discussion-based.” A simulation exercise is typically more realistic and pressured (sometimes involving time compression, actual call-outs, or technical failover), and therefore not the best match. “Investigative” is not the standard label for this low-pressure walk-through category in common BC exercise groupings. Discussion-based exercises are often used early to build confidence and validate understanding before moving to more demanding exercise types.

Embracing Business Continuity increases commitment to ongoing maintenance, including regular plan reviews and updates, to ensure plans remain effective and relevant. The CBCI 7.0 course highlights that a strong Business Continuity culture does not reduce maintenance needs; rather, it ensures such activities are prioritized and valued. Reduction in maintenance requirements would signal neglect, risking preparedness. Other outcomes include prioritization of tasks and external recognition of Business Continuity’s value.

While communication plans, team structure, and exercising escalation and response are essential for an effective Business Continuity response structure, specific guidance on regulator notification, although important, is not typically considered a core structural element. The CBCI 7.0 course outlines that regulatory communications are usually integrated within communication plans but are not a standalone requirement for response structures. The focus remains on establishing clear roles, responsibilities, and communication mechanisms.

The CBCI 7.0 course advises that when establishing a BCMS, an initial focused scope limited to high-value or critical parts of the organization is practical to manage complexity and costs effectively. This allows targeted efforts on areas that pose the greatest risks or have the most significant impact on continuity. Over time, the scope can be expanded as maturity develops. Including everything initially or focusing only on IT disaster recovery limits effectiveness or overcomplicates early efforts, respectively. Crisis management is part of BCMS but not the sole focus of the initial scope.

When establishing a BCMS, good practice is to create governance that supports informed decisions, prioritisation, and cross-functional coordination. The BCI’s guidance explicitly recognises the value of a steering group/team to “oversee, advise and make recommendations to top management,” ensuring the programme is guided by the right expertise and stakeholder perspectives rather than being driven by one function alone. This fits the purpose of PP1 (Establishing a BCMS), which includes establishing high-level governance and coordinating interrelated activities such as scope, policy, objectives, and roles/responsibilities.

Options A and B rely on coercion (rules/mandatory obligations). While participation is important, “forcing” engagement often undermines ownership and culture—whereas a steering group creates structured, senior-supported engagement and clearer accountability. Option D can be useful for specific inputs (e.g., supplier continuity requirements), but routinely inviting external parties into BCMS establishment is not the core good-practice governance mechanism; external expectations are normally managed through contracts, SLAs, assurance, and stakeholder communications rather than open-ended participation in internal governance.

Protecting priority activities and meeting their RTOs involves developing and implementing effective strategies and solutions that address unacceptable risks and single points of failure. The CBCI 7.0 course explains that after identifying risks and critical points, creating approved and actionable mitigation strategies is essential to limit disruption impacts and ensure recovery within targeted timeframes. While risk assessments and BIAs inform these strategies, it is the actual development and approval of solutions that directly safeguard continuity. Grouping risks by owner is part of the process but does not itself provide protection.