Testing, Exercising, Training, Awareness, and Maintenance
A plan is a hypothesis until it is exercised. The validation spectrum runs from plan review and walkthroughs, through tabletop exercises and simulations, to full-scale live tests and alternate-site activations. Each level increases realism, cost, and disruption risk. Choose the level that matches the objective: tabletop exercises test decision-making and role clarity; functional exercises test specific procedures; full-scale exercises test integration end to end.
Key concepts: exercise objectives, scope, scenario design, facilitation, safety and stop conditions, observation and evaluation, and a corrective action program. After-action reports should capture what worked, what failed, and assigned owners with due dates. Training builds competence in specific roles; awareness builds general understanding across the workforce. Both are distinct from exercising, though exams often blur them.
Traps: running a full-scale test before basic walkthroughs; exercising without defined objectives; treating a successful exercise as proof of perfection; failing to track corrective actions to closure; and forgetting to update plans, contact lists, and dependency data after organizational change. Another trap is testing only IT recovery while ignoring business processes and communications.
Worked example: a firm's objective is to confirm that the crisis team can decide on failover within one hour. A tabletop exercise with an injected scenario and a facilitator meets that objective cheaply. A full data-center failover would be disproportionate and risky for this specific goal. Findings, such as unclear authority, become corrective actions with owners and dates, and the plan is updated and re-exercised.
Rule of thumb: exercise to objectives, not to impress. Start simple, increase realism over time, and always close the loop through corrective action and plan maintenance.