ISO 22301 Testing and Exercises

The programme should show whether strategies, solutions, plans, warning and communication procedures, recovery steps, and assigned roles work under appropriate disruption scenarios. Define the objective, scope, scenario, participants, assumptions, and success criteria before each exercise.

Plan coverage over time rather than relying on one annual tabletop. Depending on the BCMS scope and risk profile, the programme can combine tabletop exercises, communication drills, plan walkthroughs, technical recovery tests, supplier handoff tests, and site-loss scenarios. These are practical examples, not ISO-defined categories. ISO 22301 does not mandate a particular exercise type or an annual frequency; it requires planned intervals and additional exercises or tests when significant changes occur. Clause 8.6 separately requires capability evaluation after an incident or activation.

Exercises should test whether the business impact analysis and risk assessment still describe the real operating environment. If a prioritized activity depends on named people, facilities, suppliers, applications, manual workarounds, access permissions, data recovery, or communication steps, the scenario should check whether those assumptions hold.

The BIA identifies when impacts from not resuming an activity would become unacceptable and sets an earlier prioritized time frame for resumption at a specified minimum acceptable capacity. ISO 22301 notes that these time frames can be called MTPD and RTO. It does not define RPO, so any data-loss target should be identified as an additional organization-specific or technology requirement.

Clause 8.5 requires a formal post-exercise report containing outcomes, recommendations, and actions to implement improvements. A useful report also identifies the exercise objective, scenario, scope, participants, plans or procedures used, timestamps, success criteria, and evidence reviewed so another person can understand the result.

Keep observations separate from actions. An observation records what happened against the objective or criterion. An improvement action names the change, owner, due date, closure evidence, and follow-up. Classify it as a nonconformity and corrective action only when a requirement was not met; not every exercise observation is a nonconformity.

Clause 8.5 requires the organization to act on exercise and testing results to implement changes and improvements. If the result also shows that an ISO 22301 requirement or the organization's own BCMS requirement was not met, Clause 10.1 applies: control or correct the nonconformity as applicable, address consequences and causes, implement action, and review effectiveness.

Treat partial success according to the pre-set criteria. If the team recovered the service but missed the time or capacity target, relied on one unavailable person, bypassed a required supplier step, or used an undocumented workaround, record the variance and decide the appropriate improvement or corrective action. Calling it accepted risk does not turn a missed requirement into conformity.

Management review inputs should include trends from monitoring and evaluation, BIA and risk-assessment information, capability evaluations, lessons from near-misses and disruptions, audit results, nonconformities, corrective actions, interested-party feedback, and improvement opportunities. Summarize exercise patterns within those inputs rather than reporting only the number of exercises completed.

Use the results to update BIA and risk records, continuity strategies and solutions, business continuity plans, warning and communication procedures, training, supplier expectations, audit plans, and the next exercise schedule.