BCP Testing and Exercises: Tabletop to Full Failover (ISO 22301 8.5)

Exercise Types

• Tabletop — walk through scenarios, decisions, and communications
• Walkthrough / simulation — deeper role play without full production impact
• Technical / component test — restore a system, failover a link, validate backups
• Full exercise / failover — end-to-end recovery under controlled conditions

Building an Exercise Programme

1. Select scenarios from BIA priorities and realistic threats (including ransomware)
2. Define objectives, success criteria, and safety constraints
3. Brief participants; run the exercise; capture observations live
4. Hot wash + formal report; raise corrective actions
5. Update plans, training, and technical controls

Records Auditors Look For

Exercise schedule, attendance, scenario description, results against objectives, issues found, owners, and closure evidence. Link cyber scenarios to SIEM/SOAR playbooks where relevant.

How CyberSilo Helps

• BCMS programme artefacts — BIA, plans, exercise records — organised in Compliance Standards Automation
• ThreatHawk SIEM / SOAR for detection, response evidence, and ICT continuity telemetry during disruption
• Advisory scoping for certification readiness — contact CyberSilo

Frequently Asked Questions

Does clause 8.5 require annual full failover?

The standard requires exercising and testing suitable to your organisation. Frequency, type, and depth are risk- and scope-based — not a single universal cadence invented here.

Can a tabletop alone satisfy 8.5?

Tabletops are valuable but often insufficient alone for ICT-heavy scopes. Mix discussion and technical tests proportionate to critical activities.

Who should attend?

Plan owners, deputies, IT/DR, security, facilities, key suppliers, and executive sponsors as scenario demands.

Related ISO 22301 Resources

Ransomware playbook · Clauses 4–10 · Hub