Free and Premium GAQM CBCP-002 Dumps Questions Answers

Threats can be considered any events or situations that can cause harm or disruption to an organization’s functions or processes. Threats can be natural, human-made, or technological in origin. Some examples of threats are water (such as floods, leaks, or spills), technology failure (such as system crashes, cyberattacks, or power outages), and fire (such as arson, accidents, or explosions). Verified References:

A formal “disaster” can only be declared by the firm owners or by the IT Department Manager. This is false because a formal “disaster” can be declared by any authorized person who has the responsibility and authority to activate the business continuity and disaster recovery plan. The authorized person may vary depending on the type, scope, and severity of the disaster, but it should be clearly defined in the plan who can declare a disaster and under what circumstances. The authorized person should also communicate the declaration of a disaster to all relevant stakeholders, such as employees, customers, suppliers, partners, regulators, media, or the public. Verified References:

Tolerating risk is where no action is taken to mitigate or reduce a risk. This is true because tolerating risk is one of the possible strategies for managing risk. Tolerating risk means accepting or retaining a risk without taking any further action to reduce it, either because the risk level is acceptable or because the cost or effort of reducing it is not justified. Tolerating risk may be appropriate for low-priority or low-impact risks that do not pose a significant threat to the organization’s objectives. Verified References:

A disaster lasting longer than seventy-two (72) hours requires implementation of a business continuity and disaster recovery plan. A business continuity and disaster recovery plan is a comprehensive document that outlines how an organization will respond to and recover from adisaster that disrupts its normal operations. It covers both the IT aspects (disaster recovery) and the business aspects (business continuity) of restoring the critical functions and processes within an acceptable time frame. A disaster lasting longer than seventy-two (72) hours is likely to have significant impacts on the organization’s performance, reputation, assets, and stakeholders, and therefore requires a coordinated and structured approach to ensure its survival and resilience. Verified References:

Damage assessment is the process of evaluating the extent and severity of the damage caused by a disruption to an organization’s facilities, equipment, systems, data, records, or personnel. It includes identifying the affected business functions and processes, estimating the time it will take to restore them to normal or acceptable levels of operation, and evaluating whether the recovery time exceeds the maximum tolerable downtime (MTD) for each function or process. If so, a disaster should be declared and the business continuity plan should be activated. Having the insurance company declare the total extent of the damages is not part of the damage assessment process, as it may take longer than the MTD and may not reflect the operational impact of the damage. Verified References:

The four T’s of risk guidance produced by the Office of Government Commerce are transfer, tolerate, treat, and terminate. They are:

Transfer: This strategy involves transferring or sharing some or all of the responsibility or impact of a risk to another party, such as an insurer, a supplier, or a partner.

Tolerate: This strategy involves accepting or retaining a risk without taking any further action to reduce it, either because the risk level is acceptable or because the cost or effort of reducing it is not justified.

Treat: This strategy involves taking steps to reduce the likelihood or impact of a risk to an acceptable level, such as implementing controls, mitigations, or contingency plans.

Terminate: This strategy involves eliminating or avoiding a risk by discontinuing or changing the activity that causes it. Verified References:

Risk ownership must be clearly set out, documented and agreed with the individual owners at all levels of the operational risk management process. This is true because risk ownership is one of the key principles of business continuity management. Risk ownership means that each risk has a designated person who is responsible and accountable for its identification, assessment, treatment, monitoring, and reporting. Risk owners should have the authority and resources to manage their risks effectively and efficiently. Verified References:

A formal “disaster” can only be declared by the firm owners or by the IT Department Manager. This is false because a formal “disaster” can be declared by any authorized person who has the responsibility and authority to activate the business continuity and disaster recovery plan. The authorized person may vary depending on the type, scope, and severity of the disaster, but it should be clearly defined in the plan who can declare a disaster and under what circumstances. The authorized person should also communicate the declaration of a disaster to all relevant stakeholders, such as employees, customers, suppliers, partners, regulators, media, or the public. Verified References:

A disaster can also be declared for an illness pandemic where a significant portion of employees are sick. This is true because an illness pandemic is a type of natural disaster that can affect an organization’s ability to continue its normal operations. An illness pandemic can cause absenteeism, reduced productivity, increased costs, supply chain disruptions, customer dissatisfaction, or regulatory compliance issues. Therefore, an organization may need to declare a disaster and activate its business continuity and disaster recovery plan if an illness pandemic impacts its critical functions and processes beyond an acceptable level. VerifiedReferences:

Business continuity planning is not a one-time activity, but a dynamic and ongoing process that needs to be reviewed and updated regularly to reflect changes in the internal and external environment. The frequency of review may vary depending on the nature and size of the organization, but it is generally recommended to conduct a review at least annually or whenever significant changes occur that may affect the continuity of the organization’s functions and processes. Such changes may include organizational restructuring, new products or services, new technologies, new regulations, new threats or vulnerabilities, or lessons learned from incidents or exercises. Verified References:

Continuity planning with external stakeholders, such as key suppliers, is essential to ensure the uninterrupted flow of information, materials, products, and services during disruptions. The type of continuity planning determines the nature of the relationship and coordination with these suppliers:

Multilateral: This involves multiple parties (e.g., an organization and several suppliers or partners) working together in a coordinated plan. While multilateral planning can enhance collaboration across a broad network, it is complex and not specifically tailored to strengthening individual supplier relationships, which is the focus of this question.

Bilateral: This refers to a two-party agreement or plan between the organization and a specific supplier. Bilateral continuity planning fosters a direct, functioning relationship with key suppliers, enabling mutual understanding, aligned recovery strategies, and stronger assurances of continuous supply. It is the most effective approach for building robust, one-on-one supplier relationships, as it allows for tailored coordination and commitments.

Unilateral: This is a one-sided plan where the organization develops its continuity strategy without direct supplier involvement. While it may address internal resilience, it does not enhance the functioning relationship with suppliers or provide assurances of their continuity, making it inadequate for this purpose.

The correct answer isB. Bilateral, as it directly enhances the relationship with key suppliers through mutual planning and coordination, ensuring a continuous supply chain. This aligns with Business Continuity Professional practices that emphasize collaboration with critical external dependencies.

References:

DRI International Professional Practices for Business Continuity Management (2023), Section 4: Business Impact Analysis and Risk Assessment – Highlights the importance of engaging key suppliers in continuity planning.

ISO 22301:2019, Clause 8.2.3 – Emphasizes identifying and managing dependencies, including suppliers, through coordinated planning.

The primary reason for developing and implementing a business continuity plan is to ensure the continuation of a company’s critical functions and processes in the face of a disruption that may otherwise cause severe losses or damage to the company’s reputation, assets, customers, or stakeholders. A business continuity plan can help a company to resume operations asquickly as possible after a disruption, minimize the impact on its performance and profitability, protect its brand and image, and fulfill its legal and contractual obligations. Verified References: