BCM-006 BCM and DR Testing
Description
Business continuity and disaster recovery plans are exercised at least annually using tabletop exercises, functional tests, or full simulation. Test scenarios cover the most likely disruptive events (e.g., availability zone failure, ransomware, key personnel unavailability). Results are documented, lessons learned are captured, and plans are updated accordingly.
Rationale
Plans that are never tested contain untested assumptions. Regular exercises expose gaps in procedures, tooling, and team readiness before a real event.
Applicability (9 profiles)
Art. 30(3)(c) requires the plans to be tested, not only held. RTS 2024/1773 Art. 9(2), point (a), then requires the results to reach the customer as a standing report on business continuity measures and testing.
Framework Mappings (12)
| BCR-06 | Business Continuity Exercises | full |
| BCR-10 | Response Plan Exercise | full |
| BCR-06 | Business Continuity Exercises | full |
| BCR-10 | Response Plan Exercise | full |
| DORA-Art.30.3.c | Business contingency plans and ICT security measures | partial |
| HIPAA-164.308.a.7.ii.D | Testing and Revision Procedures | full |
| 5.30 | ICT readiness for business continuity | full |
| NIS2-CIR-4.1 | Business Continuity and Disaster Recovery Plan | informative |
| NIS2-CIR-4.3 | Crisis Management | informative |
| CP-3 | Contingency Training | partial |
| CP-4 | Contingency Plan Testing | full |
| A1.3 | Recovery Plan Testing | full |
Evidence (2)
BCM/DR exercise record documenting the test scenario, participants, findings, and lessons learned from the most recent tabletop, functional, or full simulation exercise.
Example: DR test report or BCM exercise after-action report (dated, within the last 12 months) showing scenario description, participant list, timeline of events, issues identified, and corrective actions raised
Test: Request the BCM/DR exercise record for the last two annual exercises. Verify: (1) exercises were conducted within the required frequency; (2) scenarios covered at least one realistic disruption type (e.g., AZ failure, ransomware, key personnel loss); (3) participants included personnel with defined response roles; (4) findings and lessons learned are documented; (5) corrective actions have been assigned and tracked.
Post-exercise lessons learned report showing corrective actions raised and tracked following the most recent BCM/DR exercise.
Example: Post-exercise improvement register or Jira/equivalent backlog showing issues identified during the exercise, assigned owners, target remediation dates, and current status
Test: Request the post-exercise lessons learned report and the corrective action register. Verify: (1) all significant findings from the exercise are in the register; (2) each finding has an assigned owner and due date; (3) actions from the prior exercise cycle were completed before the next exercise; (4) completed actions resulted in an update to the BCP, DRP, or related procedures.
Questions (3)
Are business continuity and disaster recovery plans exercised at least annually?
Exercises should include personnel with defined response roles. Lessons learned must be captured and result in updates to the BCP, DRP, or related procedures.
What type of BCM/DR exercise was most recently conducted, and when?
A tabletop exercise is the minimum acceptable exercise type. A full simulation or live failover test provides the strongest evidence of plan effectiveness.
Which of the following follow each continuity or recovery exercise?
Options run from the most commonly in place to the least. An exercise that produces no change to any plan is usually an exercise that tested the plan nobody doubted. Record the scenario as well as the outcome, because the scenario is what decides whether the test was worth running.