Run business continuity exercises
Exercise a realistic service disruption with cross-functional participants to test safety, member support, manual fallbacks, decisions, communications, and restoration priorities.
| Field | Value |
|---|---|
| Business area | security-continuity |
| Primary role | general-manager |
| Frequency | annual |
| Privacy sensitivity | medium |
| Security sensitivity | high |
| Compliance review | needed |
Trigger and handoff
Trigger: Approved exercise schedule or a material change in critical dependencies.
Inputs
- Risk-based scenario
- Current continuity procedures
- Participants
- injects
- and stop criteria
Outputs
- Observed decision and fallback evidence
- Capability gaps
- Prioritized corrective actions
Current manual methods
- Plan read-through
- Fire drill only
- Lessons assumed from real outage
Human judgment and approvals
-
Adapt scenario safely to participant actions
-
Evaluate decision quality and workable service minimums
-
Approval: Exercise director and safety owner approve scenario
-
Approval: scope
-
Approval: and stop conditions
Failure modes
- Scenario is disclosed and rehearsed to pass
- Exercise tests technology but not member and staff operations
Success metrics
- Critical fallbacks and decisions are demonstrated under realistic constraints
- Actions close and are retested