BCM testing: testing continuity plans with the tabletop exercise

What does a BCM test check?

A BCM test checks the supporting assumptions and documents of your business continuity management against reality. Five subjects are at the centre:

• BIA assumptions: are criticality, dependencies and priorities from the business impact analysis still right, for example after a change of service provider?
• RTO and RPO: can the defined recovery times and maximum tolerable data losses actually be achieved with the available resources?
• Business continuity plans: can business units keep working with emergency operation, alternative processes or manual workarounds?
• Recovery plans: are order, responsibilities and dependencies for recovery described realistically?
• Emergency organisation: do alerting, escalation and crisis team work function? Are deputies named and reachable?

Why do BCM plans have to be tested?

Continuity plans go out of date faster than they are written: responsibilities change, systems are replaced, service providers are added, and the assumptions of the business impact analysis shift. Only the test shows whether the RTO and RPO targets are realistic, whether escalation works and whether everyone involved knows their role. Unexercised plans usually fail in a real incident on reachability, unclear decision paths and improvised communication, more rarely on technology. All of that becomes visible in an exercise of 60 to 90 minutes.

Test or exercise? The formats

Colloquially every check of a continuity plan is called a “BCM test”. Exercise guidance such as ISO 22398 and national BCM standards distinguish the formats by how much is actually executed. Plan walkthroughs, tabletop and crisis team exercises and alerting exercises mainly train people and the emergency organisation. The functional test executes a plan or a measure for real, for example a failover or restore test. In practice that means: a test has a clear pass or fail criterion, an exercise trains and assesses behaviour.

The tabletop exercise corresponds methodically to the plan walkthrough or a discussion-based crisis team exercise on a scenario. It can be run in 60 to 90 minutes and needs no intervention in systems. A staged programme makes sense: tabletop exercises as the regular rhythm, complemented by functional tests for the most critical systems.

What do ISO 22301, NIS2 and DORA require?

• ISO 22301 requires an exercise programme with documented results and improvements derived from them (clause 8.5, see below).
• NIS2 requires business continuity including crisis management and procedures to assess the effectiveness of the measures (Art. 21(2)(c) and (f)).
• DORA requires financial entities to test ICT business continuity plans and response and recovery plans at least yearly (Art. 11(6)).

Testing is therefore mandatory, partly by standard, partly by law.

Exercise programme under ISO 22301, clause 8.5

ISO 22301:2019 requires in clause 8.5 a programme of exercises and tests that validates the effectiveness of the business continuity strategies and solutions over time. Exercises and tests should:

• be consistent with the business continuity objectives and be based on well-planned scenarios with clear aims,
• develop teamwork, competence, confidence and knowledge of those involved,
• taken together, validate the strategies and solutions over time,
• produce formalised post-exercise reports with results, recommendations and actions,
• take place at planned intervals and after significant changes.

Improvements must follow from the results. For certification, the documented evidence is what counts.

BCM test vs. disaster recovery test

A disaster recovery test checks technical recovery, a BCM test the ability of the whole organisation to act. The differences at a glance:

The two belong together: a successful restore is of little use if nobody decides which system comes back first. And the best business continuity plan fails if the backup cannot be read.

How does a BCM test run as a tabletop exercise?

1. Choose a critical scenario, e.g. ransomware with a production outage or the loss of the central data centre.
2. Set up the team in real roles (crisis team, IT, business units, communications).
3. Develop the scenario through injects and make decisions under time pressure.
4. Check response, recovery order and communication against the plan’s targets (RTO/RPO, escalation levels).
5. Produce an after-action report with lessons learned and scheduled actions.

Where do BCM tests fail in practice?

• Only IT exercises: recovery also concerns business units, procurement and communications. If they are missing, the plan remains untested.
• The scenario spares the weak spots: whoever only exercises what is sure to work creates false confidence.
• No consequences: findings without actions, owners and dates fizzle out until the next exercise.
• No documentation: without evidence, the best exercise does not count in the audit.

The evidence for the audit

Every exercise with SecDrills ends with a documented after-action report: scenario, participants with roles, decisions with timestamps and the discussion outcomes. You derive deviations from the plan and the action plan from it. That is the evidence auditors expect for ISO 22301, NIS2 and DORA, and you can present it directly. If you exercise regularly, the reports also show whether your team is getting better from exercise to exercise. The bigger picture is explained in the BCM guide.

Frequently asked questions