Business continuity exercising
An unexercised plan is a hypothesis.
Tabletop, functional, cyber and full scale exercises that prove your plans work, sharpen the people behind them, and produce the evidence ISO 22301, NIS2 and DORA expect.
What is a business continuity exercise?
A business continuity exercise is a controlled rehearsal of how your organisation responds to disruption. It takes the plans you have written, a cyber attack, a site loss, a supplier failure, a data centre outage, and tests them against a realistic scenario, with the people who would actually have to respond. The output is evidence: what held, what failed, and what to fix before reality runs the test for you.
Exercising is also an obligation. ISO 22301 requires a standing exercise programme, NIS2 expects continuity and crisis measures whose effectiveness is assessed, and DORA requires financial entities to test digital operational resilience against severe but plausible scenarios. One well designed exercise produces the assurance and the audit trail at the same time.
The exercise ladder
Four formats, from low disruption to full realism. Most programmes climb the ladder over time: each rung builds the confidence, and the evidence, for the next.
The formats, compared
Which exercise fits depends on what you need to prove, to whom, and how much disruption you can absorb.
| Format | Who is in the room | Durée typique | What it proves |
|---|---|---|---|
| Tabletop exercise | Executive and crisis teams around one table | Une demi-journée | Roles, decisions and escalation paths are understood, and the plan holds as a document. |
| Functional exercise | One team or capability, with its real tools | Half to one day | A specific capability, such as IT recovery, relocation or emergency communications, works in practice. |
| Cyber crisis exercise | IT, security, communications and leadership together | One day | The organisation can decide, communicate and recover under a realistic cyber scenario such as ransomware. |
| Full scale exercise | Multiple teams, sites and systems, live | One to two days | The whole response works end to end under conditions close to a real disruption. |
How an exercise runs
Six steps, from scoping to the corrective actions that feed the next cycle. Designed and facilitated by practitioners who have managed real crises.
Scenarios that feel real
Scenarios come from our library and are tailored to your industry and threat profile. They are severe but plausible: hard enough to expose weaknesses, close enough to reality that the lessons transfer.
- Ransomware and destructive cyber attack
- Site loss and denial of access
- Critical supplier or shared platform failure
- IT and data centre outage
- Power and utilities disruption
- Workforce absence and pandemic conditions
How often to exercise
Typical intervals between exercises of each format. Your cadence is calibrated to your risk profile, regulatory obligations and maturity during scoping.
What the regulators and standards expect
One exercise, run properly, produces the evidence several regimes ask for.
| Cadre | What it expects | What the exercise gives you |
|---|---|---|
| ISO 22301 | An exercise programme that validates continuity strategies and plans over time (Clause 8.5). | A documented exercise record, evaluation report and corrective actions, ready for certification audits. See our BCM service. |
| NIS2 | Business continuity and crisis management among the Article 21 measures, with their effectiveness assessed. | Evidence that continuity and crisis arrangements are tested, not just written. See our NIS2 service. |
| DORA | A digital operational resilience testing programme for financial entities, including severe but plausible scenarios. | Response and recovery tested against realistic ICT disruption, with board ready reporting. See our DORA service. |
| EASA Part-IS | Tested readiness to detect and respond to information security events in aviation. | Aviation scenarios exercised across operations and information security. Read our Part-IS guide. |
| ISG suisse | Resilient arrangements for critical infrastructure operators in Switzerland. | Exercised response arrangements that stand up to regulator scrutiny. Read our Swiss ISG guide. |
Prefer to build the capability in house?
We also train your own people to design and run exercises, through our accredited training practice.
Exercices de gestion de crise
Learn to design, run and evaluate crisis exercises inside your own organisation.
Explorez le programme › EntraînementTop Team Simulations
High pressure simulations for executive teams and boards.
Explorez le programme › EntraînementOpération HELVÉTIE
Our flagship immersive exercise experience.
Explorez le programme ›Foire aux questions
What is a business continuity exercise?
What is the difference between a tabletop and a full scale exercise?
How often should we exercise?
Do exercises satisfy ISO 22301, NIS2 and DORA requirements?
Will an exercise disrupt our operations?
Who designs and runs the exercise?
Explorez davantage
Services connexes
Gestion de la continuité des activités
Stratégie, plans et validation alignés sur la norme BIA et ISO 22301 : un programme de continuité conçu pour résister à une véritable perturbation.
Découvrez le service ›REGULATION AND CRISISGestion de crise
Doctrine, structures et communications qui contiennent le pic et raccourcissent la récupération, ancrées dans la norme ISO 22361.
Découvrez le service ›CONTINUITY AND RESILIENCERésilience organisationnelle
La structure au-dessus des plans : risques, continuité, crise, cybersécurité et personnel sur une base de gouvernance unique, conformément à la norme ISO 22316.
Découvrez le service ›CYBER AND SECURITYRésilience cybernétique
Au-delà de la prévention : la capacité de résister, de réagir et de se rétablir tout en maintenant les services essentiels en fonctionnement.
Découvrez le service ›CYBER AND SECURITYSécurité de l'information
Confidentialité, intégrité et disponibilité protégées par un système de gestion de la sécurité de l'information (SGSI) évolutif, conforme à la norme ISO 27001.
Découvrez le service ›CYBER AND SECURITYSécurité de la chaîne d'approvisionnement
Les risques hérités des fournisseurs et des plateformes partagées : cartographiés, assurés, contractuels et exercés, conformément aux normes ISO 28000, NIS2 et DORA.
Découvrez le service ›REGULATION AND CRISISConformité NIS2
De la détermination du champ d’application aux mesures de l’article 21 et à la préparation au reporting 24 heures sur 24 en vertu de la directive (UE) 2022/2555.
Découvrez le service ›RISK AND GOVERNANCEGestion des risques
De l'univers des risques au risque maîtrisé : identification, évaluation tenant compte du stress, traitement adapté et surveillance en temps réel.
Découvrez le service ›RISK AND GOVERNANCE7A Cadre de gestion des risques
Notre modèle opérationnel exclusif axé sur la décision : l’exposition et la confiance dans la décision sont mesurées séparément pour le conseil d’administration.
Découvrez le service ›RISK AND GOVERNANCEGouvernance et résilience de l'IA
Une gouvernance enveloppant chaque niveau des systèmes intelligents, du comportement des modèles à la responsabilité du conseil d'administration et à la norme ISO 42001.
Découvrez le service ›SECTOR FRAMEWORKCadre de résilience aéroportuaire de DAEDALUS
Le cadre de résilience aéroportuaire : cinq domaines comme un seul modèle opérationnel à travers l'aérodrome, alimenté par le moteur 7A, dans les éditions aviation commerciale, fret et affaires.
Découvrez le service ›Find out whether your plans survive contact.
Tell us what you need to prove, to your board, your auditor or your regulator, and we will design the exercise that proves it. Conversations are confidential.