BCM Testing, Training, and Exercises 3 — Questions and Answers
Question 1: What is the recommended minimum frequency for conducting a full-scale business continuity exercise according to most BCM frameworks?
- Monthly
- Quarterly
- Annually (Correct answer)
- Every three years
Correct answer: Annually
Most BCM frameworks, including ISO 22301 and NFPA 1600, recommend conducting exercises at least annually to ensure plans remain current and effective.
Question 2: Which role is responsible for controlling the pace and flow of a BCM exercise?
- Incident Commander
- Exercise Controller (Correct answer)
- BCM Manager
- Observer
Correct answer: Exercise Controller
The Exercise Controller manages the flow of the exercise, delivers injects, monitors participant actions, and ensures the exercise objectives are met.
Question 3: An organization conducts a recovery test and achieves its RTO but fails to meet its RPO. What does this indicate?
- Systems recovered on time but too much data was lost (Correct answer)
- Systems recovered with acceptable data loss but took too long
- The test was a complete failure
- The organization should lower its RTO
Correct answer: Systems recovered on time but too much data was lost
Meeting the RTO means systems were restored within the target time, but failing the RPO means more data was lost than the maximum acceptable threshold.
Question 4: Which type of training is MOST effective for teaching employees their specific roles during a business disruption?
- General awareness training for all staff
- Role-specific training tied to BCP responsibilities (Correct answer)
- Annual all-hands safety briefings
- E-learning modules on organizational history
Correct answer: Role-specific training tied to BCP responsibilities
Role-specific training ensures each employee understands their individual BCP responsibilities and actions, making it the most directly applicable preparation for an actual disruption.
Question 5: What is a 'master scenario events list' (MSEL) used for in BCM exercises?
- Documenting all incidents that have occurred in the organization's history
- A scripted timeline of injects delivered during an exercise to achieve objectives (Correct answer)
- A register of all recovery scenarios tested in the past year
- A list of all personnel authorized to activate the BCP
Correct answer: A scripted timeline of injects delivered during an exercise to achieve objectives
The MSEL is a chronological script used by exercise controllers to deliver pre-planned injects at specific times to drive the exercise toward its objectives.
Question 6: Why is it important to include third-party vendors in BCM exercises?
- To satisfy regulatory requirements only
- To verify that vendor recovery capabilities align with the organization's recovery objectives (Correct answer)
- To reduce the organization's exercise costs by sharing expenses
- To ensure vendors are familiar with the organization's internal processes
Correct answer: To verify that vendor recovery capabilities align with the organization's recovery objectives
Including vendors in exercises validates that their recovery capabilities, RTOs, and RPOs are compatible with the organization's requirements and that joint recovery procedures work effectively.
Question 7: Which element should be included in an after-action report (AAR) following a BCM exercise?
- Financial performance metrics for the quarter
- Identified gaps, corrective actions, owners, and target completion dates (Correct answer)
- Marketing strategy adjustments based on exercise findings
- Employee performance reviews conducted during the exercise
Correct answer: Identified gaps, corrective actions, owners, and target completion dates
An AAR must document identified gaps, the corrective actions required, who is responsible for each action, and the target dates for completion to drive improvement.
BCM Testing, Training, and Exercises 3
What is the recommended minimum frequency for conducting a full-scale business continuity exercise according to most BCM frameworks?