# Clause 8.5: Exercise programme

Put in place and keep up a programme of exercises and tests that shows, over time, that the continuity strategies and solutions work. The exercises and tests must: fit the continuity objectives; rest on carefully planned scenarios with clearly stated aims; build teamwork, competence, confidence and knowledge among those who have roles in the response; together, over time, confirm the strategies and solutions; lead to formal reports after each exercise setting out outcomes, recommendations and improvement actions; be reviewed with continual improvement in mind; and take place at planned intervals and whenever significant change happens. Act on what they show by making changes and improvements.

Cloud: Exercises that do not involve the provider test your assumptions about the provider, not the provider's resilience. Ask for a joint exercise, or at least test your side against a simulated provider failure.

Evidence: Exercise programme showing scope, scenario and interval coverage over time; Exercise aims and objectives defined before each exercise; Formal post exercise reports with outcomes, recommendations and actions; Action tracking to closure with evidence of the resulting change; Coverage analysis showing the programme validates every strategy and solution over its cycle.

Test: Record whether the provider took part in the last exercise, and what was assumed if not.

Citation: ISO 22301:2019, clause 8.5. Source: https://compliance.theartofservice.com/frameworks/iso-22301-2019. Last updated: 2026-10-20.