Testing, Training, and Exercises Flashcards
7 cards from real BCM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Testing, Training, and Exercises flashcards as text
What is the recommended minimum frequency for conducting a full-scale business continuity exercise according to most BCM frameworks?
Answer: Annually
Most BCM frameworks, including ISO 22301 and NFPA 1600, recommend conducting exercises at least annually to ensure plans remain current and effective.
Which role is responsible for controlling the pace and flow of a BCM exercise?
Answer: Exercise Controller
The Exercise Controller manages the flow of the exercise, delivers injects, monitors participant actions, and ensures the exercise objectives are met.
An organization conducts a recovery test and achieves its RTO but fails to meet its RPO. What does this indicate?
Answer: Systems recovered on time but too much data was lost
Meeting the RTO means systems were restored within the target time, but failing the RPO means more data was lost than the maximum acceptable threshold.
Which type of training is MOST effective for teaching employees their specific roles during a business disruption?
Answer: Role-specific training tied to BCP responsibilities
Role-specific training ensures each employee understands their individual BCP responsibilities and actions, making it the most directly applicable preparation for an actual disruption.
What is a 'master scenario events list' (MSEL) used for in BCM exercises?
Answer: A scripted timeline of injects delivered during an exercise to achieve objectives
The MSEL is a chronological script used by exercise controllers to deliver pre-planned injects at specific times to drive the exercise toward its objectives.
Why is it important to include third-party vendors in BCM exercises?
Answer: To verify that vendor recovery capabilities align with the organization's recovery objectives
Including vendors in exercises validates that their recovery capabilities, RTOs, and RPOs are compatible with the organization's requirements and that joint recovery procedures work effectively.
Which element should be included in an after-action report (AAR) following a BCM exercise?
Answer: Identified gaps, corrective actions, owners, and target completion dates
An AAR must document identified gaps, the corrective actions required, who is responsible for each action, and the target dates for completion to drive improvement.