Business Continuity and Resilience Governance (CGEIT – Risk Optimization)
Business Continuity and Resilience Governance: A Complete CGEIT Guide
This guide is part of the Risk Optimization domain of the ISACA CGEIT (Certified in the Governance of Enterprise IT) certification. It explains why business continuity and resilience governance matters, what it is, how it works in practice, and how to answer exam questions on it with confidence.
1. Why Business Continuity and Resilience Governance Is Important
Modern enterprises depend on IT for nearly every critical business process. Many things can stop operations:
• Cyberattacks, especially ransomware
• Natural disasters
• Pandemics
• Supplier failures and cloud outages
• Human error
Disruptions can cause financial loss, regulatory penalties, reputational damage, loss of customer trust and, in extreme cases, the collapse of the organization.
From a governance perspective, continuity and resilience matter for the following reasons:
• Value preservation: Governance exists to create and protect stakeholder value. A strategy cannot deliver value if the enterprise cannot operate.
• Risk optimization: The board must make sure disruption risk stays within the enterprise's risk appetite and tolerance.
• Accountability: Boards and executives are accountable for the survival of the organization. Continuity cannot be delegated entirely to IT.
• Regulatory and contractual obligations: Many sectors require demonstrable resilience. Examples include financial services (e.g., DORA in the EU), healthcare, energy and telecommunications.
• Stakeholder confidence: Investors, customers, regulators and partners expect the organization to withstand and recover from shocks.
• Competitive advantage: A resilient enterprise can keep serving customers while competitors struggle.
2. What Business Continuity and Resilience Governance Is
Business continuity is the capability of an organization to keep delivering products and services at acceptable, predefined levels during and after a disruptive incident.
Business continuity management (BCM) is the holistic process that delivers this capability. It identifies potential threats and their impacts, and builds resilience and an effective response.
Disaster recovery (DR) is a subset of continuity. It focuses specifically on restoring IT systems, data and infrastructure after a disruption.
Resilience is broader than either. It is the ability of the enterprise to:
• anticipate disruption,
• absorb it,
• adapt to it, and
• recover from it.
Resilience often means the enterprise emerges stronger. It covers organizational, operational, technological, supply-chain and cyber dimensions.
Governance of continuity and resilience means the board and executive management:
• set direction
• define risk appetite for disruption
• approve policy
• assign accountability
• ensure adequate resources
• monitor whether the enterprise can actually continue operating
Key distinction for CGEIT: Governance is about evaluating, directing and monitoring (the EDM model in COBIT). Management is about planning, building, running and monitoring. The CGEIT candidate thinks like a board-level advisor, not a DR technician.
Key terms to know
• Business Impact Analysis (BIA): Identifies critical business processes, the impact of their disruption over time, and their dependencies.
• Recovery Time Objective (RTO): The maximum acceptable time to restore a process or system after a disruption.
• Recovery Point Objective (RPO): The maximum acceptable amount of data loss, measured in time.
• Maximum Tolerable Downtime (MTD) / Maximum Tolerable Period of Disruption (MTPD): The point beyond which the disruption threatens the viability of the organization.
• Minimum Business Continuity Objective (MBCO): The minimum level of service acceptable during a disruption.
• Business Continuity Plan (BCP): Documented procedures that guide the organization in responding, recovering, resuming and restoring operations.
• Disaster Recovery Plan (DRP): The technical plan for recovering IT services.
• Crisis management: Strategic-level leadership and communication during a major incident.
• Important business services and impact tolerances: Operational resilience concepts used by many regulators.
Relevant frameworks and standards
• COBIT 2019:
– EDM03 (Ensured Risk Optimization)
– APO12 (Managed Risk)
– DSS04 (Managed Continuity)
– DSS05 (Managed Security Services)
– BAI04 (Managed Availability and Capacity)
• ISO 22301 (Business Continuity Management Systems)
• ISO 22316 (Organizational Resilience)
• ISO 27031 (ICT readiness for business continuity)
• NIST SP 800-34 (Contingency Planning)
• NIST Cybersecurity Framework (Recover function)
3. How It Works
Step 1: Establish governance and accountability
• The board approves a business continuity and resilience policy aligned with enterprise strategy and risk appetite.
• Accountability sits with senior management. Business process owners own continuity requirements for their processes. IT is accountable for delivering the technical recovery capability.
• A steering committee or resilience committee is often created. A senior executive sponsor (e.g., COO or CRO) provides oversight.
• Roles are defined using a RACI matrix.
Step 2: Understand the organization (BIA and risk assessment)
• The BIA identifies critical processes, their dependencies (people, technology, facilities, suppliers, data), and the financial and non-financial impact of disruption over time.
• The BIA produces RTO, RPO and MTD values. These are defined by the business, not by IT.
• A risk assessment identifies threats and vulnerabilities that could cause disruption, and evaluates their likelihood and impact.
Step 3: Determine continuity and resilience strategies
• Strategies are selected based on the BIA, risk appetite and cost-benefit analysis. Options include:
– redundant sites (hot, warm, cold)
– cloud failover
– data replication
– alternate suppliers
– cross-training staff
– manual workarounds
– insurance
• Governance ensures the cost of resilience is proportionate to the value at risk. Over-investment and under-investment are both governance failures.
Step 4: Develop and implement plans
• Plans are documented and integrated: BCP, DRP, crisis management, communication and incident response.
• Resilience is embedded into architecture, procurement, change management, third-party contracts and project delivery (resilience by design).
Step 5: Test, exercise and train
Plans are regularly tested to validate them. Test types include:
• checklist reviews
• tabletop or walkthrough exercises
• simulations
• parallel tests
• full interruption tests
Staff receive awareness and role-based training. Test results, lessons learned and gaps are reported to management and, where significant, to the board.
Step 6: Monitor, review and improve
• Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) are tracked, for example:
– percentage of critical processes with tested plans
– actual versus target recovery times in tests
– number of unresolved test findings
– supplier resilience ratings
• Plans are updated after organizational changes, new systems, mergers, incidents and test results.
• Internal audit provides independent assurance on the BCM program.
• The board receives regular reports on resilience posture.
Step 7: Address third-party and ecosystem resilience
• Critical suppliers and cloud providers must be included in the scope.
• Contracts should cover service levels, recovery commitments, right to audit, exit strategies and concentration risk.
• Outsourcing a service does not outsource accountability. The enterprise remains accountable.
4. Governance Roles at a Glance
• Board of Directors: Sets risk appetite, approves policy, ensures resources are available, receives assurance and holds management accountable.
• Executive management: Owns the program, approves strategies and investment, and leads crisis response.
• Business process owners: Define criticality, RTO and RPO, and own process-level plans.
• CIO / IT: Delivers DR capability and technical resilience aligned with business requirements.
• Risk management (second line): Integrates continuity risk into enterprise risk management (ERM) and challenges assumptions.
• Internal audit (third line): Provides independent assurance.
5. Common Pitfalls Governance Must Prevent
• Treating continuity as an IT-only exercise.
• Setting RTO and RPO without business input.
• Plans that exist on paper but are never tested.
• Ignoring dependencies on suppliers, people or facilities.
• Outdated plans that are not maintained after change.
• No board visibility or reporting.
• Spending on resilience that is not aligned with business value or risk appetite.
Exam Tips: Answering Questions on Business Continuity and Resilience Governance
1. Think like a governance professional, not a technician. CGEIT questions favor answers about direction, accountability, alignment, policy and oversight. Technical answers such as "implement replication" or "buy a backup site" are usually wrong unless the question is explicitly operational.
2. The BIA comes first. If a question asks what should be done FIRST when developing a continuity program or strategy, the answer is usually to perform or update the business impact analysis. In some cases it is to obtain senior management commitment. Strategy and plans come after the BIA.
3. The business defines criticality, RTO and RPO. Business process owners, not IT, determine recovery requirements. IT translates them into technical solutions. Watch for distractors that have IT setting priorities.
4. Senior management commitment and board accountability. The most important success factor for BCM is usually executive or board support and sponsorship. Ultimate accountability rests with the board and senior management.
5. Align with business strategy and risk appetite. The best answer typically ties resilience investment to business objectives, value and risk appetite, and uses cost-benefit reasoning.
6. An untested plan is an unreliable plan. If a question asks how to gain assurance that a plan will work, choose regular testing and exercising, with results reported to management. Choose this over documentation review alone.
7. Accountability cannot be outsourced. In cloud or third-party scenarios, the enterprise retains accountability. Look for answers about contractual requirements, right to audit, verifying the provider's continuity capability, and exit strategies.
8. Integrate, don't isolate. Correct answers often integrate continuity with ERM, change management, project delivery, architecture and information security. Answers that treat BCM as a standalone silo are weaker.
9. Keep plans current. After major changes such as mergers, new systems or restructuring, the best action is usually to update the BIA and plans.
10. Choose monitoring and metrics for oversight questions. For board-level questions, choose answers involving dashboards, KRIs, test results and assurance reports. Avoid detailed technical logs.
11. Know the definitions precisely.
• RTO = time to recover.
• RPO = acceptable data loss.
• A lower RTO or RPO means higher cost.
• MTD is greater than or equal to RTO.
• DR is a subset of BCP.
• Resilience is broader than recovery.
12. Watch the keywords. Words such as FIRST, BEST, MOST important, PRIMARY and GREATEST concern signal priority-based questions. Eliminate answers that are true but secondary. Then pick the one with the broadest governance impact.
13. Greatest concern scenarios. Typical "greatest concern" answers include:
• no BIA performed
• plans never tested
• RTOs set by IT without business input
• critical suppliers excluded from scope
• no executive ownership
Sample question approach: "An enterprise has moved critical applications to a cloud provider. What should the IT governance committee ensure FIRST?"
The best answer is that the provider's continuity capabilities meet the enterprise's business-defined recovery requirements, and that this is contractually enforceable and verified. Simply assuming the provider handles DR is wrong.
Summary: Business continuity and resilience governance makes sure the enterprise can withstand and recover from disruption in line with its risk appetite and strategic objectives. In practice this means:
• board direction and accountability
• a business-driven BIA
• proportionate strategies
• tested plans
• third-party oversight
• continuous monitoring and improvement
In the exam, always favor the answer that reflects business alignment, executive accountability, the BIA as the foundation, regular testing, and retained accountability for outsourced services.
