Business Continuity and Resilience Flashcards

Question 1

What is business continuity planning, and what goals does it pursue?

Accepted Answer

Business continuity planning is the process of preparing an organization to keep its critical functions running during and after a disruption. Its main goals are protecting people, limiting financial and operational losses, meeting legal and contractual obligations, and restoring normal operations within acceptable timeframes. It is proactive, documented, and reviewed regularly.

Question 2

What counts as a business disruption that continuity planning should address?

Accepted Answer

A business disruption is any event that interrupts normal operations, whether it is an outage or a prolonged loss of facilities, staff, technology, suppliers, or utilities. Causes include severe weather, fire, power failure, cyberattacks, equipment breakdown, pandemics, and labor disputes. Continuity planning considers sudden shocks and gradual threats, since either can stop critical work.

Question 3

How does organizational resilience differ from business continuity?

Accepted Answer

Business continuity focuses on specific plans and procedures that keep critical functions operating and recover them after an incident. Organizational resilience is a broader capability, describing how well an organization anticipates, absorbs, adapts to, and recovers from many kinds of stress over time. Continuity is one important component of resilience, not a replacement for it.

Question 4

Why is business continuity management usually described as an ongoing lifecycle rather than a one time project?

Accepted Answer

Business continuity management is an ongoing cycle because organizations, technology, suppliers, and threats keep changing, so plans become outdated without regular attention. Work moves through understanding needs, designing responses, implementing them, testing, and reviewing results to improve. Treating it as a one-time project leads to plans that nobody remembers or trusts when an incident occurs.

Question 5

What does the term critical business function mean in continuity planning?

Accepted Answer

A critical business function is an activity whose interruption would cause unacceptable harm, such as lost revenue, safety risks, legal penalties, or damage to customers. Examples include payroll, order processing, patient care, and emergency communications. Identifying these functions first tells planners where limited time, money, and attention should go.

Question 6

Which stakeholders should usually be involved when building a continuity program?

Accepted Answer

Effective programs involve senior leadership for authority and funding, operational managers who understand daily work, and staff who perform the tasks. Information technology, facilities, human resources, legal, finance, procurement, and communications teams also contribute essential knowledge. Including external partners such as key suppliers and emergency services helps reveal dependencies that internal teams may overlook.

Question 7

Why does executive sponsorship matter so much for business continuity programs?

Accepted Answer

Executive sponsorship gives the program authority to set priorities, approve budgets, and require departments to take planning seriously. Without visible leadership support, continuity work is often treated as a low priority compliance exercise, and plans stay unfinished or unused. Sponsors also help resolve conflicts between departments when recovery decisions require trade-offs.

Question 8

What is the main purpose of a continuity policy statement?

Accepted Answer

A continuity policy statement is a short, formal document approved by leadership that sets out why the organization maintains continuity capability, what scope it covers, and who is accountable for it. It establishes the authority behind plans and signals commitment to employees, customers, and regulators. Detailed procedures then sit beneath the policy in supporting documents.

Question 9

What is a business impact analysis, and what is its purpose?

Accepted Answer

A business impact analysis is a structured review that identifies critical activities, estimates how their loss affects the organization over time, and determines what resources they depend on. Its purpose is to set priorities for recovery by showing which functions matter most and how quickly each must be restored. It informs every later continuity decision.

Question 10

What kinds of impacts does a business impact analysis typically measure?

Accepted Answer

Impact categories commonly include financial loss, lost customers and revenue, regulatory or legal exposure, safety and health effects, damage to reputation, and operational disruption such as missed deadlines or backlogs. Analysts often measure how these impacts grow as downtime lengthens, since a short outage may be tolerable while a week-long outage may be catastrophic.

Question 11

What is a maximum tolerable period of disruption?

Accepted Answer

The maximum tolerable period of disruption is the longest time a business function can be unavailable before the organization suffers unacceptable consequences. It is a key input for setting recovery targets, because it marks the outer limit within which a function must be resumed. Planners compare this limit with realistic recovery capabilities to find gaps.

Question 12

How do recovery time objectives and recovery point objectives differ?

Accepted Answer

A recovery time objective is the maximum acceptable time to restore a service after an outage. A recovery point objective is the maximum acceptable data loss, measured by the age of the last backup or replica. One limits how long you can be down, while the other limits how much recent information you can lose.

Question 13

What is a dependency map, and how does it support continuity planning?

Accepted Answer

A dependency map is a diagram or table showing how a business process relies on other processes, applications, data sets, staff skills, vendors, power, and physical sites. It supports continuity planning by revealing chains of reliance that are not obvious from organizational charts. Planners can see which upstream failure might silently halt a downstream service.

Question 14

How does a risk assessment differ from a business impact analysis?

Accepted Answer

A risk assessment asks how likely threats are and how exposed the organization is to them, while a business impact analysis asks what happens when critical work stops. The first focuses on causes and probabilities, the second on consequences and recovery needs. Programs use both, because a likely threat matters less if its consequences are minor.

Question 15

How do likelihood and impact ratings help prioritize threats in risk assessment?

Accepted Answer

Likelihood and impact ratings use simple scales, such as low, medium, and high, to describe how probable a threat is and how severe its effects would be. Multiplying or combining the two scores produces a priority ranking. The method is useful but approximate, so planners should document assumptions and not treat results as precise.

Question 16

What is a risk treatment decision, and what options does it usually include?

Accepted Answer

A risk treatment decision chooses how to respond to a risk after assessment. Options include avoiding the risk by stopping the activity, reducing it through controls, transferring it through insurance or contracts, or accepting it with documented approval. Continuity planning focuses on reducing impact and recovery, since some risks cannot be prevented.

Question 17

What is a workaround strategy in business continuity, and when is it appropriate?

Accepted Answer

A workaround strategy uses temporary manual or alternative methods to keep a function running while the normal system is unavailable. Examples include paper order forms, phone scripts, or spreadsheets replacing a failed application. Workarounds suit short disruptions, and they should be documented and limited in duration because they carry higher error and security risk.

Question 18

What is the difference between a hot site, a warm site, and a cold site?

Accepted Answer

A hot site is an equipped alternate facility that can take over operations immediately, but it is costly. A warm site has some equipment and connectivity installed, so it needs a partial setup before use. A cold site provides only basic space and utilities, so equipment and data must be brought in, making recovery slowest.

Question 19

What is a mutual aid agreement, and what risks does it carry?

Accepted Answer

A mutual aid agreement is an arrangement in which two or more organizations support each other during disruptions, by sharing space, staff, equipment, or data. Though inexpensive, it depends on the partner remaining able to help when its own operations are also stressed. Agreements should be documented and tested, with compatibility and confidentiality checked.

Question 20

How should recovery time and data loss targets guide choice of recovery strategy?

Accepted Answer

Tighter targets, meaning shorter allowable downtime or less acceptable data loss, justify more expensive strategies such as hot sites. Looser targets may permit lower cost approaches like periodic backups and cold standby equipment. The goal is to match the investment to the real cost of disruption, not to pursue the fastest recovery for every system.

Question 21

What is the purpose of a backup strategy that follows the 3-2-1 pattern?

Accepted Answer

A 3-2-1 backup pattern keeps three copies of important data, stored on two different types of media, with one copy kept offsite. Its purpose is to protect against losses such as hardware failure or ransomware that encrypts local copies. Offsite and immutable copies matter most when attackers might alter local data.

Question 22

What does a recovery sequence or priority list accomplish during restoration?

Accepted Answer

A recovery sequence orders the restoration of systems, processes, and people so that dependencies are respected and the most critical services return first. Without it, teams may restore convenient systems before the ones that other functions need, delaying business recovery. The sequence should be derived from impact analysis and dependency maps, and checked in exercises.

Question 23

Why do continuity plans need alternate staffing arrangements?

Accepted Answer

Disruptions often reduce staff availability through illness, transport failure, evacuation, or personal emergencies, so critical roles need named backups. Plans should identify who can perform each essential task, confirm skills, and consider remote work, cross-training, or contractors. Without this, a plan may look sound yet fail because no available person knows how to execute it.

Question 24

Why should recovery strategy include a plan for returning to normal operations?

Accepted Answer

Recovery does not end when emergency services are restored, because temporary arrangements cost more, carry greater risk, and cannot be sustained indefinitely. Failback planning defines how and when people, data, and processes move back to primary facilities or systems, with integrity checks. Without it, organizations can remain in fragile workarounds after the crisis passes.

Question 25

What is crisis management, and how does it differ from routine incident handling?

Accepted Answer

Crisis management is the coordinated leadership response to events that threaten an organization's survival, reputation, or core mission and that exceed normal procedures. Routine incident handling resolves common, contained problems through established processes, such as a password reset. Crises require senior decisions, broader coordination, and attention to stakeholders beyond the immediate technical fault.

Question 26

Why should an organization establish a crisis team with defined roles before an emergency?

Accepted Answer

Predefined roles let people act quickly, because decisions about authority, spokespeople, and resource allocation are settled, not debated under pressure. Typical structures include a decision maker, an incident coordinator, and leads for operations, communications, legal, and human resources. Clear roles prevent duplicated work and gaps in critical tasks during the first hours of a crisis.

Question 27

What should a first public statement after an incident usually include?

Accepted Answer

A first public statement should acknowledge the incident, confirm that the organization is responding, and state what people should do now, such as avoiding a closed site. It should avoid speculation about causes or blame, and promise another update by a stated time. Accuracy and speed matter, so messages may be brief but truthful.

Question 28

How should organizations keep employees informed during a serious operational disruption?

Accepted Answer

Organizations should use several reliable channels, such as text alerts and phone trees, because a single system may fail. Messages should explain what is known, what actions staff should take, where to get updates, and whom to contact for urgent needs. Regular, predictable updates reduce rumors and anxiety, even when the news is limited.

Question 29

What responsibilities does a designated public spokesperson have during a crisis?

Accepted Answer

A designated spokesperson is the single trained voice for official statements to media, customers, and the public, preventing contradictory comments. Spokespeople should work from approved facts, avoid guessing, refer technical questions to subject experts, and never speak about legal matters without counsel. Limiting who speaks protects credibility and reduces the chance of accidental disclosure.

Question 30

Why is it important to notify regulators or authorities when a serious incident occurs?

Accepted Answer

Many laws, licenses, and contracts require timely notification of certain incidents, and missing a deadline can add penalties. Early contact can also allow authorities to provide guidance, coordinate support, or warn others. The specific obligations depend on sector, location, and the type of data or service involved, so legal counsel should confirm requirements.

Question 31

What information should be documented during an incident for later review?

Accepted Answer

Teams should record the timeline of key events, decisions made and their reasons, who was informed, actions taken, resources used, and any unexpected problems. Accurate records support regulatory reporting, insurance claims, and legal defense, and help identify improvements. Notes should be made as events unfold, since memory fades under pressure.

Question 32

What is the difference between a crisis communication plan and a crisis response plan?

Accepted Answer

A crisis response plan describes how the organization mobilizes teams, makes decisions, and restores operations during an emergency. A crisis communication plan focuses on how information is gathered, approved, and delivered to stakeholders, including employees, customers, partners, regulators, and the public. The plans must align, because operational facts drive every message.

Question 33

Why is regular testing of continuity plans necessary, even when plans look complete?

Accepted Answer

Plans often contain untested assumptions about staff availability, system access, contact details, and vendor support, and these assumptions fail more often than planners expect. Testing reveals gaps in a controlled setting, where mistakes cost far less than in a real disaster. Results should feed directly into plan updates, with lessons recorded and assigned to owners.

Question 34

What are the main types of continuity exercises, from simplest to most demanding?

Accepted Answer

A common progression begins with a document or tabletop review, where participants walk through a scenario verbally. Next comes a walkthrough or simulation, which tests specific procedures with more realism. The most demanding exercises are functional or full scale tests, which activate real resources such as alternate sites or backup systems, sometimes without warning.

Question 35

How often should continuity plans be reviewed and updated, and what should trigger changes?

Accepted Answer

Plans should be reviewed on a fixed schedule set by policy, and whenever a significant trigger occurs. Triggers include new facilities, system upgrades, staff turnover in key roles, changes in suppliers, lessons from exercises or real incidents, and regulatory changes. Each review should confirm that contact lists, dependencies, and recovery targets still reflect current operations.

Question 36

What is a continuity maintenance program, and what does it include?

Accepted Answer

A continuity maintenance program keeps plans accurate, tested, and aligned with changing conditions over time. It typically includes scheduled reviews, training refreshers for new staff, contact list verification, documentation control, corrective action tracking, and periodic exercises. Its success depends on clear ownership, so someone is accountable for each element.

Question 37

Which capabilities help an organization absorb shocks and adapt to change?

Accepted Answer

Resilient organizations combine several capabilities, including awareness of early warning signs, flexible structures that allow quick reallocation of people and resources, and a culture that encourages reporting. They also maintain financial reserves, diversified suppliers, and decision rights that let frontline teams act within clear limits. These traits help absorb shocks and adapt rather than collapse.

Question 38

What is a post-incident review, and what should it produce?

Accepted Answer

A post-incident review is a structured analysis conducted after an event to understand what happened, why, and how well the response worked. It should focus on system causes rather than individual blame, while staying candid about mistakes. Its output should be specific corrective actions with named owners and deadlines, tracked until completed and verified.

Question 39

What is a key performance indicator for continuity, and why track it?

Accepted Answer

A continuity key performance indicator is a measurable value, such as the percentage of critical functions with tested recovery plans or the average time to restore a service during exercises. Tracking these indicators shows trends, highlights weak areas, and gives leaders evidence for funding decisions. Measures work best when they reflect outcomes rather than activity.

Question 40

Why do supply chain dependencies deserve special attention in resilience planning?

Accepted Answer

Organizations often rely on a few suppliers for components, logistics, software, or specialized services, so a single failure can ripple through many operations. Supply chain risk assessment looks beyond first tier vendors to understand subcontractors and geographic concentration. Mitigations include qualified alternate sources, buffer inventory for critical items, and contract terms that require continuity commitments.

Business Continuity and Resilience Flashcards

1Foundations of business continuity

2Business impact analysis and risk

3Continuity strategies and recovery

4Crisis management and communication

5Testing, maintenance and resilience

Learning Resources