Exercises that prove your plans survive contact with reality.

A crisis management exercise is a structured rehearsal in which an organisation tests its plans, people and decision making against a realistic scenario, in formats ranging from a discussion based tabletop exercise to a full scale live simulation, producing evidence of capability and a prioritised improvement plan.

Plans that have never been exercised are assumptions. A business continuity exercise or preparedness exercise converts those assumptions into observed fact: whether the crisis team convenes fast enough, whether escalation and communication work under pressure, whether recovery decisions hold when information is incomplete. Resilience Guard designs and facilitates the full spectrum, from tabletop exercises for boards to functional and full scale exercises across critical operations.

Every exercise is run to a documented lifecycle: objectives and scope, scenario design, facilitated conduct, scored observation against defined criteria, a no fault debrief, and an owned action plan. That discipline is what turns a rehearsal into a lasting increase in resilience, and into an evidence trail an auditor or supervisor will accept.

ISO 22301, the business continuity management standard, requires in clause 8.5 an exercise programme that validates continuity strategies and solutions at planned intervals and after significant change; ISO 22398 provides the international guidance for designing those exercises, and ISO 22361 anchors the crisis management capability they test. Our exercises are designed to all three, so results feed certification audits directly.

NIS2 places cyber risk management, incident handling and business continuity duties on essential and important entities, with management bodies accountable for oversight and training; a documented exercise record is among the clearest evidence of that oversight. DORA goes further for the financial sector, mandating a digital operational resilience testing programme, with crisis communication and response capabilities expected to be exercised, up to threat led penetration testing for designated firms.

In Germany, operators under KRITIS and the BSI Act must demonstrate the effectiveness of their resilience measures, and in Switzerland the Information Security Act gives critical infrastructure operators a 24 hour incident reporting duty to BACS, a deadline no organisation meets for the first time during a real crisis. Exercising is how that readiness is built and evidenced; see our German language ISG briefing and our operational resilience overview.