BCP Testing and Exercises: Tabletop to Full Failover (ISO 22301 8.5)

ISO 22301:2019 Clause 8.5 requires organisations to exercise and test business continuity procedures to validate effectiveness and enhance competence. Exercises range from discussion-based tabletops to full technical failovers.

Related: BCP · DR · Hub.

Clause 8.5: Exercising and testing are mandatory BCMS activities — plan them, record results, and feed findings into continual improvement (Clause 10).

Exercise Types

Tabletop — walk through scenarios, decisions, and communications
Walkthrough / simulation — deeper role play without full production impact
Technical / component test — restore a system, failover a link, validate backups
Full exercise / failover — end-to-end recovery under controlled conditions

Building an Exercise Programme

Select scenarios from BIA priorities and realistic threats (including ransomware)
Define objectives, success criteria, and safety constraints
Brief participants; run the exercise; capture observations live
Hot wash + formal report; raise corrective actions
Update plans, training, and technical controls

Records Auditors Look For

Exercise schedule, attendance, scenario description, results against objectives, issues found, owners, and closure evidence. Link cyber scenarios to SIEM/SOAR playbooks where relevant.

How CyberSilo Helps

BCMS programme artefacts — BIA, plans, exercise records — organised in Compliance Standards Automation
ThreatHawk SIEM / SOAR for detection, response evidence, and ICT continuity telemetry during disruption
Advisory scoping for certification readiness — contact CyberSilo

Prove Continuity with Evidence

Track exercise programmes and remediation in CSA; use ThreatHawk for cyber scenario telemetry.

Talk to CyberSilo ISO 22301 Hub

Frequently Asked Questions

Does clause 8.5 require annual full failover?

The standard requires exercising and testing suitable to your organisation. Frequency, type, and depth are risk- and scope-based — not a single universal cadence invented here.

Can a tabletop alone satisfy 8.5?

Tabletops are valuable but often insufficient alone for ICT-heavy scopes. Mix discussion and technical tests proportionate to critical activities.

Who should attend?

Plan owners, deputies, IT/DR, security, facilities, key suppliers, and executive sponsors as scenario demands.

Ransomware playbook · Clauses 4–10 · Hub

BCP Testing and Exercises: Tabletop to Full Failover (ISO 22301 8.5)

Exercise Types

Building an Exercise Programme

Records Auditors Look For