DRI Business Continuity Planning and Documentation 2 — Questions and Answers

Question 1: Which of the following best describes a 'Business Continuity Management System (BCMS)'?

The specific software platform used to manage continuity plans
A comprehensive management framework encompassing policies, processes, plans, and governance for managing business continuity (Correct answer)
The team of employees responsible for executing the business continuity plan
The set of recovery technologies (servers, backups, alternate sites) supporting continuity

Correct answer: A comprehensive management framework encompassing policies, processes, plans, and governance for managing business continuity

A BCMS is the overarching management framework—encompassing policies, governance, processes, plans, and resources—through which an organization manages its business continuity capabilities, not just a software tool or recovery team.

The Business Continuity Management System concept, formalized in ISO 22301, takes a systems thinking approach to continuity management. A BCMS comprises all the elements required to establish, implement, operate, monitor, review, maintain, and continually improve an organization's business continuity capabilities: policy and governance (leadership commitment, scope, objectives), risk and impact analysis processes (BIA, risk assessment), strategy development (recovery strategies, alternate operating procedures), plan development and maintenance (BCPs, IT DRPs, crisis communication plans), training and awareness programs, exercise and testing programs, and performance measurement and improvement processes. The BCMS concept recognizes that isolated plans without a supporting management framework are insufficient—sustainable resilience requires organizational commitment, resource allocation, accountability, and continuous improvement embedded in governance structures.

Question 2: What is the role of the 'Business Continuity Steering Committee' in a mature BCM program?

To execute recovery procedures during actual incidents
To provide executive sponsorship, strategic direction, and resource allocation decisions for the BCM program (Correct answer)
To conduct technical testing of IT disaster recovery capabilities
To manage relationships with all external vendors and service providers

Correct answer: To provide executive sponsorship, strategic direction, and resource allocation decisions for the BCM program

A Business Continuity Steering Committee provides executive-level governance: strategic direction, organizational commitment, resource allocation, and accountability for the BCM program—it governs the program, not operationally executes it.

Mature BCM programs require executive sponsorship to ensure adequate resources, organizational authority, and cross-functional cooperation. The Business Continuity Steering Committee typically comprises senior executives from key functional areas—IT, operations, finance, legal, HR, and communications—plus the BCM program leader. Its responsibilities include establishing and approving BCM policy, setting the program scope and objectives, reviewing and approving BIA results and risk assessments, ensuring adequate resources are allocated, reviewing program performance metrics and exercise results, and making strategic decisions about recovery strategy investments. The committee provides the organizational authority that individual BCM managers rarely have to compel participation from all business units and to ensure recovery priorities align with overall business strategy and risk appetite. Executive sponsorship at this level is a key differentiator between nominal compliance programs and genuinely effective BCM capabilities.

Question 3: A 'recovery strategy' in BCP documentation MOST accurately refers to:

The IT disaster recovery technical architecture
The pre-selected approach and resources for restoring a critical business function within its RTO (Correct answer)
The insurance and financial recovery plan for losses sustained during a disruption
The regulatory compliance strategy for post-incident reporting

Correct answer: The pre-selected approach and resources for restoring a critical business function within its RTO

A recovery strategy is the pre-selected approach and associated resources for restoring a specific critical business function to minimum acceptable operating levels within its RTO—the operational plan for 'how we will recover this function.'

Recovery strategies bridge the gap between BIA requirements (what must be recovered and how quickly) and the BCP procedures (the step-by-step actions taken during recovery). For each critical business function, the recovery strategy specifies: the approach (work from home, alternate site activation, manual workarounds, third-party processing), the resources required (technology, personnel, space, supplies, third-party services), the sequence of recovery steps, dependencies and assumptions, and cost estimates. Recovery strategies are selected during the planning phase after evaluating options against BIA requirements, cost constraints, and risk tolerance. They should be evaluated and updated periodically to ensure they remain viable and cost-effective as the organization evolves. Multiple strategies should be considered for each function, and the selected strategy must demonstrably be achievable within the function's RTO.

Question 4: What is the function of an 'Emergency Operations Center (EOC)' in a business continuity response?

A permanent facility dedicated to day-to-day risk management activities
A physical or virtual command and coordination hub activated during incidents for centralized decision-making (Correct answer)
The offsite data backup facility where IT systems are recovered
A regulatory reporting center for communicating with government agencies during emergencies

Correct answer: A physical or virtual command and coordination hub activated during incidents for centralized decision-making

An Emergency Operations Center (EOC) is a command and coordination hub—physical or virtual—that is activated during significant incidents to centralize decision-making, information flow, resource allocation, and coordination among response teams.

The Emergency Operations Center concept comes from government emergency management but has been widely adopted in private sector business continuity. During significant incidents, the complexity of coordinating multiple response teams—IT recovery, facility management, communications, HR, operations, finance—across potentially multiple locations creates information management and decision-making challenges that benefit from centralization. An activated EOC brings together representatives from all response functions, providing a single space (or virtual equivalent) where situational awareness is maintained, resource requests are evaluated and approved, communications are coordinated, and executive decisions are made. EOC design considerations include location (primary and alternate), equipment and communications infrastructure, staffing protocols, information management processes, and exercise procedures. Well-designed EOCs are a significant factor in the speed and effectiveness of incident response.

Question 5: Which type of BCP documentation provides the most detailed, step-by-step instructions for specific recovery tasks?

The overarching Business Continuity Plan policy document
The Business Impact Analysis report
Operational recovery procedures and run books (Correct answer)
The crisis communication plan

Correct answer: Operational recovery procedures and run books

Operational recovery procedures and run books provide the most detailed, task-level step-by-step instructions for executing specific recovery actions—they are designed for practitioners who need precise guidance during recovery.

BCP documentation exists in a hierarchy from strategic to tactical. At the top, policy documents establish governance, objectives, and accountability. At the operational level, the BCP describes the overall framework, activation procedures, and recovery strategies. At the most tactical level, operational procedures and run books provide the granular, step-by-step instructions needed to actually execute specific recovery tasks: 'Step 1: Call the data center facility manager at [number]. Step 2: Provide your employee ID and the incident code. Step 3: Request activation of the cold storage backup system...' This granular detail is essential for two reasons: it allows less experienced staff to execute recovery procedures correctly under stress, and it reduces dependence on individuals who hold the knowledge 'in their heads.' Run books should be living documents updated whenever systems or processes change, and tested in exercises to verify their accuracy.

Question 6: When documenting dependencies in a BCP, which type of dependency is MOST commonly overlooked?

Technology system dependencies
External utility dependencies (power, water, telecommunications)
Internal upstream business process dependencies (Correct answer)
Key personnel dependencies

Correct answer: Internal upstream business process dependencies

Internal upstream process dependencies—business functions that must be operational before a downstream function can operate—are frequently overlooked because they are less visible than technology or utility dependencies, yet their unavailability can prevent recovery of dependent functions.

Business continuity documentation typically captures obvious dependencies well: IT systems, telecommunications, power, and key personnel. However, internal process dependencies—business functions that must be operational for downstream functions to operate—are frequently missed. For example, accounts receivable cannot function if the sales order processing system is unavailable. Customer service cannot resolve complaints without access to order history from fulfillment. Payroll cannot run without timesheet data from HR. When these upstream dependencies are not documented, recovery teams may successfully restore a function's technical infrastructure only to find it still cannot operate because a feeding process remains unavailable. Comprehensive dependency mapping in the BIA phase should trace both technical and process dependencies, identifying the complete chain of interdependencies that must be addressed in the correct sequence for recovery to succeed.

DRI Business Continuity Planning and Documentation 2

Which of the following best describes a 'Business Continuity Management System (BCMS)'?