Lion Cipher Lab
Engineer a quantitative BCMS to ISO 22301
- GRC / Compliance
- Advanced
- ~90 min
- Free · no account required
Why it matters
A qualitative continuity plan reads well in an audit and fails on the night of the outage. The failure is almost always numeric: a 4-hour recovery target that quietly rides on a supplier who takes 48 hours, a runbook nobody ever added up, a 'we recovered fine' exercise with no pass/fail line. This lab is the engineering layer where you turn a BIA into hard targets, trace dependencies until the cascade shows you the real bound, measure your actual recovery capability against the target, and score an exercise honestly enough that the gaps become funded work. That is the difference between a…
What you'll learn
- ISO 22301 BCMS
- Business Impact Analysis (BIA)
- RTO / RPO / MTPD / MTDL / RTC
- dependency mapping & RTO cascade
- recovery gap analysis
- business continuity exercises
Steps in this lab
- The blind spot: what a qualitative plan cannot tell you
- The vocabulary, defined precisely (get these exactly right)
- Clause 8.2 — derive MTPD from the BIA, then set RTO < MTPD and RPO within MTDL
- Clause 8.3 — build the dependency map and watch the RTO cascade
- Clause 8.4 — compute RTC from the runbook and expose the RTC-vs-RTO gap
- Roll it up for all four processes (optional stdlib Python)
- Prioritise remediation by criticality and gap — and know when NOT to gold-plate
- Clause 8.5 — design and SCORE a recovery exercise honestly
- What you engineered