CBCI 7.0 reflects the GPG 7.0 emphasis that business continuity culture is not achieved by “mandating and enforcing compliance” alone; it is achieved when BC becomes understood, valued, and practiced across the organization. A “good practice” BC culture therefore looks like shared understanding and broad participation —people know why BC matters, understand their roles, and actively contribute to readiness and resilience. That matches option C .

Option A describes compliance without ownership, which is weaker and often fragile under stress. Option B incorrectly centralizes BC into the BC team; good practice requires distributed ownership (leaders and staff) rather than the BC function “doing it all.” Option D is also incorrect because top management involvement remains essential (leadership sets direction, provides resources, and reinforces expectations); a mature culture does not remove leadership accountability—it strengthens organization-wide engagement with leadership support. The GPG’s cultural focus is about enabling the organization to improve BC culture intentionally and make BC part of “how we operate,” not a specialist-only activity.

The CBCI 7.0 course explains that defining the BCMS scope is a dynamic process , which means that the parameters set are not necessarily permanent and may be reviewed and revised as organizational needs, risks, and priorities evolve. While the scope provides clarity on which parts of the organization, products, services, and activities are included, it must remain flexible to adapt to change. Permanent or fixed parameters risk locking the BCMS into outdated or incomplete coverage, reducing effectiveness. Efficient use of time and resources is a benefit of appropriate scoping, but permanence is not a characteristic of good scope definition.

Measuring Business Continuity culture is essential to assess the level of engagement, understanding, and commitment personnel have toward Business Continuity plans and procedures. The CBCI 7.0 course stresses that culture measurement helps predict the likely success of continuity efforts during disruptions. A strong culture supports adherence to plans and proactive risk management, while a weak culture may highlight areas needing targeted improvement. While measurements can indirectly inform reviews and validations, the primary focus is on gauging personnel behaviour and engagement, which is the most critical factor in continuity effectiveness.

A response structure must work under pressure, with clear leadership, decision rights, and coordination across incident management, crisis management, and recovery teams. In PP5 (Enabling Solutions), organizations embed agreed solutions by establishing response arrangements and plans that can actually be executed during disruption; that requires putting competent individuals into key leadership roles so decisions are timely, coordinated, and aligned to priorities.

Option B is therefore the correct inclusion in the process: ensure appropriate and competent individuals are assigned to leadership roles. Competence matters because leadership roles require situational assessment, escalation, communications, and resource prioritization—not just job titles.

Option A can be useful for specific dependencies (e.g., supplier coordination) but it is not a core requirement for designing the internal response structure. Option C is overly rigid: the response structure should integrate with existing management and operational structures where practical, rather than forcing wholesale reorganization. Option D (performance management) is not a prerequisite design step for response structures; it may support broader governance, but effective response depends first on clear roles, authority, and capable leadership.

The CBCI 7.0 course highlights that the most effective way to motivate personnel is through clear, accessible, and engaging communication. Materials should be understandable regardless of role or background, avoiding jargon and complexity. This clarity facilitates comprehension and fosters genuine interest in Business Continuity. Detailed explanations and testing may overwhelm or alienate, while relying solely on email or intranet assumes preferences that may not be universal. Recording attendance links to compliance rather than motivation. Tailoring communication style and delivery to audience needs maximizes engagement and encourages embracement.

A gap analysis is a critical evaluation tool used in the Solutions Design phase to identify differences between existing Business Continuity capabilities and what is required to achieve organizational resilience. The CBCI 7.0 course specifies that this analysis determines if new or revised strategies and solutions are needed to meet Business Continuity requirements effectively. By comparing current states with desired outcomes, the gap analysis highlights areas lacking adequate controls, resources, or processes. It drives decision-making for prioritizing improvements and investments in continuity measures. This systematic assessment ensures that Business Continuity strategies are fit for purpose and aligned with evolving risks and business objectives. It is not focused on financial performance or audit justifications but on actionable capability enhancements.

While the Activities BIA informs the development of solutions, updating the BIA is not part of the solution implementation process itself . The CBCI 7.0 course explains that implementing solutions focuses on ensuring that operational plans, training, and governance are aligned and effectively deployed. Training equips personnel to use and support new solutions properly. Compliance with project management processes ensures structured, controlled implementation. The BIA is a foundational analysis tool and is typically reviewed or updated separately during scheduled risk and impact assessments rather than during solution implementation. Conflating BIA updates with implementation may confuse strategic assessment with operational execution.

In PP1 (Establishing a BCMS), defining scope is a foundational activity because it sets clear boundaries for what the BCMS applies to and what it does not. Good practice requires a scope statement that makes coverage explicit (e.g., products/services, sites, functions, legal entities, interfaces, and exclusions) so stakeholders understand the BCMS’s intended reach and so analysis and solutions design are directed appropriately. The GPG 7.0 Lite highlights that BCMS development includes developing the scope and policy , and it emphasizes continual improvement and review—implying scope may need review when organizational context changes. ( thebci.org )

Option C captures the definition accurately: scope clarifies what is covered and not covered. Option A is too absolute; you consider relevant suppliers/customers, but scope does not automatically include “all.” Option B is incorrect because scope is reviewed as the organization changes (mergers, delivery model changes, regulatory change). Option D describes the policy , not the scope. Therefore, C is the correct statement.

The CBCI 7.0 course states that conducting the risk assessment after the BIA allows the organization to prioritize risk treatments effectively by focusing on the critical activities identified during the BIA. The BIA highlights which business functions are most important and the impact of their disruption, enabling the risk assessment to concentrate on threats that could affect these priority areas. This sequencing ensures that resources and mitigation efforts are directed toward protecting the most significant risks impacting continuity objectives. Resource availability is not the primary reason, and risk assessments are integral to ongoing BCMS maintenance rather than conditional on business plan updates or solution development.

An alternate location strategy for physical infrastructure focuses on providing usable workspace quickly when a primary site is unavailable. Solutions that can be available within hours typically rely on options the organization already controls—such as repurposing internal space (often described in continuity guidance as “displacement/budge-up,” using other facilities, or relocating teams into existing sites). This is the most realistic “hours-scale” approach because it avoids procurement lead times and complex engineering dependencies.

Option B fits that model precisely: repurposing other work areas and facilities can be activated rapidly with basic logistics (access, seating, connectivity, and prioritization of critical teams).

Option A (working from home) can be a valid continuity strategy, but the question specifies physical infrastructure and an alternate location approach; remote working is not a physical alternate site solution in the same sense. Options C and D typically take longer than hours: ordering/installing equipment and rebuilding/reconnecting utilities involve supply chains, specialist work, and external dependencies. Therefore, B is the best answer.