Spring World 2015

Conference & Exhibit

Attend The #1 BC/DR Event!

Fall Journal

Volume 27, Issue 4

Full Contents Now Available!

Business Continuity Glossary by DRJ


Download Entire Glossary:     word   pdf
UPDATED: August 6, 2014

 

Term

Definition

   
   

ABCP

Associate Business Continuity Professional. The ABCP level is designed for individuals with less than two years of Continuity Mgmt experience, but who have minimum knowledge in continuity management, and have passed the qualifying exam.

   

Alert

Notification that a potential disruption is imminent or has occurred; usually includes a directive to act or standby.

   

Alternate Site

A site held in readiness for use during/following an invocation of business or disaster recovery plans to continue urgent and important activities of an organization.

   

Alternate Work Area

Recovery environment complete with necessary infrastructure (desk, telephone, workstation, and associated hardware and equipment, communications, etc)

   

Annual Loss Exposure/Expectancy (ALE)

A risk management method of calculating loss based on a value and level of frequency.

   

Application Recovery

The component of Disaster Recovery that deals specifically with the restoration of business system software and data after the processing platform has been restored or replaced.

   

Annual Program Review (APR)

A structured yearly opportunity for top management to review the status of important components of the business continuity management program, with the objectives of approving future initiatives, allocating resources and confirming program scope

   

Assembly Area

The designated area at which employees, visitors, and contractors assemble if evacuated from their building/site.

   

Asset

Anything that an organization signifies as important or valuable. This could include technology equipment, real estate, operating equipment, intellectual property, reputation, and financial resources.

   

Associate Member (AMBCI)

Associate Member of The Business Continuity Institute. This entry level certification is for those with at least one year’s general experience within BCM across all six Business Continuity Competencies. Applicants need to obtain a Pass in the BCI Certificate examination or hold other recognized credentials.

   

Backlog

a) The amount of work that accumulates when a system or process is unavailable for a long period of time. This work needs to be processed once the system or process is available and may take a considerable amount of time to process.
b) A situation whereby a backlog of work requires more time to action than is available through normal working patterns. In extreme circumstances, the backlog may become so marked that the backlog cannot be cleared.

   

Backup (Data)

A process by which data (electronic or paper-based) and programs are copied in some form so as to be available and used if the original data from which it originated is lost, destroyed or corrupted.

   

Backup Generator

An independent source of power, usually fueled by diesel or natural gas.

   

Business Continuity

The strategic and tactical capability of the organization to plan for and respond to incidents and business disruptions in order to continue business operations at an acceptable predefined level.

   

Business Continuity

The strategic and tactical capability of the organization to plan for and respond to incidents and business disruptions in order to continue business operations at an acceptable predefined level.

   

Business Continuity Coordinator

A role within the BCM program that coordinates planning and implementation for overall recovery of an organization or unit(s).

   

Business Continuity Management (BCM)

The process that organizations use to ensure business continuity is maintained across their organization.

   

Business Continuity Management Program

Ongoing management and governance process supported by top management and appropriately resourced to implement and maintain business continuity management (Source= ISO 22301:2012)

   

Business Continuity Management Team

A group of individuals functionally responsible for directing the development and execution of the business continuity plan, as well as responsible for declaring a disaster and providing direction during the recovery process, both pre-disaster and post-disaster. Similar terms: disaster recovery management team, business recovery management team.

   

Business Continuity Plan (BCP)

 

 

 

Documented procedures that guide organizations to respond, recover, resume and restore to a pre-defined level of operation following disruption.

NOTE: Typically this covers resources, services and activities required to ensure the continuity of critical business functions. (Source= ISO 22301:2012)

 

 

Business Continuity Planning

Business Continuity Planning is the process of developing prior arrangements and procedures that enable an organization to respond to an event in such a manner that critical business functions can continue within planned levels of disruption.   The end result of the planning process is the BC Plan. (Source=BCI Dictionary of BC Management Terms)

   

Business Continuity Plan Administrator

The designated individual responsible for plan documentation, maintenance, and distribution

   

Business Continuity Steering Committee

A committee of decision makers, (e.g.,

Business leaders, technology experts and continuity professionals) tasked with making strategic policy and continuity planning decisions for the organization, and for providing the resources to accomplish all business continuity program goals.

   

Business Continuity Strategy

An approach selected by an organization to ensure its recovery and continuity in the face of a disaster or other business disruption.

   

Business Continuity Team

Designated individuals responsible for developing, execution, rehearsals, and maintenance of the business continuity plan.

   

Business Impact Analysis

A process designed to assess the potential quantitative (financial) and qualitative (non-financial) impacts that might result if an organization was to experience a business disruption.

   

Business Interruption

Any event, whether anticipated (i.e., public service strike) or unanticipated (i.e., blackout) which disrupts the normal course of business operations at an organization’s location. Similar terms: outage, service interruption.

   

Business Interruption Costs

The impact to the business caused by different types of outages, normally measured by revenue lost.

   

Business Interruption Insurance

Insurance coverage for disaster related expenses that may be incurred until operations are fully recovered after a disaster. Business interruption insurance generally provides reimbursement for necessary ongoing expenses during this shutdown, plus loss of net profits that would have been earned during the period of interruption, within the limits of the policy.

   

Business Recovery Coordinator

An individual or group designated to coordinate or control designated recovery processes or testing.

   

Business Recovery Team

A group responsible for: relocation and recovery of business unit operations at an alternate site following a business disruption; and subsequent resumption and restoration of those operations at an appropriate site.

   

Business Recovery Timeline

The approved sequence of activities, required to achieve stable operations following a business interruption. This timeline may range from minutes to weeks, depending upon the recovery requirements and methodology.

   

Business Unit Recovery

A component of Business Continuity which deals specifically with the recovery of a key function or department in the event of a disaster.

   

Call Tree

A document that graphically depicts the calling responsibilities and the calling order used to contact management, employees, customers, vendors, and other key contacts in the event of an emergency, disaster, or severe outage situation.

   

Capability

An umbrella term which generically encompasses business processes or activities, and/or technology systems or applications

   

Capability Resilience Level (CRL)

The relative degree to which a capability can be impacted by a single disaster event.

   

Cascade System

A system whereby one person or organization calls out/contacts others who in turn initiate further call-outs/contacts as necessary.

   

CBCP

Certified Business Continuity Professional. The CBCP certification is for individuals with a minimum of two years of Enterprise Continuity Mgmt experience in 5 of the 10 Professional Practice areas, have passed the qualifying exam and have had their DRII - Certification Application approved.

   

CFCP

Certified Functional Continuity Professional. The CFCP is designed for individuals with a minimum of two years of Continuity Mgmt experience in 3 of the 10 Professional Practice areas, have passed the qualifying exam and have had their DRII Certification Application approved. This certification provides a certification opportunity for those individuals with Continuity Mgmt experience in specific functional or vertical areas vs. enterprise wide.

   

Checklist

a) Tool to remind and /or validate that tasks have been completed and resources are available, to report on the status of recovery. b) A list of items (names or tasks etc.) to be checked or consulted.

   

Checklist Exercise

A method used to exercise a completed disaster recovery plan. This type of exercise is used to determine if the information such as phone numbers, manuals, equipment, etc. in the plan is accurate and current.

   

Cold Site

An environmentally equipped facility that provides only the physical space for recovery operations while the organization using the space provides its own office equipment, hardware and software systems and any other required resources to establish and continue operations.  

   

Command Center

The (facility) location, local to the event but outside the immediate affected area, where tactical response, recovery and restoration activities are managed. There could be more than one command center for each event reporting to a single Emergency Operations Center.

   

Communications Recovery

The component of Disaster Recovery which deals with the restoration or rerouting of an organization’s telecommunication network, or its components, in the event of loss.

   

Consortium Agreement

An agreement made by a group of organizations to share processing facilities and/or office facilities, if one member of the group suffers a disaster.

   

Contact List

A list of key people to be notified at the time of disruption or as needed.

   

Contingency Plan

An event specific preparation that is executed to protect an organization from certain and specific identified risks and/or threats.

   

Contingency Planning

Process of developing advanced arrangements and procedures that enable an organization to respond to an undesired event that negatively impacts the organization.

   

Continuity of Operations (COOP)

Management policy and procedures used to guide an enterprise response to a major loss of enterprise capabilities or damage to its' facilities. It defines the activities of individual departments and agencies and their subcomponents to ensure their essential functions are performed. The term is primarily used in the Public Sector.

 

 

Continuity Of Operations Plan (COOP)

Management policy and procedures used to guide an enterprise response to a major loss of enterprise capabilities or damage to its' facilities. It defines the activities of individual departments and agencies and their subcomponents to ensure their essential functions are performed. The term is primarily used in the Public Sector.

   

Continuous Availability

A system or application that supports operations which continue with little to no noticeable impact to the user. For instance, with continuous availability, the user will not have to re-log in, or to re-submit a partial or whole transaction.

   

Continuous Operations

The ability of an organization to perform its processes without interruption.

   

Corporate Governance

The system/process by which top management of an organization are required to carry out and discharge their legal, moral and regulatory accountabilities and responsibilities.

   

Corporate Risk

A category of risk management that looks at ensuring an organization meets its corporate governance responsibilities takes appropriate actions and identifies and manages emerging risks.

   

Cost Benefit Analysis

A process (after a BIA and risk assessment) that facilitates the financial assessment of different strategic BCM options and balances the cost of each option against the perceived savings.

   

Crisis

A situation with a high level of uncertainty that disrupts the core activities and/or credibility of an organization and requires urgent action. (Source= ISO 22300)

   

Crisis Management

The overall direction of an organization’s response to a disruptive event, in an effective, timely manner, with the goal of avoiding or minimizing damage to the organization’s profitability, reputation, and ability to operate.

   

Crisis Management Team

A team consisting key leaders (i.e., media representative, legal counsel, facilities manager, disaster recovery coordinator, etc.), and the appropriate business owners of critical functions who are responsible for recovery operations during a crisis.

   

Critical Business Functions

The critical operational and/or business support functions that could not be interrupted or unavailable for more than a mandated or predetermined timeframe without significantly jeopardizing the organization.

   

Critical Data Point

See definition for Recovery Point Objective

   

Critical Infrastructure

Physical assets whose incapacity or destruction would have a debilitating impact on the economic or physical security of an organization, community, nation, etc

   

CRL: Capability Resilience Level

The relative degree to which a capability can be impacted by a single disaster event

   

Data Backup Strategies

Data backup strategies will determine the technologies, media and offsite storage of the backups necessary to meet an organization’s data recovery and restoration objectives.

   

Data Backups

The copying of production files to media that can be stored both on and/or offsite and can be used to restore corrupted or lost data or to recover entire systems and databases in the event of a disaster.

   

Data Center Recovery

The component of Disaster Recovery which deals with the restoration of data center services and computer processing capabilities at an alternate location and the migration back to the production site.

   

Data Mirroring

The act of copying data from one location to a storage device at another location in or near real time.
Source: Hot sites usually refer to IT and Telecom capabilities. When used in the same context for business users they are more often referred to as Work Area Recovery Sites.

   

Data Recovery

The restoration of computer files from backup media to restore programs and production data to the state that existed at the time of the last safe backup.

   

Database Replication

The partial or full duplication of data from a source database to one or more destination databases.

   

Declaration

A formal announcement by pre-authorized personnel that a disaster or severe outage is predicted or has occurred and that triggers pre-arranged mitigating actions (e.g., a move to an alternate site.)

   

Declaration Fee

A fee charged by a Commercial Hot Site Vendor for a customer invoked disaster declaration

   

Denial of Physical Access

The inability of an organization to access and/or occupy its normal, physical, working environment.

   

Dependency

The reliance or interaction, directly or indirectly, of one activity, or process, or component thereof, upon another.

   

Desk Check

One method of validating a specific component of a plan. Typically, the owner of the component reviews it for accuracy and completeness and signs off.

   

Disaster

Situation where widespread human, material, economic or environmental losses have occurred which exceeded the ability of the affected organization (2.2.9), community or society to respond and recover using its own resources. Source: ISO 2.1.11

   

Disaster Recovery

The process, policies and procedures related to preparing for recovery or continuation of technology infrastructure, systems and applications which are vital to an organization after a disaster or outage.
NOTE: Disaster Recovery focuses on the information or technology systems that support business functions, as opposed to Business Continuity which involves planning for keeping all aspects of a business functioning in the midst of disruptive events. Disaster recovery is a subset of Business Continuity.

   

Disaster Recovery Plan

The management approved document that defines the resources, actions, tasks and data required to manage the technology recovery effort. Usually refers to the technology recovery effort. This is a component of the Business Continuity Management Program.

   

Disaster Recovery Planning

The process of developing and maintaining recovery strategies for information technology (IT) systems, applications and data. This includes networks, servers, desktops, laptops, wireless devices, data and connectivity.
NOTE: Priorities for IT recovery should be consistent with the priorities for recovery of business functions and processes that were developed during the business impact analysis (BIA) process. IT resources required to support time-sensitive business functions and processes should also be identified.

   

Drop Ship

A strategy for a) Delivering equipment, supplies, and materials at the time of a business continuity event or exercise. b) Providing replacement hardware within a specified time period via prearranged contractual arrangements with an equipment supplier at the time of a business continuity event.

   

Electronic Vaulting

The transfer of data by electronic means to a backup site, as opposed to the physical shipment of backup tapes or disks.

   

Emergency

Any incident, whether natural, technological, or human-caused, that requires responsive action to protect life or property.

   

Emergency Control Center (ECC)

An emergency operations center (EOC) is a physical (e.g., a conference room) or virtual (e.g., telephone conference call) location designed to support emergency response, business continuity and crisis communications activities. Staff meets at the EOC to manage preparations for an impending event or manage the response to an ongoing incident.
Source - FEMA

   

Emergency Coordinator

The person designated to plan, exercise, and implement the activities of sheltering in place or the evacuation of occupants of a site with the first responders and emergency services agencies.

   

Emergency Operations Center (EOC)

An emergency operations center (EOC) is a physical (e.g., a conference room) or virtual (e.g., telephone conference call) location designed to support emergency response, business continuity and crisis communications activities. Staff meets at the EOC to manage preparations for an impending event or manage the response to an ongoing incident. Source – FEMA

   

Emergency Preparedness

The capability that enables an organization or community to respond to an emergency in a coordinated, timely, and effective manner to prevent the loss of life and minimize injury and property damage.

   

Emergency Procedures

A documented list of activities to commence immediately to prevent the loss of life and minimize injury and property damage.

   

Emergency Response Plan

A documented plan usually addressing the immediate reaction and response to an emergency situation

   

Emergency Response Procedures

The initial response to any event and is focused upon protecting human life and the organization’s assets.

   

Emergency Response Team (ERT)

Qualified and authorized personnel who have been trained to provide immediate assistance.

   

Enterprise Wide Planning

The overarching master plan covering all aspects of business continuity within the entire organization.

   

Escalation

The process by which event-related information is communicated upwards through an organization's established chain of command.

   

Evacuation

The movement of employees, visitors and contractors from a site and/or building to a safe place (assembly area) in a controlled and monitored manner at time of an event.

   

Executive / Management Succession Plan

A predetermined plan for ensuring the continuity of authority, decision-making, and communication in the event that key members of executive management unexpectedly become incapacitated.

   

Exercise

A people focused activity designed to execute business continuity plans and evaluate the individual and/or organization performance against approved standards or objectives. Exercises can be announced or unannounced, and are performed for the purpose of training and conditioning team members, and validating the business continuity plan. Exercise results identify plan gaps and limitations and are used to improve and revise the Business Continuity Plans. Types of exercises include: Table Top Exercise, Simulation Exercise, Operational Exercise, Mock Disaster, Desktop Exercise, Full Rehearsal.

   

Exercise Auditor

An appointed role that is assigned to assess whether the exercise aims / objectives are being met and to measure whether activities are occurring at the right time and involve the correct people to facilitate their achievement. The exercise auditor is not responsible for the mechanics of the exercise. This independent role is crucial in the subsequent debriefing.

   

Exercise Controller

See Exercise Owner

   

Exercise Coordinator

They are responsible for the mechanics of running the exercise. The Coordinator must lead the exercise and keep it focused within the predefined scope and objectives of the exercise as well as on the disaster scenario. The Coordinator must be objective and not influence the outcome. They perform the coordination to make sure appropriate exercise participants have been identified and that exercise scripts have been prepared before, utilized during, and updated after the exercise.

   

Exercise Observer

An exercise observer has no active role within the exercise but is present for awareness and training purposes. An exercise observer might make recommendations for procedural improvements.

   

Exercise Owner

An appointed role that has total management oversight and control of the exercise and has the authority to alter the exercise plan. This includes early termination of the exercise for reasons of safety or the aims / objectives of the exercise cannot be met due to an unforeseen or other internal or external influence.

   

Exercise Plan

A plan designed to periodically evaluate tasks, teams, and procedures that are documented in business continuity plans to ensure the plan’s viability. This can include all or part of the BC plan, but should include mission critical components.

   

Exercise Script

A set of detailed instructions identifying information necessary to implement a predefined business continuity event scenario for evaluation purposes.

   

Exposure

The potential susceptibility to loss; the vulnerability to a particular risk.

   

Extra Expense

The extra cost necessary to implement a recovery strategy and/or mitigate a loss. An example is the cost to transfer inventory to an alternate location to protect it from further damage, cost of reconfiguring lines, overtime costs, etc. Typically reviewed during BIA and is a consideration during insurance evaluation.

   

Fellow (FBCI)

Fellow Business Continuity Institute. This senior membership grade is currently held by c125 BCM practitioners. Applications or nominations to this grade are considered from very experienced MBCIs or SBCIs who can provide evidence of a significant contribution to the Institute and the BCM discipline. There is no direct entry into Fellowship.

   

Floor Warden

Person responsible for ensuring that all employees, visitors and contractors evacuate a floor within a specific site.

   

Full Rehearsal

An exercise that simulates a Business Continuity event where the organization or some of its component parts are suspended until the exercise is completed.

   

Gap Analysis

A survey whose aim is to identify the differences between BCM/Crisis Management requirements (what the business says it needs at time of an incident) and what is in place and/or currently available

A facility equipped with full technical requirements including IT, Telecoms and Infrastructure, and which can be used to provide rapid resumption of operations.

Editor's Note: Hot sites usually refer to IT and Telecom capabilities.  When used in the same context for business users they are more often referred to as Work Area Recovery Sites.

   

Hardening

The process of making something more secure, resistant to attack, or less vulnerable.

   

Health and Safety

The process by which the well being of all employees, contractors, visitors and the public is safeguarded. All business continuity plans and planning must be cognizant of H&S statutory and regulatory requirements and legislation. Health and Safety considerations should be reviewed during the Risk assessment.

   

High-Availability

Systems or applications requiring a very high level of reliability and availability. High availability systems typically operate 24x7 and usually require built-in redundancy to minimize the risk of downtime due to hardware and/or telecommunication failures.

   

High-Risk Areas

Areas identified during the risk assessment that are highly susceptible to a disaster situation or might be the cause of a significant disaster.

   

Hot site

An alternate facility that already has in place the computer, telecommunications, and environmental infrastructure required to recover critical business functions or information systems.

   

Human Continuity

The ability of an organization to provide support for its associates and their families before, during, and after a business continuity event to ensure a viable workforce. This involves pre planning for potential psychological responses, occupational health and employee assistance programs, and employee communications.

   

Human Threats

Possible disruptions in operations resulting from human actions as identified during the risk assessment. (i.e., disgruntled employee, terrorism, blackmail, job actions, riots, etc.)

   

Integrated Capability Analysis (ICA)

An analytical methodology which considers concurrent and contextual review of multiple metrics, to provide a more complete picture regarding a particular plan, artifact, or aspect of the business continuity program

   

Impact

The effect, acceptable or unacceptable, of an event on an organization. The types of business impact are usually described as financial and non-financial and are further divided into specific types of impact.

   

Incident

An event which is not part of standard business operations which may impact or interrupt services and, in some cases, may lead to disaster.

   

Incident Command System (ICS)

A standardized on-scene emergency management construct specifically designed to provide for the adoption of an integrated organizational structure that reflects the complexity and demands of single or multiple incidents, without being hindered by jurisdictional boundaries. ICS is the combination of facilities, equipment, personnel, procedures, and communications operating within a common organizational structure, designed to aid in the management of resources during incidents. It is used for all kinds of emergencies and is applicable to small as well as large and complex incidents. ICS is used by various jurisdictions and functional agencies, both public and private, to organize field-level incident management operations.
Source:  FEMA ICS Glossary

   

Incident Management

The process by which an organization responds to and controls an incident using emergency response procedures or plans.

   

Incident Management Plan

A clearly defined and documented plan of action for use at the time of an incident, typically covering the key personnel, resources, services and actions needed to implement the incident management process.

   

Incident Manager

Commands the local emergency operations center (EOC) reporting up to senior management on the recovery progress. Has the authority to invoke the recovery plan

   

Incident Response

The response of an organization to a disaster or other significant event that may significantly impact the organization, its people, or its ability to function productively. An incident response may include evacuation of a facility, initiating a disaster recovery plan, performing damage assessment, and any other measures necessary to bring an organization to a more stable status.

   

Information Security

The securing or safeguarding of all sensitive information, electronic or otherwise, which is owned by an organization.

   

Infrastructure

The term infrastructure refers to the entire system of facilities, equipment, and services that an organization needs in order to function.
Source:  ISO22301 2012 Plain English

   

Integrated Exercise

An exercise conducted on multiple interrelated components of a Business Continuity Plan, typically under simulated operating conditions. Examples of interrelated components may include interdependent departments or interfaced systems.

   

Integrated Test(ing)

Examination of a plan that addresses multiple plan components, in conjunction with each other, typically under simulated operating conditions.

   

Interim Site

A temporary location used to continue performing business functions after vacating a recovery site and before the original or new home site can be occupied. Move to an interim site may be necessary if ongoing stay at the recovery site is not feasible for the period of time needed or if the recovery site is located far from the normal business site that was impacted by the disaster. An interim site move is planned and scheduled in advance to minimize disruption of business processes; equal care must be given to transferring critical functions from the interim site back to the normal business site.

   

Internal Hot site

A fully equipped alternate processing site owned and operated by the organization.

   

Key Tasks

Priority procedures and actions in a Business Continuity Plan that must be executed within the first few minutes/hours of the plan invocation.

   

Lead Time

The time it takes for a supplier - either equipment or a service - to make that equipment or service available.  Business continuity plans should try to minimize this by agreeing to Service Levels (Service Level Agreement) with the supplier in advance rather than relying on the supplier's best efforts.

   

Logistics / Transportation Team

A team comprised of various members representing departments associated with supply acquisition and material transportation, responsible for ensuring the most effective acquisition and mobilization of hardware, supplies, and support materials. This team is also responsible for transporting and supporting staff.

   

Loss

Unrecoverable resources that are redirected or removed as a result of a Business Continuity event. Such losses may be loss of life, revenue, market share, competitive stature, public image, facilities, or operational capability.

   

Loss Adjuster

Designated position activated at the time of a Business Continuity event to assist in managing the financial implications of the event and should be involved as part of the management team where possible

   

Loss Reduction

The technique of instituting mechanisms to lessen the exposure to a particular risk. Loss reduction involves planning for, and reacting to, an event to limit its impact. Examples of loss reduction include sprinkler systems, insurance policies, and evacuation procedures.

   

Loss Transaction Recovery

Recovery of data (paper within the work area and/or system entries) destroyed or lost at the time of the disaster or interruption. Paper documents may need to be requested or re-acquired from original sources. Data for system entries may need to be recreated or reentered

   

Manual Procedures

An alternative method of working following a loss of IT systems. As working practices rely more and more on computerized activities, the ability of an organization to fallback to manual alternatives lessens. However, temporary measures and methods of working can help mitigate the impact of a business continuity event and give staff a feeling of doing something.

   

Member (MBCI)

Member of the Business Continuity Institute. Those wishing to attain this well respected certification need to demonstrate experience of working as a BCM practitioner for 3+ years across all six Business Continuity Competencies and hold the BCI Certificate credential of CBCI with merit or other recognized credentials.

   

MBCP

Master Business Continuity Professional. The Master level certification is for individuals with a minimum of five years of Enterprise Continuity Mgmt experience in 7 of the 10 Professional Practices, have passed both the qualifying exam and the Masters case study, and have had their DRII Certification Application approved.

   

Mission-Critical Activities

The critical operational and/or business support activities (either provided internally or outsourced) required by the organization to achieve its objective(s) i.e. services and/or products.

   

Mission-Critical Application

Applications that support business activities or processes that could not be interrupted or unavailable for 24 hours or less without significantly jeopardizing the organization.

   

Mobile Recovery

A mobilized resource purchased or contracted for the purpose of business recovery. The mobile recovery center might include: computers, workstations, telephone, electrical power, etc.

   

Mobile Standby Trailer

A transportable operating environment, often a large trailer, that can be configured to specific recovery needs such as office facilities, call centers, data centers, etc. This can be contracted to be delivered and set up at a suitable site at short notice.

   

Mobilization

The activation of the recovery organization in response to a disaster declaration.

   

Mock Disaster

One method of exercising teams in which participants are challenged to determine the actions they would take in the event of a specific disaster scenario. Mock disasters usually involve all, or most, of the applicable teams. Under the guidance of exercise coordinators, the teams walk through the actions they would take per their plans, or simulate performance of these actions. Teams may be at a single exercise location, or at multiple locations, with communication between teams simulating actual ‘disaster mode’ communications. A mock disaster will typically operate on a compressed timeframe representing many hours, or even days.

   

Minimum Planning Duration (MPD)

A recovery strategy imperative which mandates how long each plan’s recovery strategy is expected to endure without receiving support from resources which are external to the plan

   

Minimum Planning Radius (MPR)

A recovery strategy imperative which defines the geographic size of an event the institution’s business continuity plans must address

   

N + 1

A fault tolerant strategy that includes multiple systems or components protected by one backup system or component. (Many-to-one relationship)

   

Network Outage

An interruption of voice, data, or IP network communications.

   

Off-Site Storage

Any place physically located a significant distance away from the primary site, where duplicated and vital records (hard copy or electronic and/or equipment) may be stored for use during recovery.

   

Operational Exercise

See: Exercise

   

Operational Risk

The risk of loss resulting from inadequate or failed procedures and controls. This includes loss from events related to technology and infrastructure, failure, business interruptions, staff related problems, and from external events such as regulatory changes

   

Orderly Shutdown

The actions required to rapidly and gracefully suspend a business function and/or system during a disruption.

   

Outage

The interruption of automated processing systems, infrastructure, support services, or essential business operations, which may result, in the organizations inability to provide services for some period of time.

   

Peer Review

A review of a specific component of a plan by personnel (other than the owner or author) with appropriate technical or business knowledge for accuracy and completeness.

   

Plan Maintenance

The management process of keeping an organization’s Business continuity management plans up to date and effective. Maintenance procedures are a part of this process for the review and update of the BC plans on a defined schedule. Maintenance procedures are a part of this process.

   

Preventative Measures

Controls aimed at deterring or mitigating undesirable events from taking place.

   

Prioritization

The ordering of critical activities and their dependencies are established during the BIA and Strategic-planning phase. The business continuity plans will be implemented in the order necessary at the time of the event.

   

Qualitative Assessment

The process for evaluating a business function based on observations and does not involve measures or numbers. Instead, it uses descriptive categories such as customer service, regulatory requirements, etc to allow for refinement of the quantitative assessment. This is normally done during the BIA phase of planning.

   

Quantitative Assessment

The process for placing value on a business function for risk purposes. It is a systematic method that evaluates possible financial impact for losing the ability to perform a business function. It uses numeric values to allow for prioritizations. This is normally done during the BIA phase of planning.

   

Quick Ship

See Drop Ship.

   

Reciprocal Agreement

Agreement between two organizations (or two internal business groups) with similar equipment/environment that allows each one to recover at the other’s location.

   

Recoverable Loss

Financial losses due to an event that may be reclaimed in the future, e.g. through insurance or litigation. This is normally identified in the Risk Assessment or BIA.

   

Recovery

Implementing the prioritized actions required to return the processes and support functions to operational stability following an interruption or disaster.

   

Recovery Management Team

See: Business Continuity Management (BCM) Team.

   

Recovery Period

The time period between a disaster and a return to normal functions, during which the disaster recovery plan is employed.

   

Recovery Point Capability (RPC)

 

 

The point in time to which data was restored and/or systems were recovered (at the designated recovery/alternate location) after an outage or during a disaster recovery exercise.

 

 

Recovery Point Objective (RPO)

The point in time to which data is restored and/or systems are recovered after an outage.

Note: RPO is often used as the basis for developing backup strategies and determining the amount of data that may require recreation after systems have been recovered. RPO for applications can be enumerated in business time (i.e., “8 business hours” after a Sunday disaster restores to close of business Thursday) or elapsed time, but is always measured in terms of time before a disaster. RPO for systems typically must be established at time of disaster as a specific point in time (e.g., end of previous day’s processing) or software version/release.

   

Recovery Services Agreement / Contract

A contract with an external organization guaranteeing the provision of specified equipment, facilities, or services, usually within a specified time period, in the event of a business interruption. A typical contract will specify a monthly subscription fee, a declaration fee, usage costs, method of performance, amount of test time, termination options, penalties and liabilities, etc.

   

Recovery Site

A designated site for the recovery of business unit, technology, or other operations, which are critical to the enterprise.

   

Recovery Strategy

See business continuity strategy

   

Recovery Teams

A structured group of teams ready to take control of the recovery operations if a disaster should occur.

   

Recovery Time Capability (RTC)

 

The demonstrated amount of time in which systems, applications and/or functions have been recovered, during an exercise or actual event, at the designated recovery/alternate location (physical or virtual).  As with RTO, RTC includes assessment, execution and verification activities.  RTC and RTO are compared during gap analysis.

Recovery Time Objective (RTO)

The period of time within which systems, applications, or functions must be recovered after an outage. RTO includes the time required for: assessment, execution and verification. RTO may be enumerated in business time (e.g. one business day) or elapsed time (e.g. 24 elapsed hours).

Notes: Assessment includes the activities which occur before or after an initiating event, and lead to confirmation of the execution priorities, time line and responsibilities, and a decision regarding when to execute.

 

Execution includes the activities related to accomplishing the pre-planned steps required within the phase to deliver a function, system or application in a new location to its owner.

 

Verification includes steps taken by a function, system or application owner to ensure everything is in readiness to proceed to live operations.

   

Recovery Timeline

The sequence of recovery activities, or critical path, which must be followed to resume an acceptable level of operation following a business interruption. The timeline may range from minutes to weeks, depending upon the recovery requirements and methodology.

   

Resilience

The ability of an organization to absorb the impact of a business interruption, and continue to provide a minimum acceptable level of service.

   

Resilient

The process and procedures required to maintain or recover critical services such as “remote access” or “end-user support” during a business interruption.

   

Response

The reaction to an incident or emergency to assess the damage or impact and to ascertain the level of containment and control activity required. In addition to addressing matters of life safety and evacuation, Response also addresses the policies, procedures and actions to be followed in the event of an emergency.

   

Restoration

Process of planning for and/or implementing procedures for the repair of hardware, relocation of the primary site and its contents, and returning to normal operations at the permanent operational location.

   

 

Resumption

The process of planning for and/or implementing the restarting of defined business processes and operations following a disaster. This process commonly addresses the most critical business functions within BIA specified timeframes.

   

Risk

Potential for exposure to loss which can be determined by using either qualitative or quantitative measures.

   

Risk Assessment / Analysis

Process of identifying the risks to an organization, assessing the critical functions necessary for an organization to continue business operations, defining the controls in place to reduce organization exposure and evaluating the cost for such controls. Risk analysis often involves an evaluation of the probabilities of a particular event.

   

Risk Categories

Risks of similar types are grouped together under key headings, otherwise known as ‘risk categories’. These categories include reputation, strategy, financial, investments, operational infrastructure, business, regulatory compliance, Outsourcing, people, technology and knowledge.

   

Risk Controls

All methods of reducing the frequency and/or severity of losses including exposure avoidance, loss prevention, loss reduction, segregation of exposure units and non-insurance transfer of risk

   

Risk Management

The culture, processes and structures that are put in place to effectively manage potential negative events. As it is not possible or desirable to eliminate all risk, the objective is to reduce risks to an acceptable level

   

Risk Transfer

A common technique used by Risk Managers to address or mitigate potential exposures of the organization. A series of techniques describing the various means of addressing risk through insurance and similar products.

   

Roll Call

The process of identifying that all employees, visitors and contractors have been safely evacuated and accounted for following an evacuation of a building or site.

   

Salvage & Restoration

The act of conducting a coordinated assessment to determine the appropriate actions to be performed on impacted assets. The assessment can be coordinated with Insurance adjusters, facilities personnel, or other involved parties. Appropriate actions may include: disposal, replacement, reclamation, refurbishment, recovery or receiving compensation for unrecoverable organizational assets.

   

SBCI

Specialist of Business Continuity Institute. A professional certification granted by the Business Continuity Institute for specialist practitioners with at least two years of full time experience in a business continuity management related profession and who have good general knowledge of some of the BCI Certification Standards.

   

Scenario

A pre-defined set of Business Continuity events and conditions that describe, for planning purposes, an interruption, disruption, or loss related to some aspect(s) of an organization’s business operations to support conducting a BIA, developing a continuity strategy, and developing continuity and exercise plans. Note: Scenarios are neither predictions nor forecasts.

   

Security Review

A periodic review of policies, procedures, and operational practices maintained by an organization to ensure that they are followed and effective.

   

Self Insurance

The pre-planned assumption of risk in which a decision is made to bear loses that could result from a Business Continuity event rather than purchasing insurance to cover those potential losses.

   

Service Continuity

The process and procedures required to maintain or recover critical services such as “remote access” or “end-user support” during a business interruption.

   

Service Continuity Planning

A process used to mitigate, develop, and document procedures that enable an organization to recover critical services after a business interruption.

   

Service Level Agreement (SLA)

A formal agreement between a service provider (whether internal or external) and their client (whether internal or external), which covers the nature, quality, availability, scope and response of the service provider. The SLA should cover day-to-day situations and disaster situations, as the need for the service may vary in a disaster.

   

Service Level Management (SLM)

The process of defining, agreeing, documenting and managing the levels of any type of services provided by service providers whether internal or external that are required and cost justified.

   

Simulation Exercise

One method of exercising teams in which participants perform some or all of the actions they would take in the event of plan activation. Simulation exercises, which may involve one or more teams, are performed under conditions that at least partially simulate ‘disaster mode’. They may or may not be performed at the designated alternate location, and typically use only a partial recovery configuration.

   

Single Point of Failure (SPOF)

A unique pathway or source of a service, activity, and/or process. Typically, there is no alternative and a loss of that element could lead to a failure of a critical function.

   

Specialist (SBCI)

 

 

 

 

 

This membership grade was developed to allow certification to those practitioners who specialize in aspects of BCM or who work in associated disciplines. Two years specialist experience, a Pass in the BCI Certificate examination and a professional qualification from another awarding body will enable the applicant to enter one of the six Specialist Faculties.

Stand Down

Formal notification that the response to a Business Continuity event is no longer required or has been concluded.

   

Standalone Test

A test conducted on a specific component of a plan in isolation from other components to validate component functionality, typically under simulated operating conditions.

   

Structured Walkthrough

Types of exercise in which team members physically implement the business continuity plans and verbally review each step to assess its effectiveness, identify enhancements, constraints and deficiencies.

   

Subscription

See: Recovery Services Agreement / Contract

   

Supply Chain

All suppliers, manufacturing facilities, distribution centers, warehouses, customers, raw materials, work-in-process inventory, finished goods, and all related information and resources involved in meeting customer and organizational requirements.

   

System

Set of related technology components that work together to support a business process or provide a service.

   

System Recovery

The procedures for rebuilding a computer system and network to the condition where it is ready to accept data and applications, and facilitate network communications.

   

System Restore

The procedures necessary to return a system to an operable state using all available data including data captured by alternate means during the outage. System restore depends upon having a live, recovered system available.

   

Table Top Exercise

One method of exercising plans in which participants review and discuss the actions they would take without actually performing the actions. Representatives of a single team, or multiple teams, may participate in the exercise typically under the guidance of exercise facilitators.

   

Task List

Defined mandatory and discretionary tasks allocated to teams and/or individual roles within a Business Continuity Plan

   

Technical Recovery Team

 

 

 

Test

A group responsible for: relocation and recovery of technology systems, data, applications and/or supporting infrastructure components at an alternate site following a technology disruption; and subsequent resumption and restoration of those operations at an appropriate site.

A pass/fail evaluation of infrastructure (example-computers, cabling, devices, hardware) and\or physical plant infrastructure (example-building systems, generators, utilities) to demonstrate the anticipated operation of the components and system. Tests are often performed as part of normal operations and maintenance. Tests are often included within exercises. (See Exercise).

   

Test Plan

See Exercise Plan

   

Threat

A combination of the risk, the consequence of that risk, and the likelihood that the negative event will take place.

   

Trauma Counseling

The provisioning of counseling assistance by trained individuals to employees, customers and others who have suffered mental or physical injury as the result of an event.

   

Trauma Management

The process of helping employees deal with trauma in a systematic way following an event by proving trained counselors, support systems, and coping strategies with the objective of restoring employees psychological well being.

   

Unexpected Loss

The worst-case financial loss or impact that a business could incur due to a particular loss event or risk. The unexpected loss is calculated as the expected loss plus the potential adverse volatility in this value. It can be thought of as the worst financial loss that could occur in a year over the next 20 years.

   

Uninterruptible Power Supply (UPS)

A backup electrical power supply that provides continuous power to critical equipment in the event that commercial power is lost. The UPS (usually a bank of batteries) offers short-term protection against power surges and outages. The UPS usually only allows enough time for vital systems to be correctly powered down.

   

Validation Script

A set of procedures within the Business Continuity Plan to validate the proper function of a system or process before returning it to production operation.

   

Vital Records

Records essential to the continued functioning or reconstitution of an organization during and after an emergency and also those records essential to protecting the legal and financial rights of that organization and of the individuals directly affected by its activities.

   

Warm Site

An alternate processing site which is equipped with some hardware, and communications interfaces, electrical and environmental conditioning which is only capable of providing backup after additional provisioning, software or customization is performed.

   

Work Area Facility

A pre-designated space provided with desks, telephones, PCs, etc. ready for occupation by business recovery teams at short notice. May be internally or externally provided.

   

Work Area Recovery

The component of recovery and continuity that deals specifically with the relocation of a key function or department in the event of a disaster, including personnel, essential records, equipment supplies, work space, communication facilities, work station computer processing capability, fax, copy machines, mail services, etc. Office recovery environment complete with necessary office infrastructure (desk, telephone, workstation, hardware, communications).

   

Work Area Recovery Planning

The business continuity planning process of identifying the needs and preparing procedures and personnel for use at the work area facility.

   

Workaround Procedures

Alternative procedures that may be used by a functional unit(s) to enable it to continue to perform its critical functions during temporary unavailability of specific application systems, electronic or hard copy data, voice or data communication systems, specialized equipment, office facilities, personnel, or external services.