Business Continuity Plan Exercise/Test, Assessment, and Maintenance
What you must understand
This domain covers proving and sustaining the program. Know the exercise types in increasing rigor: plan review/walkthrough, tabletop, simulation, functional drill, and full-scale/full-failover test. Understand that each has a purpose and cost, and that you choose based on objectives and risk. Know the exercise lifecycle: define objectives and scope → design scenario → conduct → evaluate against objectives → document findings → corrective actions → track to closure. Understand maintenance triggers: organizational change, new systems, mergers, regulatory change, lessons learned, and scheduled review cadence. Recognize that findings without tracked corrective actions are worthless.
Traps in questions
- Choosing a full-scale test when a tabletop meets the objective; match rigor to purpose and risk.
- Running exercises without defined, measurable objectives - you cannot evaluate what you did not define.
- Treating an exercise as pass/fail rather than a learning and improvement tool.
- Forgetting to update the plan and retrain after findings or organizational change.
Worked example / rule of thumb
A new ERP system goes live. The team updates the BIA and plan, retrains affected roles, then runs a tabletop for the finance function and a functional test of the failover. Rule of thumb: Objective → Exercise → Findings → Corrective action → Plan update → Retrain. No corrective action tracking means the exercise did not happen.