Business continuity exercising
An unexercised plan is a hypothesis.
Tabletop, functional, cyber and full scale exercises that prove your plans work, sharpen the people behind them, and produce the evidence ISO 22301, NIS2 and DORA expect.
What is a business continuity exercise?
A business continuity exercise is a controlled rehearsal of how your organisation responds to disruption. It takes the plans you have written, a cyber attack, a site loss, a supplier failure, a data centre outage, and tests them against a realistic scenario, with the people who would actually have to respond. The output is evidence: what held, what failed, and what to fix before reality runs the test for you.
Exercising is also an obligation. ISO 22301 requires a standing exercise programme, NIS2 expects continuity and crisis measures whose effectiveness is assessed, and DORA requires financial entities to test digital operational resilience against severe but plausible scenarios. One well designed exercise produces the assurance and the audit trail at the same time.
The exercise ladder
Four formats, from low disruption to full realism. Most programmes climb the ladder over time: each rung builds the confidence, and the evidence, for the next.
The formats, compared
Which exercise fits depends on what you need to prove, to whom, and how much disruption you can absorb.
| Format | Who is in the room | Typical duration | What it proves |
|---|---|---|---|
| Tabletop exercise | Executive and crisis teams around one table | Half a day | Roles, decisions and escalation paths are understood, and the plan holds as a document. |
| Functional exercise | One team or capability, with its real tools | Half to one day | A specific capability, such as IT recovery, relocation or emergency communications, works in practice. |
| Cyber crisis exercise | IT, security, communications and leadership together | One day | The organisation can decide, communicate and recover under a realistic cyber scenario such as ransomware. |
| Full scale exercise | Multiple teams, sites and systems, live | One to two days | The whole response works end to end under conditions close to a real disruption. |
How an exercise runs
Six steps, from scoping to the corrective actions that feed the next cycle. Designed and facilitated by practitioners who have managed real crises.
Scenarios that feel real
Scenarios come from our library and are tailored to your industry and threat profile. They are severe but plausible: hard enough to expose weaknesses, close enough to reality that the lessons transfer.
- Ransomware and destructive cyber attack
- Site loss and denial of access
- Critical supplier or shared platform failure
- IT and data centre outage
- Power and utilities disruption
- Workforce absence and pandemic conditions
How often to exercise
Typical intervals between exercises of each format. Your cadence is calibrated to your risk profile, regulatory obligations and maturity during scoping.
What the regulators and standards expect
One exercise, run properly, produces the evidence several regimes ask for.
| Framework | What it expects | What the exercise gives you |
|---|---|---|
| ISO 22301 | An exercise programme that validates continuity strategies and plans over time (Clause 8.5). | A documented exercise record, evaluation report and corrective actions, ready for certification audits. See our BCM service. |
| NIS2 | Business continuity and crisis management among the Article 21 measures, with their effectiveness assessed. | Evidence that continuity and crisis arrangements are tested, not just written. See our NIS2 service. |
| DORA | A digital operational resilience testing programme for financial entities, including severe but plausible scenarios. | Response and recovery tested against realistic ICT disruption, with board ready reporting. See our DORA service. |
| EASA Part-IS | Tested readiness to detect and respond to information security events in aviation. | Aviation scenarios exercised across operations and information security. Read our Part-IS guide. |
| Swiss ISG | Resilient arrangements for critical infrastructure operators in Switzerland. | Exercised response arrangements that stand up to regulator scrutiny. Read our Swiss ISG guide. |
Prefer to build the capability in house?
We also train your own people to design and run exercises, through our accredited training practice.
Crisis Management Exercises
Learn to design, run and evaluate crisis exercises inside your own organisation.
Explore the programme › TrainingTop Team Simulations
High pressure simulations for executive teams and boards.
Explore the programme › TrainingOperation HELVETIA
Our flagship immersive exercise experience.
Explore the programme ›Frequently asked questions
What is a business continuity exercise?
What is the difference between a tabletop and a full scale exercise?
How often should we exercise?
Do exercises satisfy ISO 22301, NIS2 and DORA requirements?
Will an exercise disrupt our operations?
Who designs and runs the exercise?
Explore further
Related services
Business Continuity Management
BIA, ISO 22301 aligned strategy, plans and validation: a continuity programme built to survive contact with a real disruption.
Explore the service ›REGULATION AND CRISISCrisis Management
Doctrine, structures and communications that contain the peak and shorten the recovery, anchored on ISO 22361.
Explore the service ›CONTINUITY AND RESILIENCEOrganisational Resilience
The structure above the plans: risk, continuity, crisis, cyber and people on one governed foundation, per ISO 22316.
Explore the service ›CYBER AND SECURITYCyber Resilience
Beyond prevention: the capacity to withstand, respond and recover while essential services keep running.
Explore the service ›CYBER AND SECURITYInformation Security
Confidentiality, integrity and availability protected through a living ISMS aligned to ISO 27001.
Explore the service ›CYBER AND SECURITYSupply Chain Security
The risk you inherit from suppliers and shared platforms: mapped, assured, contracted and exercised, per ISO 28000, NIS2 and DORA.
Explore the service ›REGULATION AND CRISISNIS2 Compliance
From scope determination to Article 21 measures and 24 hour reporting readiness under Directive (EU) 2022/2555.
Explore the service ›RISK AND GOVERNANCERisk Management
From risk universe to governed risk: identification, stress aware assessment, owned treatment and live monitoring.
Explore the service ›RISK AND GOVERNANCE7A Risk Management Framework
Our proprietary decision centric operating model: exposure and decision confidence measured separately, for the board.
Explore the service ›RISK AND GOVERNANCEAI Governance and Resilience
Governance wrapped around every layer of intelligent systems, from model behaviour to board accountability and ISO 42001.
Explore the service ›SECTOR FRAMEWORKDAEDALUS Airport Resilience Framework
The Airport Resilience Framework: five domains as one operating model across the aerodrome, powered by the 7A engine, in commercial, freight and business aviation editions.
Explore the service ›Find out whether your plans survive contact.
Tell us what you need to prove, to your board, your auditor or your regulator, and we will design the exercise that proves it. Conversations are confidential.