What is CBCP certification? CBCP, Certified Business Continuity Professional, is the mid-level credential from DRI International for people who build and run business continuity programs. To earn it you need at least two years of hands-on continuity experience across five of DRI's ten Professional Practices, written essays and references that document that experience, and a score of at least 75% on the Qualifying Examination (DRI International).
Most people who search for it fall into one of two groups. Some are deciding whether to earn it. Others are business owners or IT leaders who saw it on a resume or a vendor proposal and want to know what it is worth. This guide covers both.
CBCP requirements
DRI sets four requirements for the CBCP (DRI International):
- Experience. At least two years of significant, practical experience in business continuity.
- Breadth. That experience must cover five of the ten Professional Practices, and at least two of your five essays must address Practices 3, 4, 6 or 8 (Business Impact Analysis, Continuity Strategies, Plan Development and Implementation, and Exercise, Assessment and Maintenance).
- The Qualifying Examination. A minimum score of 75%. No prerequisite course is required.
- References. At least two people who can confirm your experience in each subject area you claim.
The ten Professional Practices
The essays and the exam are built on DRI's ten Professional Practices for business continuity management (DRI International):
- Program Management
- Risk Assessment
- Business Impact Analysis
- Business Continuity Strategies
- Incident Preparedness and Response
- Plan Development and Implementation
- Awareness and Training Programs
- Exercise, Test, Assessment and Maintenance
- Crisis Communications
- Coordination with External Agencies and Resources
If you are planning to apply, keep a running record of the programs you have worked on mapped to these ten areas. The essays are where most applications slow down, and they are much easier to write from notes than from memory.
How much CBCP certification costs
DRI lists a $400 application fee and a $225 annual renewal fee for the CBCP, and certified professionals must earn 80 continuing education points to maintain it (DRI International). Training courses and exam preparation are separate and optional. Check DRI's site for current fees before you budget; they change.
ABCP vs CBCP vs MBCP
DRI offers three levels. The difference is experience and how much you have to prove.
| ABCP | CBCP | MBCP | |
|---|---|---|---|
| Experience | Under 2 years | 2+ years | 5+ years, within the last 10 |
| Professional Practices covered | None required | 5 of 10 | 7 of 10 |
| Exams (75% to pass) | Qualifying Examination | Qualifying Examination | Qualifying Examination and Master's Case Study |
| Essays and references | Not required | Required | Required |
| Application fee | $200 | $400 | $500 |
| Annual renewal | $200 | $225 | $300 |
Sources: DRI International pages for ABCP, CBCP and MBCP.
ABCP is a sensible start for someone new to the field, and it can be upgraded once the experience is there. MBCP is for people who lead programs and want the most senior DRI credential.
Is CBCP certification worth it?
For practitioners, usually yes. CBCP is one of the most recognized continuity credentials, and it appears often in job postings for continuity, resilience, and operational risk roles. The essay requirement also has a side benefit: it forces you to describe real program work in a structured way, which is useful in interviews and audits.
It is not the only route. The Business Continuity Institute's CBCI and ISO 22301 lead implementer or auditor courses cover similar ground, and some employers prefer one over another. If a specific employer or client matters to you, ask which they recognize.
What a CBCP means when you are the one hiring
If you are a business owner or IT leader, you are more likely to meet the credential than earn it: on a candidate's resume, an MSP's proposal, or a consultant's bio. Read it for what it is.
What it tells you. The person has documented experience across several parts of the discipline, passed an exam, and had references confirm their work. That is a real signal of competence.
What it does not tell you. Whether your plan will work on the day. Plans fail for reasons no credential covers:
- Recovery targets nobody agreed. IT assumes the business can wait a day; the business assumes IT can recover in an hour. Until each system has a written recovery time and acceptable data loss, nobody is planning for the same event. We explain how to set them in RPO and RTO that stand up to outages and audits.
- Backups that have never been restored. Having backups is not the same as restoring from them quickly, and ransomware often targets the backups first.
- A plan that was written once and filed. The first real test is the incident, which is when outdated contacts and missing credentials appear.
- Vendor dependencies. Your recovery depends on your cloud, carrier and software providers, and on what they have actually promised in writing.
Questions to ask a certified candidate or vendor:
- When did you last run a recovery test end to end, and what broke?
- How did you set recovery targets with the business, and who signed off?
- Which of the ten Professional Practices did you document for your certification, and which do you not do?
- How would you handle a vendor whose contract does not support our recovery time?
Good answers are specific. Vague ones are worth noting whatever the credentials say.
Where to start if your own plan is the question
If you landed here because you are responsible for continuity in your organization, the useful next step is usually not a certificate. It is knowing whether your current plan would hold.
- Score it yourself. The Business Continuity Readiness Assessment runs fifty-six checks across recovery targets, backups, plans, communications, vendors and testing, in about ten minutes.
- Use a template. Our business continuity plan template for regulated organizations gives you the structure, and BCP vs DRP explains how the two plans fit together.
- Get an outside view. The Digital Presence & Technology Review looks at the systems and providers your recovery depends on and shows where the gaps are.
The Deady Group is an independent technology advisor in Boston. We help organizations test what they have and choose the right partners when they need help, and we disclose how we are paid before any recommendation under our Transparency Standard.
Questions, answered plainly
What is CBCP certification? CBCP stands for Certified Business Continuity Professional. It is DRI International's mid-level credential for people who plan and run business continuity programs. It requires at least two years of practical experience across five of DRI's ten Professional Practices and a passing score of 75% on the Qualifying Examination.
How much does CBCP certification cost? DRI International lists a $400 application fee and a $225 annual renewal fee for the CBCP. Training courses and exam preparation are separate costs, and DRI does not require a course to apply.
What is the difference between ABCP, CBCP, and MBCP? ABCP is the entry level for people with under two years of experience and requires only the exam. CBCP requires two years of experience across five Professional Practices, written essays, and references. MBCP requires five years across seven practices and a second case study exam.
Is CBCP certification worth it? For people whose job is continuity, resilience, or risk, usually yes: it is widely recognized and the essays force you to document real program work. For a business owner, it is a useful signal when hiring, but it does not prove your own plan has been tested.
Does hiring a CBCP mean our business continuity plan is sound? No. The credential shows the person knows the discipline. Whether your plan works depends on agreed recovery targets, tested restores, current contacts, and vendor commitments, which you can only confirm by testing and reviewing the plan itself.
