Purpose
Maintain personnel readiness and test whether continuity and recovery arrangements work as designed through structured training, awareness programs, and exercises.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Maintain training schedule | Annual BCM training and exercise schedule covering employees, incident roles, Technology, Operations, Compliance, management | Training schedule |
| 2 | Provide BCM training | Annual sessions, tabletop drills, phishing awareness, simulation exercises; role-based training at least annually and after material role/plan changes | Training attendance records |
| 3 | Maintain awareness | Posters, intranet campaigns, newsletters | Awareness materials |
| 4 | Confirm resource allocation | Annual budget includes BCM training, alternate sites, emergency communication systems, insurance premiums | Budget allocation |
| 5 | Conduct quarterly tabletop tests | Critical scenario tabletop exercises | Exercise results |
| 6 | Test data recovery semiannually | Semi-annual data recovery drills for IT systems | Recovery test results |
| 7 | Conduct full IT DR test | Full-scale IT disaster recovery test at least annually | DR test report |
| 8 | Conduct evacuation and org-wide drills | Evacuation drills quarterly; organization-wide continuity simulation at least biennially (end-to-end resilience) | Exercise results |
| 9 | Define exercise parameters | Objectives, scenarios, participants, success criteria, evidence before each exercise | Exercise plan |
| 10 | Record results and lessons | Results, exceptions, lessons learned, owners, due dates; retest material failures; results reviewed by Board; corrective measures tracked; serious deficiencies re-tested | Lessons learned report |
Records
- Training materials, attendance and acknowledgements
- Exercise plans, scenarios and results
- Recovery and restoration evidence
- Lessons learned, corrective actions and retest results
Relationships
- Policy: POL-BCM-001 Business Continuity Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Control: CTRL-BCM-006 Ensure BCM Training and Exercises Are Completed
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Frequency: annual training; quarterly tabletop and evacuation; semiannual data recovery; annual disaster recovery; biennial organization-wide simulation
History
- 2026-07-26: Created from sections 12 and 13 of the approved Business Continuity Manual.