DRI International BCP Examination

Business Continuity

An ongoing process to ensure that the necessary steps are taken to identify the impact of potential losses and maintain viable recovery strategies, recovery plans, and continuity of services. (NFPA 1600)

Disaster Recovery

The technical aspect of business continuity. The collection of resources and activities to re-establish information technology services (including components such as infrastructure, telecommunications, systems,

applications and data) at an alternate site following a disruption of IT services. Disaster recovery includes subsequent resumption and restoration of those operations at a more permanent site. (DRJ)

Risk Assessment

The quantification of threats to an organization and the probability of them being realized. (BCI)

Business Impact Analysis

A method of identifying the effects of failing to perform a function or requirement. (FCD-1)

Recovery Time Objective

Time goal for the restoration and recovery of functions or resources based on the acceptable down time and acceptable level of performance in case of a disruption of operations. (ASIS)

Recovery Point Objective

Point to which information used by an activity must be restored to enable the activity to operate on resumption. ISO Editor's Note: Can also be referred to as "maximum data loss". (ISO 22301)

Crisis Management

The overall coordination of an organization's response to a crisis, in an effective, timely manner, with the goal of avoiding or minimizing damage to the organization's profitability, reputation, and ability to operate. (DRJ)

Incident Management

The process by which an organization responds to and controls an incident using emergency response procedures or plans. (DRJ)

Incident Response

The response of an organization to a disaster or other significant event that may significantly impact the organization, its people, or its ability to function productively. An incident response may include evacuation of a facility, initiating a disaster recovery plan, performing damage assessment, and any other measures necessary to bring an organization to a more stable status.

(DRJ)

The Business Continuity Professional's Role

1. Establish the need for a business continuity program

2. Obtain support and funding for the business continuity program

3. Build the organizational framework to support the business continuity program

Scope

The boundary, or extent, to which a process, procedure, certification, or contract applies - considers the whole entity.

Objectives

Documents what will be delivered at the end of the project and what benefit that will provide to the entity.

Assumptions

Documents the assumptions you are making regarding the program.

The steering committee should ..

Determine/establish objectives, program structure, critical success factors and be involved in project/program management

In which area of the professional practices would you develop teams for the Business Continuity program?

Program initiation and management

Leadership is accountable/liable for?

Understanding their legal responsibilities to the business continuity program. The laws, regulations, contractual/employment agreements.

How often should you conduct a risk assessment?

Annually or as significant changes occur.

What is the first professional practice for Business Continuity Management?

Program Initiation and Management

What is the second professional practice for Business Continuity Management?

Risk Assessment

What is the third professional practice for Business Continuity Management?

Business Impact Analysis

What is the fourth professional practice for Business Continuity Management?

Business Continuity Strategies

What is the fifth professional practice for Business Continuity Management?

Incident Response

What is the sixth professional practice for Business Continuity Management?

Plan development and implementation

What is the seventh professional practice for Business Continuity Management?

Awareness and training programs

What is the eighth professional practice for Business Continuity Management?

Business continuity plan exercise, assessment, and maintenance

What is the ninth professional practice for Business Continuity Management?

Crisis communications

What is the tenth professional practice for Business Continuity Management?

Coordination with external agencies

To establish the need for a business continuity program you must:

Reference legal and regulatory requirements, reference relevant standards, show the benefits of the program within the context of the organization's mission.

Leadership is accountable and liable to know:

Their legal responsibilities including: applicable laws, regulations, and contractual and employment agreements.

What must you present to leadership to establish the need for business continuity management?

Legal and regulatory requirements

In which professional practice would you identify teams that will support the business continuity program implementation?

Program initiation and management

What is the role of the business continuity steering committee?

To implement objectives, program structure, and critical success factors.

Is program management a part of the steering committees role?

Yes, they help manage the business continuity program.

In which of the three elements of a business continuity plan would you put exclusions?

In the scope.

Who is legally responsible for the business continuity program and outcomes?

The CEO and leadership.

What information should be presented to leadership about the need for business continuity?

Legal and regulatory requirements.

Which team is responsible for defining the objectives, structure, policies, and charter for the business continuity program?

The steering committee.

What is the most critical element to the success of the business continuity planning effort?

Leadership commitment.

Which team provides resources and support to the business continuity program?

The steering committee.

The most important role for the business continuity professional in performing a risk assessment is?

To determine the probability and impact of the identified risks.

To collect data for risk assessments and BIA's one must use a combination of what methods?

Forms and questionnaires, interviews and meetings.

How often should a risk assessment be conducted?

Annually or as significant changes occur

The three most important sources of risk are?

Natural phenomena, technological exposure, human acts

Risk Appetite

The amount of risk that an organization is prepared to accept, tolerate, or be exposed to at any point in time.

The purpose of identifying and evaluating the effectiveness of existing controls is?

To mitigate impact exposures

Evaluating the effectiveness of controls involves?

Identifying the existing controls that are in place

Implementing controls and procedures ________?

Minimizes risk

Necessary changes in order to reduce the impact of identified risks include:

Changes to physical protection and changes to cyber security and information technology.

Resilience

The adaptive capacity of an organization in a complex and changing environment

Controls

Processes, procedures, or devices that prevent or mitigate impact exposures/risks

What is the number one emerging supply chain risk?

Cyber attack

Business interruption insurance

The requirement for calculation of adequate

insurance, covering financial loss due to temporary business cessation.

Extra expense insurance

Pays for extra expenses to maintain operations after an accident to an insured item until normal operations can be restored.

Contingent business interruption insurance

Reimburses for lost profits and extra expenses. due to an interruption relating to a customer or supplier.

What are the primary objectives of conducting a risk assessment?

To understand the entity's exposure to loss and evaluate the effectiveness of controls and safeguards.

What is describes mitigation?

Reducing risk

What is an objective of performing a risk assessment?

To identify risks that can adversely affect an entity's resources.

What are examples of quantitative impacts?

Percentages, numbers, money

What are examples of qualitative impacts?

High, medium, low

What is the number one objective of the BIA?

To prioritize functions and processes based on the level of criticality and time sensitivity

What is the second objective of the BIA?

To determine the recovery objectives for core and support functions and processes.

What is the third objective of the BIA?

To analyze the findings to ascertain any gaps between the entity's requirements and it's ability to deliver those requirements.

A BIA sets requirements not?

Strategies

Recovery Point Objective

The amount of data that you can tolerate to lose. Data that is not on the backup.

What is the primary goal of the BIA?

To gain acceptance of the RTO and RPO for each operational area

Sole Source Supplier

The only supplier of that resource, no other options.

Single Source Supplier

The only supplier that you choose to supply your resource, however there are other options out there.

What is one of the last steps in the BIA process?

To prepare a gap analysis

What are example gaps?

Resource, time, and data gaps

Impact should determine?

The frequency of backups

The greater the impact from lost data the?

More frequently backups should be completed

Objective of the BIA?

Entity function/process criticality and time sensitivity

What is the first planning professional practice?

Business Continuity Srategies

What is the objective for the professional practice: Business continuity strategies

Select cost-effective strategies to reduce deficiencies as identified during the risk assessment and business impact analysis (BIA) processes

Who is responsible for developing business continuity strategies?

The functional area manager

What is the difference between a regulation and a standard?

Regulations are enforceable by external agencies and you have to comply with them. While standards are not enforced and you can conform to them, they resemble best practices.

What are the four life safety procedures?

Evacuation, sheltering, shelter-in-place, and lockdown

Reciprocal Agreements need to be documented in what way?

External agreements need to be documented in writing.