In pre-crisis management, CM activities are focused on prevention and preparedness activities. This is true because pre-crisis management is the phase before a crisis occurs, where the organization tries to anticipate and avoid potential crises or reduce their likelihood and impact. Pre-crisis management involves activities such as risk assessment, business impact analysis, business continuity planning, contingency planning, crisis communication planning, training and awareness, testing and exercising, monitoring and reviewing. Verified References: https://www.cisco.com/c/en/us/solutions/hybrid-work/what-is-business-continuity.html https://phoenixnap.com/blog/what-is-business-continuity-management

BIA helps to identify all of the above aspects of an organization’s functions and processes. It helps to identify the critical services and products that the organization delivers to its customers and stakeholders, and the functions and processes that support them. It also helps to identify the critical interdependencies and interested parties that are involved in or affected by the organization’s functions and processes, such as suppliers, partners, regulators, or employees. Moreover, it helps to identify the tangible and intangible impacts of a disruption to the organization’s functions and processes over a period of time, such as financial losses, reputational damage, legal liabilities, or customer dissatisfaction. Verified References: https://www.ready.gov/business-impact-analysis https://drii.org/resources/professionalpractices/EN

Financial risks are the risks that result from business decisions that are influenced by changes in markets, liquidity, and credit. Financial risks are the uncertainties or variabilities of the financial performance or position of an organization due to factors such as interest rates, exchange rates, inflation, credit ratings, debt levels, or cash flows. Financial risks can affect an organization’s profitability, solvency, liquidity, or valuation. Verified References: https://www.investopedia.com/terms/f/financialrisk.asp https://www.thebci.org/training-qualifications/good-practice-guidelines.html

Technical risk is the type of risk that is associated with risk of physical assets failing/being damaged or enhanced. Technical risk is the uncertainty or variability of the performance or reliability of physical assets, such as equipment, systems, infrastructure, or data. Technical risk can result from factors such as design flaws, manufacturing defects, maintenance issues, obsolescence, human error, natural disasters, or cyberattacks. Technical risk can affect an organization’s operational efficiency, quality, safety, security, or profitability. Verified References: https://www.investopedia.com/terms/t/technical-risk.asp https://www.thebci.org/training-qualifications/good-practice-guidelines.html

Threats can be considered any events or situations that can cause harm or disruption to an organization’s functions or processes. Threats can be natural, human-made, or technological in origin. Some examples of threats are water (such as floods, leaks, or spills), technology failure (such as system crashes, cyberattacks, or power outages), and fire (such as arson, accidents, or explosions). Verified References: https://www.iso.org/publication/PUB100442.html https://phoenixnap.com/blog/what-is-business-continuity-management

Tolerating risk is where no action is taken to mitigate or reduce a risk. This is true because tolerating risk is one of the possible strategies for managing risk. Tolerating risk means accepting or retaining a risk without taking any further action to reduce it, either because the risk level is acceptable or because the cost or effort of reducing it is not justified. Tolerating risk may be appropriate for low-priority or low-impact risks that do not pose a significant threat to the organization’s objectives. Verified References: https://www.investopedia.com/terms/t/the-four-ts.asp https://www.thebci.org/training-qualifications/good-practice-guidelines.html

Damage assessment is the process of evaluating the extent and severity of the damage caused by a disruption to an organization’s facilities, equipment, systems, data, records, or personnel. It includes identifying the affected business functions and processes, estimating the time it will take to restore them to normal or acceptable levels of operation, and evaluating whether the recovery time exceeds the maximum tolerable downtime (MTD) for each function or process. If so, a disaster should be declared and the business continuity plan should be activated. Having the insurance company declare the total extent of the damages is not part of the damage assessment process, as it may take longer than the MTD and may not reflect the operational impact of the damage. Verified References: https://www.fema.gov/pdf/emergency/nims/Damage_Assessment.pdf https://drii.org/resources/professionalpractices/EN

A facility certification center is a center that provides the physical infrastructure for testing and certifying the functionality and performance of products, systems, or services. A facility certification center may have specialized equipment, tools, environments, or standards that can simulate real-world conditions or scenarios. A facility certification center may also have qualified staff, experts, or auditors who can conduct the testing and certification process. Verified References: https://www.iso.org/publication/PUB100442.html https://www.cisco.com/c/en/us/solutions/hybrid-work/what-is-business-continuity.html

Strategic management is the type of management that is an often used term, but has so many different connotations to different people that invariably the message of its meaning gets confused. Strategic management is the process of defining and executing the long-term vision, goals, plans, and actions of an organization. Strategic management involves analyzing the internal and external environment, formulating strategies, implementing them, and evaluating their outcomes. Strategic management can be complex and challenging, as it requires alignment and integration of various aspects of the organization, such as culture, structure, resources, capabilities, stakeholders, markets, competitors, or regulations. Verified References: https://www.investopedia.com/terms/s/strategic-management.asp https://phoenixnap.com/blog/what-is-business-continuity-management

In Business Continuity Planning (BCP), confidentiality and security of sensitive information are critical considerations when releasing details publicly. According to standard practices outlined in Business Continuity Professional guidelines, such as those from the Disaster Recovery Institute International (DRI) and ISO 22301, certain elements of a BCP should remain confidential to protect the organization and its stakeholders.

Process flows : These describe how critical processes are maintained or recovered during a disruption. While detailed process flows may be sensitive internally, a high-level overview can often be shared publicly to demonstrate preparedness without compromising operational security. Thus, they are not inherently prohibited from public release.

Contact lists : These contain personal and operational details such as names, phone numbers, and roles of key personnel involved in the BCP. Releasing contact lists publicly poses significant risks, including privacy violations, potential targeting by malicious actors, and operational vulnerabilities. Best practices dictate that contact lists should remain confidential and restricted to authorized personnel only.

BIA results : The Business Impact Analysis (BIA) identifies critical functions, recovery time objectives (RTOs), and potential impacts of disruptions. While detailed BIA results are sensitive, summary-level findings (e.g., critical processes identified without specific vulnerabilities) can sometimes be shared to show due diligence. However, this is not strictly prohibited in public releases if anonymized or generalized.

All of the above : Since process flows and BIA results can be released in a controlled, summarized form, this option is incorrect. The key element that should unequivocally not be released is the contact list due to its sensitive nature.

Therefore, the correct answer is B. Contact lists , as it aligns with the principle of protecting sensitive personal and operational data in public disclosures.

References :

DRI International Professional Practices for Business Continuity Management (2023), Section 6: Business Continuity Plan Development – Emphasizes safeguarding sensitive data like contact details.

ISO 22301:2019, Clause 8.4 – Highlights confidentiality in BCP documentation and communication.