The Certificate of the Business Continuity Institute (CBCI) (CBCI)

The CBCI 7.0 course defines the Minimum Business Continuity Objective (MBCO) as the minimum level of services or outputs that must be maintained or restored to avoid unacceptable consequences. The MBCO is achieved either simultaneously with or after the Recovery Time Objective (RTO), as the RTO specifies when recovery should be complete for prioritized activities. MBCO sets a baseline for continuity, focusing on critical minimum outputs, rather than risk assessment milestones or managerial mobilization decisions. Understanding this sequencing supports realistic and measurable recovery planning.

GPG 7.0 describes Embracing Business Continuity (PP2) as a paradigm shift away from “mandating and enforcing compliance” toward embedding BC into the organization , building belief, understanding, and sustained commitment. When a culture gap is large, the best approach is progressive and people-centred: establish foundational understanding first, recognise workforce perspectives, and build credibility through practical relevance—then mature toward deeper competencies. This directly matches option C and aligns with PP2’s intent to persuade and engage the workforce so BC stays “up-to-date and operational,” producing fit-for-purpose capability over time.

Option A is risky because culture is context-specific; copying another organization’s approach may ignore your own values, incentives, and constraints. Option B (aggressive training focused on BCMS detail) often creates “tick-box” compliance rather than ownership—exactly what PP2 warns against. Option D (intranet content + annual review requirement) is passive and typically insufficient to close a large culture gap because it does not build real engagement, skills practice, or behavioural change.

The CBCI 7.0 course clarifies that conducting a gap analysis is the initial step in developing recovery strategies and solutions. The gap analysis compares current Business Continuity capabilities with the requirements identified in the BIA and risk assessments, highlighting deficiencies that must be addressed. This systematic evaluation informs strategy development by identifying where improvements or new solutions are necessary. While policy development and stakeholder consultation are important subsequent steps, gap analysis provides the evidence base required for informed decision-making. Training personnel comes later as part of implementation.

Strategic response teams play a crucial role in managing crises by making timely, high-level decisions that guide the organization ' s overall continuity response. The CBCI 7.0 course emphasizes that decisiveness and rapid decision-making are essential qualities for such teams, as delays can exacerbate disruptions and increase impacts. While coordination skills and understanding of Business Continuity plans are important, the strategic team must prioritize swift, confident decisions to steer operational teams and allocate resources effectively during dynamic and stressful situations. Identifying commercial opportunities is beneficial but secondary to ensuring continuity and stability.

In CBCI 7.0 / BCI GPG-aligned practice, the Analysis stage (PP3) uses BIA to identify what matters most and to define recovery priorities and resource requirements. A Product & Services BIA helps determine which products/services are most important, while Activity/Process BIAs identify the work that must be performed to deliver those priorities. The step that determines (finalizes) the set of prioritised activities and ties them to agreed recovery requirements (timeframe and capacity) is the consolidation of analysis outputs—bringing together BIA findings (and relevant assumptions/dependencies) into an integrated view that the organization can use for solution design and planning. This is why the correct option is Consolidated Analysis.

Activity BIA is critical because it identifies and prioritizes activities and captures detailed resource/dependency needs, but the question asks which process determines the prioritised activities in a way that links them to “predetermined timeframe and capacity” across products/services—this is the role of consolidation, turning multiple BIA layers into a single, actionable priority set for recovery.

A gap analysis is a critical evaluation tool used in the Solutions Design phase to identify differences between existing Business Continuity capabilities and what is required to achieve organizational resilience. The CBCI 7.0 course specifies that this analysis determines if new or revised strategies and solutions are needed to meet Business Continuity requirements effectively. By comparing current states with desired outcomes, the gap analysis highlights areas lacking adequate controls, resources, or processes. It drives decision-making for prioritizing improvements and investments in continuity measures. This systematic assessment ensures that Business Continuity strategies are fit for purpose and aligned with evolving risks and business objectives. It is not focused on financial performance or audit justifications but on actionable capability enhancements.

BC risk mitigation is prioritised so that effort and investment reduce risk where it matters most—i.e., where risk exceeds the organization’s tolerance. In the BCI approach, the Risk Assessment is used to analyse relevant risks to prioritised activities and identify concentrations of risk or points of failure. Those findings then inform Solutions Design decisions, where mitigations are selected to reduce exposure so recovery requirements can be met. If a risk is already acceptable , it may be monitored but does not necessarily require mitigation, because resources should be directed to the risks that threaten priority delivery and could prevent meeting targets like RTO and minimum acceptable capacity.

Option B (“all threats”) is unrealistic and not risk-based; it spreads resources too thin and often results in controls that don’t materially improve resilience. Option D (“selected risks”) is too vague unless “selected” is defined by a risk evaluation step; the correct focus is specifically unacceptable risk—risks that, if realised, would create impacts beyond what the organization will tolerate. Therefore, the best answer is C .

The CBCI 7.0 course highlights that categorizing strategies by timeframe is an effective method to ensure focus on activities with short RTOs. This approach visually and operationally segments recovery strategies, allowing the organization to prioritize resources and actions that address the most time-critical functions first. Including BIA extracts supports understanding but is insufficient on its own. Risk assessments inform treatment choices but do not inherently prioritize by RTO. Workarounds for non-priority activities are useful but are a secondary measure after prioritization. Categorizing by recovery time frames aligns operational focus with impact tolerances.

The CBCI 7.0 course details that using pre-defined impact thresholds is an effective and consistent method for prioritizing products, services, and activities during a BIA. These thresholds establish clear criteria for impact levels across various categories, such as financial loss, reputational damage, and regulatory consequences. By applying standardized thresholds, organizations can objectively assess and compare the criticality of different business functions, ensuring that prioritization aligns with organizational risk appetite and strategic objectives. This approach promotes consistency, transparency, and repeatability in BIA processes. While risk matrices and gap analyses are useful tools in risk management, pre-defined impact thresholds directly guide priority-setting within BIAs.