BCI CBCI - Certificate of the Business Continuity Institute (CBCI)

CBCI 7.0 expects visible leadership commitment because BCMS success depends on senior sponsorship, resourcing, and consistent messaging. When top management embraces BC, they actively support awareness, training, and engagement so BC becomes understood beyond the small group formally involved in the BCMS. The BCI’s PP2 guidance highlights that embracing business continuity is a process of education and awareness—reminding staff what is at stake and who depends on the organization’s products and services. Leaders who embrace BC amplify this through promoting awareness and training across the workforce.

Option A contradicts good practice: a BCMS should be aligned to organizational purpose and objectives, not independent. Option C is the opposite of the expected outcome. Option D describes weak governance—reviews only “if time permits” and slow follow-up—whereas leadership embrace typically strengthens governance cadence and improvement discipline. Therefore, B is the correct outcome.

Plans at different levels (strategic, tactical, operational) typically share common foundational elements: a clear purpose and scope, key assumptions, and objectives (C), so users understand when and how to apply the plan. They also usually include escalation guidance (A) so issues are raised to the right level quickly, and stand-down/transition procedures (D) so teams can safely return to normal operations and capture learning after resolution. These elements support coordinated response across the response structure.

However, risk assessments for each possible scenario (B) would not be included “at all levels” of plans. Risk assessment is a distinct analysis activity, and while plans may reference key threats or assumptions, they are generally not built as scenario-by-scenario risk assessment catalogues—especially not across every plan level. The BCI distinguishes BIA (impact over time) and Risk Assessment (risks to prioritised activities) as analysis techniques; plans then enable execution of the chosen solutions and response arrangements.

So, risk assessments may inform plans, but they are not a universal content component at every plan level. Therefore B is correct.

Recovery Point Objective (RPO) defines the maximum acceptable age of data to be recovered following a disruption, effectively setting the point in time to which information must be restored. The CBCI 7.0 course explains that RPOs vary depending on the priority and criticality of activities, requiring consultation with data users to ensure continuity needs are met accurately. RPOs are crucial for developing backup and data recovery strategies and directly influence the selection of technical solutions. While data protection compliance is necessary, it is not the primary function of RPO. Additionally, RPO focuses on data restoration points, not on the duration IT services can be disrupted—that relates to Recovery Time Objective (RTO).

The CBCI 7.0 course emphasizes that establishing and implementing a strategy aligned with business objectives is fundamental to enabling Business Continuity solutions. Business Continuity solutions must not only be technically sound but also directly support the organization's goals and priorities. Alignment ensures that continuity efforts contribute meaningfully to sustaining critical operations and delivering value during and after disruptions. This strategic approach drives resource allocation, prioritizes recovery efforts, and integrates continuity planning into broader organizational frameworks. While gap analyses, guidance documents, and policy reviews support solution enablement, without strategic alignment solutions risk being disconnected from business needs and may fail to gain management support or achieve desired outcomes.

CBCI 7.0 treats maintenance and review as part of ensuring the BCMS remains effective and fit for purpose over time. In BCI guidance, maintenance activities are commonly triggered by meaningful change—especially changes that alter risk, dependencies, or the organization’s operating context. A core trigger explicitly referenced in BCI Good Practice material is “changes to the environment in which the organization operates.” This includes shifts such as new geopolitical conditions, supply-chain volatility, technology changes, emerging threats, regulatory changes in the wider environment, or market/infrastructure changes that can invalidate assumptions in the BIA, strategies, plans, and response structures.

Option A therefore represents a direct and widely recognized trigger for BCMS maintenance. By contrast, option B (performance appraisal process) is usually an internal HR mechanism and only indirectly relevant unless it changes competence/accountability expectations for BC roles. Option C (external auditor changes) does not inherently change continuity capability. Option D (competitor organizational structure) is not a BCMS maintenance trigger in itself; benchmarking can inform improvement, but it doesn’t automatically require maintenance updates.

A gap analysis is a critical evaluation tool used in the Solutions Design phase to identify differences between existing Business Continuity capabilities and what is required to achieve organizational resilience. The CBCI 7.0 course specifies that this analysis determines if new or revised strategies and solutions are needed to meet Business Continuity requirements effectively. By comparing current states with desired outcomes, the gap analysis highlights areas lacking adequate controls, resources, or processes. It drives decision-making for prioritizing improvements and investments in continuity measures. This systematic assessment ensures that Business Continuity strategies are fit for purpose and aligned with evolving risks and business objectives. It is not focused on financial performance or audit justifications but on actionable capability enhancements.

The CBCI 7.0 course defines the Minimum Business Continuity Objective (MBCO) as the minimum level of services or outputs that must be maintained or restored to avoid unacceptable consequences. The MBCO is achieved either simultaneously with or after the Recovery Time Objective (RTO), as the RTO specifies when recovery should be complete for prioritized activities. MBCO sets a baseline for continuity, focusing on critical minimum outputs, rather than risk assessment milestones or managerial mobilization decisions. Understanding this sequencing supports realistic and measurable recovery planning.

Solutions Design (PP4) turns requirements from Analysis into practical strategies and solutions (for people, premises, technology, information, suppliers, etc.). Selecting workable solutions requires collaboration with the stakeholders who own the product/service delivery, activities, and critical resources, because they understand operational constraints, dependencies, performance expectations, and what “minimum acceptable capacity” really means in practice. This is reinforced by the CBCI module outline for PP4, which includes selecting strategies/solutions and mitigating unacceptable risks/single points of failure—work that depends on detailed operational input from owners.

The finance director may advise on affordability, but is not the primary partner for solution design decisions. A “department representative” is vague and may not have authority/knowledge of the specific priority activity or resource. Incident response team leaders focus on incident-time coordination, not necessarily on designing recovery capabilities. Therefore, partnering with the relevant product, activity, or resource owner (option C) is best practice and delivers solutions that are realistic, maintainable, and actually executable during disruption.

The CBCI 7.0 course details that using pre-defined impact thresholds is an effective and consistent method for prioritizing products, services, and activities during a BIA. These thresholds establish clear criteria for impact levels across various categories, such as financial loss, reputational damage, and regulatory consequences. By applying standardized thresholds, organizations can objectively assess and compare the criticality of different business functions, ensuring that prioritization aligns with organizational risk appetite and strategic objectives. This approach promotes consistency, transparency, and repeatability in BIA processes. While risk matrices and gap analyses are useful tools in risk management, pre-defined impact thresholds directly guide priority-setting within BIAs.

The CBCI 7.0 course emphasizes that an effective BCMS steering group must be multi-disciplinary, involving representatives from across the organization who understand different operational, financial, and strategic aspects. This diverse composition ensures that BCMS governance benefits from broad expertise and perspectives, enabling better decision-making and alignment with organizational objectives. Involving only Business Continuity professionals or top management limits insight, while external stakeholders like customers and suppliers, although valuable for input, are not typically part of the internal governance steering group. Multi-disciplinary teams enhance buy-in and help address continuity from all angles.