Objective
Ensure personnel are prepared and continuity and recovery arrangements are exercised at the frequencies required by the manual.
Control Activity
Compliance maintains the BCM training and exercise calendar and verifies completion of: annual BCM training sessions including tabletop drills, phishing awareness, and simulation exercises; awareness programs including posters, intranet campaigns, and newsletters; quarterly tabletop tests of critical scenarios; semi-annual data recovery drills for IT systems; annual full-scale IT disaster recovery test; quarterly evacuation drills; and biennial organization-wide simulation to test end-to-end resilience. The control verifies that resource allocation in the annual budget includes BCM training, alternate sites, emergency communication systems, and insurance premiums. Test results are documented, reviewed by the Board, and corrective measures tracked. Material failures are assigned, remediated and retested; serious deficiencies are re-tested.
Evidence
- Expected evidence: Approved training and exercise schedule
- Expected evidence: Training attendance and acknowledgement records
- Expected evidence: Exercise plans, success criteria and results
- Expected evidence: Data and disaster recovery test evidence
- Expected evidence: Corrective actions and retest evidence
- Evidence location: source evidence in SYS-ECM-001 Compliance Framework Library, SYS-ECM-002 Compliance Reporting and Evidence Repository; target Hermes assessment record in Odoo under ISS-HERMES-001.
- Retention: according to the applicable approved policy and Bitkaya record-retention requirements.
- Testing method: reconcile planned events to completed evidence and sample findings through verified closure
- Testing frequency: quarterly, semiannual, annual and biennial according to exercise type
Relationships
- Requirement: REQ-IT-006 Maintain Business Continuity Management
- Policy: POL-BCM-001 Business Continuity Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Procedure: PROC-BCM-006 Train and Exercise Business Continuity
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: implemented
History
- 2026-07-26: Normalized evidence metadata and separated design status from runtime effectiveness.
- 2026-07-26: Created from the approved Business Continuity Manual version 1.0.