BCI Updated CBCI Exam Questions and Answers by khalid

In CBCI 7.0, Enabling Solutions (PP5) focuses on implementing the agreed solutions produced in Solutions Design (PP4) and ensuring those solutions can be deployed through the response structure and BC plans. The GPG 7.0 Lite explains that once solutions have been specified and approved (PP4), they must be implemented before they can be deployed, and then supported by response structures and plans. Crucially, validation later confirms that implemented solutions work according to the agreed specifications. That means implementation must align to what was designed and approved—otherwise the organization risks implementing something that does not meet recovery requirements (e.g., RTOs, minimum capacity, dependency assumptions) and will likely fail validation or real incident use. Options A and B misunderstand governance: internal audit doesn’t “approve schedules” as a prerequisite, and the BC professional does not implement everything alone. Option D can undermine control; changes should be managed through governance/change control, not ad-hoc adjustment.

The CBCI 7.0 course explains that the scope of the BCMS is the primary factor influencing the selection and combination of BIA types (e.g., activity, product, or process BIAs). The scope defines which organizational units, activities, and resources are covered, thereby guiding the level and focus of impact analysis. While risk assessments, gap analyses, and stakeholder consultations inform aspects of BCMS development, they do not determine the BIA methodology as directly as the defined scope. Aligning BIAs to scope ensures consistency and resource-effective analysis.

Solutions Design (PP4) uses BC requirements from Analysis (PP3)—including RTOs and minimum acceptable capacity—to decide which strategies and solutions must be implemented first and where investment provides the most protection to priority delivery. An urgent/short RTO means the organization has very limited time before impacts become unacceptable; therefore, solutions supporting those activities typically require earlier funding and stronger capability (e.g., automation, replication, standby arrangements, pre-positioned resources). Prioritising spend against the most urgent RTOs is a direct, requirement-led approach and aligns investment to what the organization must recover fastest to survive disruption.

Option B is poor practice: not all strategies carry equal criticality—some protect essential delivery while others are “nice to have.” Option C can create inconsistent priorities across departments and undermine enterprise-wide optimization; owners contribute, but prioritisation must be governed centrally against agreed requirements. Option D focuses on cost rather than necessity; “cheap” solutions may fail to meet recovery requirements. Therefore, the correct approach is A: prioritize solutions for the shortest and most urgent RTOs.

The CBCI 7.0 course explains that the Business Impact Analysis (BIA) is the foundational tool used to identify and prioritize organizational activities, establish Recovery Time Objectives (RTOs), and determine the resources required for recovery. The BIA evaluates the impact of disruptions on critical activities and quantifies acceptable downtime, guiding the prioritization of recovery efforts. Unlike risk assessments, which identify potential threats, the BIA focuses on operational impacts and recovery priorities. While meetings with activity owners contribute to data collection, it is the structured BIA process that synthesizes this information into actionable recovery targets. Exercises test plans but do not determine priorities.