Business continuity hiring managers ask for "CBCI or CBCP" in the same breath, yet the two credentials come from different institutes, test different bodies of knowledge and are kept current in different ways. This guide sets out what the Business Continuity Institute (BCI), DRI International and ISO 22301 personnel certification schemes publish about their credentials: exam format, the knowledge each one tests, experience rules, fees where published, and how each is maintained. It is for continuity, resilience, IT disaster recovery and security professionals choosing a first credential or planning the next grade. Facts were checked on the certifying bodies' own pages on 8 November 2026. Credentialing bodies are listed alphabetically, and order is never a ranking. Fees and rules change, so confirm on the linked pages before you apply.
Key takeaways
- There are three families. The BCI CBCI and its membership grades, the DRI International ABCP, CBCP and MBCP levels, and ISO 22301 lead implementer and lead auditor credentials from personnel certification bodies.
- The CBCI is an exam on the BCI Good Practice Guidelines. It is a 90-item, 90-minute, closed-book, online proctored multiple-choice exam covering the six Professional Practices, with a pass at 63 correct answers.
- The CBCP is an exam plus evidenced experience. DRI International requires 75% on its Qualifying Examination, more than two years of experience across five subject matter areas, and references for each area.
- Maintenance models differ. DRI International requires annual fees and 80 Continuing Education Activity Points; the BCI uses 20 hours of CPD in the last 12 months as the gate for moving up a grade.
- ISO 22301 certifies organisations, credentials certify people. A lead implementer or lead auditor credential shows you can build or audit a management system against ISO 22301; it is not the same as your organisation being certified.
Who the certification is for
| Credential family | Typical audience | What it signals |
|---|---|---|
| BCI (CBCI, AMBCI, MBCI, FBCI) | Business continuity and resilience practitioners, especially where the BCI Good Practice Guidelines are the reference | Knowledge of the Good Practice Guidelines (CBCI), then assessed competence against the BCI Competency Framework at higher grades |
| DRI International (ABCP, CBCP, MBCP) | Continuity planners, IT disaster recovery and crisis management staff, particularly where DRI's Professional Practices are the reference | Exam knowledge plus documented, referenced experience in named subject areas |
| ISO 22301 lead implementer and lead auditor | People building a business continuity management system (BCMS) for certification, internal auditors and certification body auditors | Ability to implement or audit against the clauses of ISO 22301 |
Security and identity teams have a stake too. Recovery of privileged accounts, service accounts, secrets stores and identity providers is often the critical path in a cyber recovery. A continuity credential gives security staff the language to put those dependencies into a business impact analysis. See the Business Continuity and Disaster Recovery Guide and the Cyber Resilience Guide.
Exam format and domains
BCI: CBCI exam
| Item | What the BCI publishes |
|---|---|
| Format | Multiple choice, 90 items, one sitting |
| Duration | 90 minutes |
| Delivery | Online, closed book, monitored by a proctor; laptop or desktop with webcam and stable internet |
| Pass mark | 63 correct answers; pass with merit at 77 or more |
| Coverage | All six Professional Practices of the Good Practice Guidelines, each unit weighted equally |
| Window | 60 days from purchase or registration to complete the exam |
| Body of knowledge | BCI Good Practice Guidelines, 7.0 edition, with the CBCI 7.0 Certification Course |
| Re-sits | Arranged through the BCI |
The BCI's Good Practice Guidelines page lists the six Professional Practices as PP1 Establishing a Business Continuity Management System, PP2 Embracing Business Continuity, PP3 Analysis, PP4 Solutions Design, PP5 Enabling Solutions and PP6 Validation. Older study material may describe a 120-question, two-hour exam; the current BCI exam page states 90 items in 90 minutes, so rely on that page.
DRI International: Qualifying Examination
| Item | What DRI International publishes |
|---|---|
| Exam | The Qualifying Examination, passed with a minimum score of 75% |
| Body of knowledge | DRI International's Professional Practices, evidenced through subject matter area essays |
| After the exam | An online application through your DRI account, with subject matter area essays and two references per area |
| MBCP | Also requires the Master's Case Study Examination, passed with at least 75% |
| Ethics | Certification is subject to the DRI Code of Ethics |
The DRI pages checked for this guide do not state the question count or time limit, and DRI International's subject area pages were not readable at the time of checking. Confirm the current exam format and the list of subject areas with DRI International when you book.
ISO 22301 personnel credentials
ISO itself does not certify people. Personnel certification bodies run ISO 22301 lead implementer and lead auditor schemes, usually as a five-day course ending in an exam. PECB, for example, publishes that its ISO 22301 Lead Auditor exam covers seven competency domains, from BCMS principles to managing an audit programme, and is taken on day five of the course. The implementer route is covered in depth in the ISO 22301 Lead Implementer guide, and the standard itself in the ISO 22301 Business Continuity Guide.
Prerequisites and experience
| Credential | Exam or qualification | Experience and evidence |
|---|---|---|
| CBCI (BCI) | Pass the CBCI exam | No formal prerequisite; the BCI recommends the 7.0 course and study of the Good Practice Guidelines |
| AMBCI (BCI) | CBCI certification or the BCI Diploma in Business Continuity Management | Foundational competence under the BCI Competency Framework, five work examples, 20 hours of CPD in the last 12 months |
| MBCI (BCI) | CBCI, the BCI Diploma, or current AMBCI membership; an Experiential Route also exists | Comprehensive competence; four Leadership and Management and three Professional Practice examples; CV, self-assessment, references, 20 hours of CPD in the last 12 months |
| FBCI (BCI) | Highest grade; standard and Experiential Routes | Advanced competence with six examples; 20 hours of CPD in the last 12 months; at least 120 hours of voluntary contribution in five years, 30 in the last 12 months |
| CBCP (DRI) | Qualifying Examination at 75% or more | More than two years of experience in five subject matter areas, at least two from subject areas 3, 4, 6 or 8; experience within the past ten years; two references per area |
| MBCP (DRI) | Qualifying Examination and Master's Case Study Examination, each at 75% or more | At least five years of experience in seven subject matter areas, at least four from subject areas 3, 4, 6 and 8; within the ten years before applying; two references per area |
| ISO 22301 Lead Auditor (PECB example) | Pass the Lead Auditor exam and sign the PECB Code of Ethics | Lead Auditor grade: five years of professional experience including two in business continuity management, and 300 hours of audit activity; Provisional Auditor needs none |
DRI International also offers an associate level (ABCP) for people with less experience. Its page was not readable at the time of checking, so confirm the ABCP rules directly with DRI International.
Preparation plan
A suggested approach from NHI Mgmt Group for someone working in or near a continuity role. Adjust the weeks to your experience.
- Weeks 1 to 2, choose the body of knowledge. Decide which reference your employer or target market uses: the BCI Good Practice Guidelines, DRI International's Professional Practices or ISO 22301 clauses. Read job adverts in your region and your organisation's BCMS documents.
- Weeks 3 to 6, study the framework end to end. For the CBCI, work through each of the six Professional Practices; the BCI offers a CBCI Certification Course through licensed training partners, an online course and a self-study bundle. For the CBCP, study each DRI subject area and map it to work you have done.
- Weeks 5 to 7, build your evidence early. For CBCP, MBCP or BCI upgrades, draft essays or examples as you study. The BCI recommends the STAR format (Situation, Task, Action, Result) for examples. Line up two referees per DRI subject area while projects are fresh.
- Week 7, practise under time. The BCI sells a 90-question mock exam with results cross-referenced to the Good Practice Guidelines. Use any mock only to find weak areas.
- Week 8, test the set-up and sit. Check webcam, upload speed and a quiet room before the online exam. For the CBCI, book within the 60-day window.
- After the exam, apply promptly. DRI certification follows an online application after the exam. BCI grades above CBCI need an application with CPD records and examples.
Practical exercises speed learning in all three families: run a business impact analysis for one service, including its identity and secrets dependencies, and test a recovery. The Business Continuity Plan Template and Disaster Recovery Plan Template give a structure to practise on.
Cost, renewal and continuing education
| Credential | Published fees | Maintenance |
|---|---|---|
| BCI CBCI and grades | Exam access is bought through a licensed training partner course or the BCI Shop bundles; the exam page lists no standalone price | 20 hours of CPD in the last 12 months is required to move up a grade; CPD is logged in the member's online account; membership terms through the BCI |
| DRI CBCP | USD 400 application fee; USD 225 annual renewal fee | 80 Continuing Education Activity Points (CEAPs); recertification and the DRI Code of Ethics apply |
| DRI MBCP | USD 500 application fee; USD 300 annual renewal fee | 80 CEAPs |
| ISO 22301 Lead Auditor (PECB example) | Set by the training provider; the course attestation is worth 31 CPD credits | Set by the personnel certification body |
The DRI pages state the 80 CEAP requirement without the cycle length in the text we read; confirm the period with DRI International. The BCI 2023 article on membership grades notes that a CBCI pass within the last three years usually means CBCI membership; check how the BCI treats older passes before you apply for an upgrade. Fees above were checked on 8 November 2026. Training course prices vary by provider and region.
Where it fits on the career path
- Entry: the CBCI and the DRI associate level suit people new to continuity. Pair them with a security or IT service management foundation. See the Cybersecurity Certifications Guide.
- Practitioner: the CBCP, AMBCI and MBCI show evidenced experience. They suit continuity managers, IT disaster recovery leads and resilience analysts.
- Management system work: ISO 22301 lead implementer or lead auditor credentials suit people running or auditing a certified BCMS, and pair well with ISO/IEC 27001 roles. See the Cybersecurity Auditor Career Guide.
- Senior: the MBCP and FBCI recognise long experience and, for FBCI, contribution to the profession. They suit heads of resilience and consultants.
- Adjacent: cyber resilience, crisis management and risk roles. See the Cybersecurity Risk Manager Career Guide and the Cyber Resilience Maturity Model.
Many practitioners hold credentials from more than one family because employers and clients reference different frameworks. Choose by the framework your organisation or market uses, then add a second family if your role spans both.
Where identity fits
Continuity plans often assume identity systems will be available during recovery. In a ransomware or destructive incident the identity provider, privileged access vault and secrets manager may be the first things that must be rebuilt, and service accounts and API keys must be reissued before applications can start. Credential holders who add these to impact analysis and recovery sequencing close a common gap. See the Cloud Native Backup and Ransomware Resilience Guide.
Practitioner checklist
- Identify which body of knowledge your organisation and target employers use before choosing a credential.
- Confirm the current exam format, fees and windows on the certifying body's own page on the day you buy.
- For the CBCI, study all six Professional Practices: they are weighted equally.
- For the CBCP or MBCP, map your experience to subject areas early and line up two referees per area.
- Keep a CPD log from day one; BCI upgrades need 20 hours in the last 12 months and DRI levels need CEAPs.
- Budget for annual renewal fees where they apply, not only the exam.
- Include identity providers, privileged access and secrets stores in every business impact analysis you practise on.
- Record expiry and maintenance dates for each credential in one place.
Standards and references
- Business Continuity Institute: CBCI Exam
- Business Continuity Institute: Good Practice Guidelines
- Business Continuity Institute: MBCI membership
- Business Continuity Institute: FBCI membership
- Business Continuity Institute: Continuing Professional Development
- DRI International: Certified Business Continuity Professional (CBCP)
- DRI International: Master Business Continuity Professional (MBCP)
- PECB: ISO 22301 Lead Auditor
Related NHI Mgmt Group resources: ISO 22301 Business Continuity Guide, ISO 22301 Lead Implementer, Business Continuity and Disaster Recovery Guide, Certification Renewal and CPE Requirements Guide.