Operation
8.5
Exercise programme
Put in place and keep up a programme of exercises and tests that shows, over time, that the continuity strategies and solutions work. The exercises and tests must: fit the continuity objectives; rest on carefully planned scenarios with clearly stated aims; build teamwork, competence, confidence and knowledge among those who have roles in the response; together, over time, confirm the strategies and solutions; lead to formal reports after each exercise setting out outcomes, recommendations and improvement actions; be reviewed with continual improvement in mind; and take place at planned intervals and whenever significant change happens. Act on what they show by making changes and improvements.
What the baseline asks
Put in place and keep up a programme of exercises and tests that shows, over time, that the continuity strategies and solutions work. The exercises and tests must: fit the continuity objectives; rest on carefully planned scenarios with clearly stated aims; build teamwork, competence, confidence and knowledge among those who have roles in the response; together, over time, confirm the strategies and solutions; lead to formal reports after each exercise setting out outcomes, recommendations and improvement actions; be reviewed with continual improvement in mind; and take place at planned intervals and whenever significant change happens. Act on what they show by making changes and improvements.
What it means when the service runs in the cloud
Exercises that do not involve the provider test your assumptions about the provider, not the provider's resilience. Ask for a joint exercise, or at least test your side against a simulated provider failure.
Evidence an auditor or a customer asks for
- Exercise programme showing scope, scenario and interval coverage over time
- Exercise aims and objectives defined before each exercise
- Formal post exercise reports with outcomes, recommendations and actions
- Action tracking to closure with evidence of the resulting change
- Coverage analysis showing the programme validates every strategy and solution over its cycle
Common gaps in a cloud estate
- The same comfortable scenario rehearsed annually, so rare failure modes are never stressed
- Exercises run without defined aims, so they cannot pass or fail
- Post exercise findings recorded and never actioned
- Programme covers ICT recovery only, leaving people, premises and supplier scenarios untested
- No coverage analysis, so gaps in what has been validated go unnoticed
Done well, what the file shows
Done well, this clause leaves a exercise programme showing scope, scenario and interval coverage over time that names the service, the region and the date it was last tested, so a reviewer can follow it to the provider document without asking anyone. Where that record does not exist, the gap is visible in the next review whether or not the service is working.
A test you can run this month
Record whether the provider took part in the last exercise, and what was assumed if not.