CBCI Certificate of the Business Continuity Institute (CBCI) Questions and Answers

Strategy determination is a collaborative process where the Business Continuity professional works directly with owners of priority products, services, activities, or processes to develop detailed specifications for solutions that meet continuity requirements. The CBCI 7.0 course highlights this partnership as essential to ensure strategies are practical, aligned with operational realities, and capable of achieving recovery objectives. While designing high-level strategies and managing communication are important, hands-on collaboration with operational owners facilitates realistic, implementable solutions. This approach increases ownership, ensures accuracy, and fosters smoother implementation.

According to the CBCI 7.0 course, collaborating with the teams who will use the solutions is vital for successful implementation. This cooperative approach ensures that practical considerations, system requirements, and user needs are incorporated early, facilitating smoother integration and operationalization. It also promotes ownership and readiness. Revising specifications alone or delegating implementation without collaboration can lead to misaligned outcomes. Empowering teams to unilaterally change specifications without oversight risks scope creep or misapplication. Structured collaboration balances control and flexibility, ensuring solutions meet both design intent and practical deployment realities.

In CBCI / BCI Good Practice Guidelines (GPG) Edition 7.0, Embracing Business Continuity (PP2) is centred on strengthening business continuity culture by building genuine understanding and commitment across the organization—not just “policy compliance.” A practical starting point is learning how the organization thinks and behaves: its purpose, priorities, values, and the way it communicates internally and externally. Mission statements and annual reports typically explain organizational purpose, strategic intent, and leadership messaging; newsletters and corporate social media often reveal behaviours, tone, informal norms, and what the organization chooses to celebrate or emphasise. This helps the BC professional understand the “mindset of an organization” and where the BC culture currently sits, which is necessary before influencing and improving it.

This aligns with the GPG/ISO view of organizational culture as the shared values, attitudes, and behaviours shaping the social and psychological environment in which the organization operates.

While stakeholder engagement facilitates collaboration, reduces conflict, and helps identify relevant policies, it does not primarily serve to lessen the workload of the Business Continuity Professional by delegating administrative tasks. The CBCI 7.0 course clarifies that stakeholder involvement is about gaining support, expertise, and ownership rather than shifting administrative burdens. The Business Continuity Professional retains core responsibility for managing the BCMS, though collaboration supports efficient and effective program delivery.

In CBCI 7.0 / GPG 7.0, the MTPD is defined as the time frame within which the impacts of not resuming activities become unacceptable to the organization. Therefore, estimating MTPD is fundamentally impact-based: you assess when consequences cross an unacceptable threshold. Impacts typically include inability to meet business objectives, regulatory/legal non-compliance, contractual failure, financial loss, and reputational damage—all of which can make continued disruption unacceptable.

By contrast, threats that could cause disruption belong primarily to risk assessment, not the MTPD estimate itself. In PP3, the BCI distinguishes the two techniques: BIA estimates impacts over time to determine priorities and resource requirements, while risk assessment analyses the relevant risks to prioritised activities to identify concentrations of risk or points of failure.

So, while threats help you understand what might happen and how likely, they are not the deciding factor for how long disruption is tolerable. MTPD answers “how long until impacts are unacceptable,” regardless of which specific threat caused the interruption. That is why option C is the NOT factor.

Business as usual (BAU) plans are designed to restore normal operational conditions after a disruption, often returning systems and processes to pre-incident states. The CBCI 7.0 course underlines that these plans must consider new vulnerabilities that may arise as a result of the disruption’s impact on resources or operational environments. Incidents can introduce changes such as weakened controls, damaged infrastructure, or altered workflows, which must be addressed to prevent recurrence or new risks. While BAU plans should be prepared in advance, the focus is not just on resource availability or reversing recovery sequences but on understanding the dynamic context post-disruption. This approach ensures resilience not only in restoration but in strengthening the organization against future incidents.

Embracing Business Continuity increases commitment to ongoing maintenance, including regular plan reviews and updates, to ensure plans remain effective and relevant. The CBCI 7.0 course highlights that a strong Business Continuity culture does not reduce maintenance needs; rather, it ensures such activities are prioritized and valued. Reduction in maintenance requirements would signal neglect, risking preparedness. Other outcomes include prioritization of tasks and external recognition of Business Continuity’s value.

The CBCI 7.0 course explains that defining the BCMS scope is a dynamic process, which means that the parameters set are not necessarily permanent and may be reviewed and revised as organizational needs, risks, and priorities evolve. While the scope provides clarity on which parts of the organization, products, services, and activities are included, it must remain flexible to adapt to change. Permanent or fixed parameters risk locking the BCMS into outdated or incomplete coverage, reducing effectiveness. Efficient use of time and resources is a benefit of appropriate scoping, but permanence is not a characteristic of good scope definition.

In CBCI 7.0, Enabling Solutions (PP5) focuses on implementing the agreed solutions produced in Solutions Design (PP4) and ensuring those solutions can be deployed through the response structure and BC plans. The GPG 7.0 Lite explains that once solutions have been specified and approved (PP4), they must be implemented before they can be deployed, and then supported by response structures and plans. Crucially, validation later confirms that implemented solutions work according to the agreed specifications. That means implementation must align to what was designed and approved—otherwise the organization risks implementing something that does not meet recovery requirements (e.g., RTOs, minimum capacity, dependency assumptions) and will likely fail validation or real incident use. Options A and B misunderstand governance: internal audit doesn’t “approve schedules” as a prerequisite, and the BC professional does not implement everything alone. Option D can undermine control; changes should be managed through governance/change control, not ad-hoc adjustment.

The CBCI 7.0 course describes live exercises as the most comprehensive type of Business Continuity exercise. These are conducted in actual or alternate operational environments, including command centres, to simulate real incident conditions as closely as possible. Live exercises involve all personnel who would participate in an actual incident response, testing systems, processes, communication, and physical infrastructure. Their scope, realism, and inclusiveness help identify practical issues that other exercise types may miss. They require significant resources and planning but provide critical assurance of organizational preparedness under authentic conditions.

In the CBCI 7.0 body of knowledge (aligned to the BCI Good Practice Guidelines), the Analysis stage (PP3) uses BIA to determine recovery priorities and the resources and dependencies needed to deliver those priorities. Within BIA approaches, an Activity BIA is the one that drills down to the tasks/activities that must be performed to deliver urgent products and services. It identifies which activities are most time-critical, then documents what is needed to perform them (people, premises, technology, information, suppliers) and the internal/external interdependencies that support delivery. This is exactly what the question describes: prioritising urgent delivery tasks and determining the resources and dependencies required to complete them.

A Product & Service BIA is typically higher-level (what must be delivered), while a Process BIA tends to map and assess disruption impacts at process level rather than at the detailed “do-the-work” activity/task level. “Priority BIA” is not the standard BCI naming for a BIA type. The BCI guidance explicitly links activity-level BIA work to understanding required resources and interdependencies for prioritised activities.

The CBCI 7.0 course recommends a pragmatic approach where existing teams and roles are evaluated and, where appropriate, integrated into the new response structure. This ensures continuity, leverages existing expertise, and minimizes disruption. Providing training helps align personnel with new expectations and structures, supporting a smooth transition. Immediate disbanding risks loss of knowledge and confusion, while uncritical adoption or automatic promotion can entrench outdated practices or create governance challenges. Careful assessment and deliberate integration preserve organizational memory while enabling improvement.

External audits provide independent verification that the BCMS complies with relevant standards, policies, and regulatory requirements. The CBCI 7.0 course clarifies that audits assess the design, implementation, and effectiveness of Business Continuity processes and controls to assure stakeholders that the system functions as intended. The audit does not specifically test operational readiness or management performance but focuses on conformance and control integrity, enabling informed decision-making about system improvements.

In CBCI 7.0 (aligned to BCI Good Practice Guidelines 7.0), Validation (PP6) is explicitly achieved through a combination of three activities: Exercising, Maintenance, and Review. Exercising is used to train for, assess, practice, and improve performance; maintenance ensures BC arrangements and plans remain relevant and operationally ready; and review assesses the suitability, adequacy, and effectiveness of the BCMS and identifies opportunities for improvement. This “three-part” approach ensures validation is not limited to running exercises: it also confirms that documents and capabilities stay current and that the BCMS remains effective as the organization and its context change. The GPG Lite 7.0 section for PP6 states this combination directly, and it also emphasizes that validation confirms implemented solutions and plans work to agreed specifications and are appropriate for the organization’s size and complexity—reinforcing why maintenance and review must accompany exercises rather than being optional add-ons.

According to the CBCI 7.0 course, the primary consideration when developing a system to measure Business Continuity culture is to clearly define the objectives of the measurement activity and establish robust methods for collecting and analyzing relevant data. This includes deciding what aspects of culture to assess (e.g., awareness, attitudes, behaviours), selecting appropriate tools (surveys, interviews, observation), and determining assessment frequency. Accurate data collection and analysis provide meaningful insights that drive improvements and validate cultural initiatives. Presentation style and participation mandates are important but secondary to the integrity and clarity of the measurement process itself.

An Activity Business Impact Analysis (BIA) is a crucial component of the Business Continuity Management System (BCMS) that focuses on identifying and prioritizing the activities within the organization that contribute to delivering critical products and services. According to the CBCI 7.0 course, the Activity BIA maps out which activities are most urgent and vital, and it determines the necessary resources and interdependencies required to maintain or restore these activities following a disruption. This detailed understanding enables the organization to allocate resources effectively and design recovery strategies tailored to priority activities. Unlike a broad process or product BIA, the Activity BIA provides granular insights into operational components, ensuring continuity plans address practical recovery needs and dependencies.

The RTO represents the maximum acceptable time to restore activities following disruption, and it must always be shorter than the Maximum Tolerable Period of Disruption (MTPD), which is the absolute limit before unacceptable impacts occur. The CBCI 7.0 course explains that this ensures recovery efforts occur within tolerable timeframes, preventing critical losses. The RPO concerns data restoration points and is not a time period comparison. The MBCO relates to minimum acceptable outputs and is not a time-based measure.

Developing an effective exercise program involves planning a series of varied events and activities over time to comprehensively test and validate different aspects of Business Continuity. The CBCI 7.0 course underlines that exercises should be progressive, increasing in complexity and scope, to build capability and confidence. Conducting exercises only once or relying on a single type of exercise limits effectiveness and can lead to gaps in readiness. Similarly, sampling plans restricts full organizational preparedness. A systematic, scheduled program ensures continuous improvement and coverage across plans and teams.

The CBCI 7.0 course clarifies that strategies for resuming operations are developed primarily based on the analysis of the Maximum Tolerable Period of Disruption (MTPD) and the Recovery Time Objectives (RTO). The MTPD defines the maximum duration an activity can be disrupted before causing intolerable impact, while the RTO sets the target time to restore that activity. These recovery parameters provide clear, measurable goals for strategy development, ensuring continuity efforts focus on minimizing downtime and impact. Although stakeholder input and organizational culture influence strategy implementation, the technical parameters of MTPD and RTO form the foundational basis for solutions.

In CBCI 7.0 (aligned with GPG 7.0 practice), Validation includes exercising and testing to confirm that arrangements and plans work as intended and that people understand their roles. A discussion-based exercise is specifically designed as a low-pressure environment where participants talk through roles, decisions, and plan steps, often using a hypothetical situation to prompt discussion. This format is widely used to help teams explore issues, clarify responsibilities, and identify gaps without the cost, stress, or operational impact of a live simulation.

That is why option D is correct.

A scenario (table-top) exercise is often discussion-based, but the defining feature in the question is the exercise type that is explicitly low-pressure and walk-through in nature—this matches “discussion-based.” A simulation exercise is typically more realistic and pressured (sometimes involving time compression, actual call-outs, or technical failover), and therefore not the best match. “Investigative” is not the standard label for this low-pressure walk-through category in common BC exercise groupings. Discussion-based exercises are often used early to build confidence and validate understanding before moving to more demanding exercise types.

BCMS governance is about direction, oversight, and control—setting expectations, monitoring whether the BCMS is effective, and ensuring it remains fit for purpose. The BCI GPG 7.0 (Lite) highlights that a BCMS must operate and maintain processes and response structures while monitoring and reviewing performance and effectiveness, and using qualitative/quantitative measures to drive continual improvement. Governance also includes ensuring the BCMS aligns with external obligations such as relevant legal and regulatory requirements, because non-compliance can create unacceptable impacts and can influence priorities and recovery requirements.

What governance does not do is “run the recovery work” itself. Carrying out specific operational activities (e.g., restoring systems, relocating teams, executing step-by-step recovery tasks) is the role of operational teams and plan owners under the response structure, not BCMS governance. Governance ensures those operational capabilities exist, are resourced, and are validated—but it does not execute them day-to-day. Therefore, option A is the activity that is not part of governance, while options B, C, and D are core governance responsibilities.

The CBCI 7.0 course explains that review refers to the systematic process of evaluating the BCMS to assess whether it remains suitable, adequate, and effective in meeting organizational needs and objectives. Reviews identify areas for improvement, ensuring continual enhancement of Business Continuity capabilities. This encompasses analysis of internal and external factors, performance data, audit results, and feedback from exercises and incidents. It differs from compliance checks or personnel engagement assessments by focusing on the overall system’s fitness for purpose, promoting proactive adaptation to changing risks and environments.

CBCI 7.0 aligns its risk assessment language to ISO/BCI terminology. BCI guidance defines risk assessment as an overall process of risk identification, risk analysis, and risk evaluation. In the wording of your question, “listing risk sources” maps to risk identification, and “performing a risk source analysis” maps to risk analysis (examining likelihood and consequences to understand risk level). The third step, therefore, is risk evaluation—comparing analysed risks against agreed criteria (risk appetite/tolerance) to decide whether further action is needed and to prioritise treatment.

Option C (assessing consequences) is part of risk analysis, not the final step. Options A and B can be helpful techniques, but they are not the standard third step in the three-step risk assessment model used in BC/ISO-aligned frameworks. Therefore, the correct answer is D: Evaluating risks.

In CBCI 7.0’s BCMS flow, Analysis (PP3) defines continuity requirements (priorities, resource needs, recovery targets) and then Solutions Design (PP4) selects strategies/solutions to meet those requirements. A gap analysis is the comparison step: it evaluates the organization’s current recovery capability against the required capability (e.g., can current arrangements meet the RTO/RPO, minimum capacity, dependencies, and response requirements). This is exactly option C.

Options A and B describe what happens after the gap is understood—choosing strategies and designing solutions is the Solutions Design activity itself, not the definition of a gap analysis. Option D is risk-focused and relates more to risk treatment; while single points of failure can be revealed, the primary purpose of a gap analysis is broader: determining whether existing capabilities meet stated BC requirements and documenting where they do not, so management can decide to close, reduce, or accept those gaps.

Exercising business continuity plans involves balancing the need to simulate realistic scenarios while minimizing unintended disruption to normal operations. The CBCI 7.0 course instructs that exercise planners must anticipate and control any business as usual impacts through careful planning, monitoring, and mitigation during the exercise. Ignoring risks or dismissing business as usual commitments undermines organizational operations and can reduce support for continuity activities. Managing disruption effectively ensures exercises achieve their objectives without unnecessary operational costs.

BCI GPG 7.0 places business continuity plans inside PP5 – Enabling Solutions. PP5 covers implementing agreed solutions, establishing a response structure, and developing/managing strategic, tactical, and operational BC plans so the solutions can be used effectively during incidents. Therefore, option A is correct.

Option B (exercising plans) is part of PP6 – Validation, where exercising, maintenance, review, and post-incident learning confirm whether the established BCMS meets the objectives set in policy. Option C (developing strategies) belongs to PP4 – Solutions Design, where strategies and solutions are identified and selected based on analysis outputs. Option D (updating policy) is a management practice activity within establishing/maintaining the BCMS governance and direction (PP1). In short: PP5 is where solutions become operational through response structures and plans, so the organization can actually execute recovery.

The CBCI 7.0 course details that using pre-defined impact thresholds is an effective and consistent method for prioritizing products, services, and activities during a BIA. These thresholds establish clear criteria for impact levels across various categories, such as financial loss, reputational damage, and regulatory consequences. By applying standardized thresholds, organizations can objectively assess and compare the criticality of different business functions, ensuring that prioritization aligns with organizational risk appetite and strategic objectives. This approach promotes consistency, transparency, and repeatability in BIA processes. While risk matrices and gap analyses are useful tools in risk management, pre-defined impact thresholds directly guide priority-setting within BIAs.

A gap analysis identifies discrepancies between current capabilities and required Business Continuity needs. The CBCI 7.0 course explains that outcomes may reveal that the organization’s existing capabilities exceed what is necessary, offering opportunities to redistribute resources or adjust investments. This insight helps optimize resource allocation and improve efficiency. While validation exercises and communication plans are important subsequent steps, the immediate and tangible result of a gap analysis can include the reassessment of capability adequacy.

Surveys are a practical and efficient way to collect feedback from participants who may be geographically dispersed or involved in staggered exercise sessions. The CBCI 7.0 course emphasizes that surveys enable broad participation and timely input collection, which can be crucial when participants cannot all meet in person or at the same time. Hot debriefs are typically immediate post-exercise discussions, not extended over a month. One-on-one interviews and limiting input to senior personnel restrict breadth and may delay feedback.

The CBCI 7.0 course explains that an Activity Business Impact Analysis (BIA) provides detailed identification of dependencies necessary to deliver prioritized products and services. This includes internal dependencies such as departments and resources, and external dependencies such as suppliers and partners. Mapping these dependencies is crucial to understanding potential vulnerabilities and planning continuity solutions that address both internal process interrelations and supply chain considerations. The Product and Services BIA focuses more on outcomes and impacts, while risk assessments identify threats but do not detail operational dependencies. Initial assessments are broader and less detailed.

The CBCI 7.0 course highlights that the consolidated BIA report, combining all individual BIAs, serves as a key governance document submitted to top management for review and approval. This final approval confirms that management understands the criticality of prioritized activities, recovery objectives, and resource requirements. It enables informed decision-making regarding resource allocation, strategy development, and risk treatment. While BIA participants, auditors, and exercise planners use the report, top management’s endorsement is critical for organizational commitment and effective BCMS progression.

The CBCI 7.0 course defines embracing Business Continuity as a cultural commitment by personnel who recognize the importance of Business Continuity in protecting organizational interests. It goes beyond policy mandates or role compliance and reflects genuine belief and ownership. Embracing Business Continuity is integrated with the broader organizational culture rather than existing separately. This deep commitment improves resilience and the effectiveness of continuity efforts at all levels.

In the GPG 7.0 structure used by CBCI 7.0, Analysis (PP3) covers the Business Impact Analysis (BIA) and Risk Assessment, producing requirements such as priorities, resource needs, and recovery targets. Once those requirements are understood, the next step is Solutions Design (PP4)—selecting and designing strategies and solutions that can meet the recovery requirements (e.g., meeting RTOs, securing resources, reducing single points of failure).

That sequencing is why option B is correct: after analysis, you identify strategies and solutions for resuming/continuing operations. Option A (governance) is established earlier as part of setting up the BCMS framework. Option C is part of the analysis stage itself, not the next stage. Option D (operational plans) aligns more with Enabling Solutions (PP5), where solutions are implemented and supported by response structures and plans.

CBCI 7.0 reflects the GPG 7.0 emphasis that business continuity culture is not achieved by “mandating and enforcing compliance” alone; it is achieved when BC becomes understood, valued, and practiced across the organization. A “good practice” BC culture therefore looks like shared understanding and broad participation—people know why BC matters, understand their roles, and actively contribute to readiness and resilience. That matches option C.

Option A describes compliance without ownership, which is weaker and often fragile under stress. Option B incorrectly centralizes BC into the BC team; good practice requires distributed ownership (leaders and staff) rather than the BC function “doing it all.” Option D is also incorrect because top management involvement remains essential (leadership sets direction, provides resources, and reinforces expectations); a mature culture does not remove leadership accountability—it strengthens organization-wide engagement with leadership support. The GPG’s cultural focus is about enabling the organization to improve BC culture intentionally and make BC part of “how we operate,” not a specialist-only activity.

When an organization lacks fully developed BC solutions, response structures, or plans, the CBCI 7.0 course recommends the immediate development and implementation of an interim crisis management plan. This plan serves as a temporary framework to manage disruptions while the comprehensive BCMS is being established. An interim plan prioritizes rapid response capability, outlining essential roles, responsibilities, and immediate actions to stabilize incidents. Conducting a BIA is important but follows initial crisis preparedness. Outsourcing or reactive procurement of resources without a foundational plan risks ad hoc responses and inefficiency. Establishing an interim plan ensures the organization is not unprepared during the transition towards a mature BCMS.

The CBCI 7.0 course identifies Business Continuity awareness measurement as a method involving regular assessments of personnel engagement levels with Business Continuity culture initiatives. Periodic checks gauge how many employees have been reached by awareness programs, training, and communications. This quantitative approach provides tangible data on the penetration of continuity culture across the organization, informing areas needing focus or improvement. Unlike unstructured observations or broader culture indices, awareness measurement specifically targets the spread and effectiveness of Business Continuity messaging and understanding.

In GPG 7.0, Embracing Business Continuity (PP2) is about embedding BC into the organization—moving away from “mandating and enforcing compliance” and instead shaping behaviours, ownership, and understanding so BC becomes part of “how we do things here.” When people genuinely embrace BC, the BCMS is more likely to be implemented in a way that fits the organization’s real operating context, language, and norms. That naturally leads to a BC programme that is bespoke to the organization and its culture (option A) rather than a generic, copied framework.

The other options describe outcomes that may happen in some cases but are not reliable or primary indicators of embracing BC. Strong financial performance (B) is not a direct or guaranteed outcome; BC investments can be cost-neutral or even reduced when smartly targeted. Staff turnover reductions from rewards (C) is speculative and depends on HR policy, not BC culture alone. Reduced need for support from external customers/partners (D) misunderstands continuity: embracing BC typically increases structured engagement with key stakeholders, not removes it.

Verifying that a system can be restored from backups within the RTO requires a measurable, evidence-based activity with a clear “works/doesn’t work” outcome. In business continuity terminology aligned to ISO vocabulary commonly used in BC practice, a test is an exercise designed to produce an expected, measurable pass/fail outcome—which is exactly what you need when timing a backup restore and confirming the system becomes operational within the stated RTO.

BCI guidance on validation emphasizes that validation is the “true test” of an established BCMS, bringing together prior work to confirm objectives are met. In technical recovery, the objective is not discussion or role-play; it is confirming the technology recovery steps and timings actually achieve the target. The BCI Good Practice guidance also frames validation questions in practical terms such as whether a priority system “can be recovered and restored within the expected recovery time objective,” which is best answered through a controlled technical test.

Scenario/discussion exercises support understanding and decision-making, and simulations can be broader and more complex, but the most direct method for backup-restore-to-RTO verification is a test.

In CBCI 7.0 (aligned to BCI GPG 7.0), measuring BC culture is most meaningful when it focuses on what people actually do under similar conditions—not only what they say they know. A “behavioural consistency” approach evaluates whether teams and leaders respond in a predictable, repeatable, and aligned way when faced with comparable situations across different parts of the organization. This directly fits the question wording: it looks at levels of response and performance “across all levels and the breadth” of the organization, identifying whether BC behaviours are embedded uniformly or only present in pockets. GPG 7.0 also reinforces that embracing BC is achieved by embedding behaviours beyond compliance, leading to improved culture and fit-for-purpose capability.

By contrast, “BC awareness” typically measures knowledge/visibility (training, communications reach), not consistency of performance. “Unstructured observations” can provide insight but lacks repeatability and comparability across the organization. “Pre-mortem checks” are a useful technique for anticipating failure modes, but they are not primarily a culture measurement method focused on observed response consistency.

The CBCI 7.0 course explains that flexibility in meeting arrangements is critical for effective response. Requiring meetings to always occur physically is impractical, especially in disruptions impacting facilities or when personnel are remote. Virtual meeting capabilities have become essential, allowing teams to convene despite physical constraints. Plans should specify multiple meeting options (physical and virtual) and include contingencies like stable power and connectivity. Stating arrangements and empowering leaders to select locations supports responsiveness and operational continuity.

An alternate location strategy for physical infrastructure focuses on providing usable workspace quickly when a primary site is unavailable. Solutions that can be available within hours typically rely on options the organization already controls—such as repurposing internal space (often described in continuity guidance as “displacement/budge-up,” using other facilities, or relocating teams into existing sites). This is the most realistic “hours-scale” approach because it avoids procurement lead times and complex engineering dependencies.

Option B fits that model precisely: repurposing other work areas and facilities can be activated rapidly with basic logistics (access, seating, connectivity, and prioritization of critical teams).

Option A (working from home) can be a valid continuity strategy, but the question specifies physical infrastructure and an alternate location approach; remote working is not a physical alternate site solution in the same sense. Options C and D typically take longer than hours: ordering/installing equipment and rebuilding/reconnecting utilities involve supply chains, specialist work, and external dependencies. Therefore, B is the best answer.

Embedding Business Continuity into induction and setting objectives for personnel clearly indicates a mature Business Continuity culture. The CBCI 7.0 course details that a strong culture is characterized by widespread awareness, commitment, and integration of Business Continuity principles into everyday activities. Including continuity in induction familiarizes new staff with the organization's resilience expectations, while individual objectives reinforce personal accountability. This cultural embedding supports sustainable continuity practices and improves the likelihood of effective responses during disruptions. It reflects a proactive organizational mindset rather than isolated activities or roles.

When establishing a BCMS, good practice is to create governance that supports informed decisions, prioritisation, and cross-functional coordination. The BCI’s guidance explicitly recognises the value of a steering group/team to “oversee, advise and make recommendations to top management,” ensuring the programme is guided by the right expertise and stakeholder perspectives rather than being driven by one function alone. This fits the purpose of PP1 (Establishing a BCMS), which includes establishing high-level governance and coordinating interrelated activities such as scope, policy, objectives, and roles/responsibilities.

Options A and B rely on coercion (rules/mandatory obligations). While participation is important, “forcing” engagement often undermines ownership and culture—whereas a steering group creates structured, senior-supported engagement and clearer accountability. Option D can be useful for specific inputs (e.g., supplier continuity requirements), but routinely inviting external parties into BCMS establishment is not the core good-practice governance mechanism; external expectations are normally managed through contracts, SLAs, assurance, and stakeholder communications rather than open-ended participation in internal governance.

In CBCI 7.0 (based on the BCI GPG Edition 7.0), Solutions Design (PP4) is where the organization determines how it will meet its business continuity requirements identified in Analysis (PP3). PP3 outputs—especially risk assessment results—are key inputs into PP4 so that proposed strategies and solutions address real disruption risks and resource vulnerabilities.

Assessing viability is not only about whether a solution meets recovery requirements; it must also be justified and sustainable. The GPG highlights that strategies and solutions must meet BC requirements while remaining considerate of costs and benefits, noting that mitigation cost should not exceed disruption cost or create secondary risk.

Horizon scanning fits this same viability purpose: it helps anticipate emerging external threats, trends, and changes that could invalidate a solution over time, ensuring chosen strategies remain fit-for-purpose as the operating environment evolves. This is consistent with the GPG emphasis on designing solutions that remain appropriate to the organization’s needs and context, rather than selecting options in isolation.

PP1 (Establishing a BCMS) is fundamentally a management practice: it defines how the BCMS programme will be designed and implemented and coordinated across stakeholders and workstreams. Because BCMS establishment spans governance, scope, policy, analysis activities, strategy design, implementation planning, and validation preparation, coordination must be structured: clear work breakdown, dependencies, milestones, owners, reporting, and change control. A programme/project management methodology provides exactly that—end-to-end oversight of planning, activities, timelines, and delivery governance—making it the most effective approach at organizational scale.

Option B is too reactive and lacks integrated planning and control. Option C (meetings) supports communication but is not a delivery methodology; meetings alone don’t manage dependencies or risks. Option D is minimal awareness activity, not coordination of a complex implementation programme. Therefore, the best-practice answer is A.

While the Activities BIA informs the development of solutions, updating the BIA is not part of the solution implementation process itself. The CBCI 7.0 course explains that implementing solutions focuses on ensuring that operational plans, training, and governance are aligned and effectively deployed. Training equips personnel to use and support new solutions properly. Compliance with project management processes ensures structured, controlled implementation. The BIA is a foundational analysis tool and is typically reviewed or updated separately during scheduled risk and impact assessments rather than during solution implementation. Conflating BIA updates with implementation may confuse strategic assessment with operational execution.

In GPG-aligned CBCI 7.0 practice, the BIA estimates impacts over time and identifies what must be recovered, in what order, and with what minimum capability. A key BIA output is a clear view of the resources and dependencies needed to deliver the organization’s prioritised activities—including people/skills, information and data, technology, premises, finance, suppliers, and key internal/external interdependencies. This is foundational because strategies and solutions (PP4) and the enabling plans (PP5) must be based on what the BIA proves is required to restore delivery.

Therefore, option A is correct: those requirement categories are analysed specifically to identify the dependencies that enable prioritised activities to continue or resume.

Option B (general business plan) is broader strategic planning, not the specific continuity dependency mapping output from a BIA. Option C relates to culture development (PP2), not BIA dependency capture. Option D (response structure) uses BIA outputs, but the direct purpose of gathering people/data/finance/supplier requirements during BIA is to map the resources and dependencies for prioritised activities.

When BC plans are updated, the organization must be able to prove which version is current, when it was reviewed, what changed, and who approved it. A formal version control process prevents confusion, reduces the risk of using outdated instructions during an incident, and supports assurance/audit needs. BCI guidance on content management for resilience explicitly highlights that clear version control prevents confusion and ensures teams work with the most current information—especially critical during crises when outdated guidance can compound problems.

Option B directly meets that requirement: it identifies review dates and highlights changes so plan owners and responders can trust the document. Option A (just saving to a shared drive) does not ensure people use the correct version or understand changes. Option C is insufficient for operational control. Option D is passive and does not implement document control; it also risks inconsistent distribution. In CBCI practice, controlled documents + versioning are essential to reliable response and recovery execution.

A response structure exists to ensure the organization has a documented mechanism for responding to an incident regardless of cause, with clear command, control, escalation, and communications. A “critical requirement” for such a structure is having clearly understood procedures for activation and control—i.e., how teams are stood up, who has authority, how decisions are made, and how the response is coordinated once activated. This is explicitly called out as a key requirement for an effective response structure.

Option B (monitoring/early recognition) is also important, but it is one component. The question asks for a critical requirement when creating the structure; activation and control procedures are foundational because without them, even a well-designed structure cannot be reliably mobilised or governed during disruption.

Option A (BIA summary) informs priorities, but it is not a defining requirement of the response structure mechanism itself. Option D relates to analysis/review after an incident, which supports improvement, but it is not the core requirement needed to operate the response structure during an incident. Therefore, C is the best answer.