Business Continuity Plan Exercise, Test, Assessment, and Maintenance
Purpose
This domain proves plans work, finds gaps, and keeps the program current. It is the engine of continuous improvement and the most frequently examined area.
Concepts you must know
- Exercise types by complexity - plan review/walkthrough (orientation), tabletop (discussion-based), simulation, functional (test specific capabilities in a simulated environment), full-scale (all participants, realistic conditions).
- Test vs exercise - a test verifies a component (e.g., backup restore, generator load, notification system); an exercise validates plans and people.
- Objectives and scope - written before the exercise, with success criteria.
- After-action report (AAR) and lessons learned - what happened, what was expected, root cause.
- Corrective action plan - owner, due date, verification, closure; track to completion.
- Maintenance triggers - scheduled review (typically annual), org/process change, new technology, new site or supplier, audit finding, actual incident, exercise finding.
- Assessment/audit - independent review of program conformance and maturity.
Traps in questions
- Jumping to a full-scale exercise before tabletops.
- Believing a successful backup restore test validates the whole BC plan.
- Running exercises without defined objectives, then being unable to judge success.
- Producing an AAR but no tracked corrective actions.
- Assuming maintenance is annual only - significant change should trigger review.
Rule of thumb
Progress simple → complex, and treat every exercise as incomplete until the AAR is written and each finding has an owner, a due date, and verified closure.
Worked example: A tabletop reveals no one knows who authorizes payment for emergency procurement. Finding logged, finance owner assigned, policy updated in 30 days, verified at the next exercise. That closure loop is what examiners are looking for.