8.5 Exercise programme
Implement and maintain a programme of exercising and testing that validates the effectiveness of the continuity strategies and solutions over time, running exercises and tests consistent with the continuity objectives, b
5
artefacts
0
held by a system
4
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Exercise programme showing scope, scenario and interval coverage over time · Policy repository / GRC workspace
- Exercise aims and objectives defined before each exercise · Policy repository / GRC workspace
- Formal post exercise reports with outcomes, recommendations and actions · Document repository
- Action tracking to closure with evidence of the resulting change · Document repository
governing documentDocuments that govern the control
- Coverage analysis showing the programme validates every strategy and solution over its cycle · Document repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- The same comfortable scenario rehearsed annually, so rare failure modes are never stressed
- Exercises run without defined aims, so they cannot pass or fail
- Post exercise findings recorded and never actioned
- Programme covers ICT recovery only, leaving people, premises and supplier scenarios untested
- No coverage analysis, so gaps in what has been validated go unnoticed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet8.4.5 Recovery · 8.6 Evaluation of business continuity documentation and capabilities