book

Practical Business Continuity Exercises

Name: Practical Business Continuity Exercises
Author: Charlie Maclean-Bristol
ISBN: 9781398628243

by Charlie Maclean-Bristol

August 2026

Intermediate

304 pages

7h 33m

English

Kogan Page

Read now

Unlock full access

Cover
Endorsements
Titlepage
Dedication
Contents
List of figures and table
FiguresTables
About the author
Acknowledgements
01 Introduction to business continuity exercises
What is an exercise?The difference between exercises and trainingWhy do we conduct exercises?What do individuals gain from taking part in exercises?Ten core principles of effective exercising
02 The different types of business continuity exercises
Plan walkthroughTests and technical exercisesTabletop exercisesWargaming or stress test exercisingSimulated exercise (SIMEX)Live exercises (LIVEX) and drillsBlended incident management training and workshopsWhich type of exercise is good for each level of participants?Notes

03 Guidance for designing and developing SIMEXs
Meetings to develop a SIMEXHow to use different channels for delivering the SIMEX injectsRunning online SIMEXsDeveloping a role-player’s guideCommunications among those running the exercise
04 Building a multi-year strategic exercise roadmap
Why are exercise programmes important?How to document a multi-year strategyDocumenting the requirements of each individual exerciseNote
05 Making exercises educational by design
Three levels of learningLearning styles: visual, verbal and kinaestheticTheoretical foundations of learningNote
06 Defining individual and team capabilities to build organizational response capability
Identifying individual knowledgeIndividual incident management skillsIncident management behavioursHow to measure individual competencyAssessing team capabilitiesAssessing organizational capabilityNotes
07 The 4D’s: a four-phase framework for designing and delivering effective exercises
Phase 1: DesignPhase 2: DevelopmentPhase 3: DeliveryPhase 4: Debrief and evaluation
08 From umpires to participants: understanding exercise roles
Roles and responsibilitiesWhat are the skills and attributes required for running an exercise?Using consultants to plan and deliver your exerciseHow to choose your consultancyHow to work with the consultant
09 Agreeing on the exercise logistics: when, where, who and how long
Questions for the kick-off meetingWhen: choosing the right date and time of dayHow long should you run an exercise for?Where: location of the exerciseNumber of meetings to plan your exerciseNaming your exercisesConsider risk‘Who’: understanding the organization being exercisedReview current plans and other business continuity documentationUnderstanding the organization’s use of media and social media
10 Writing the purpose and exercise objectives
Writing the exercise purpose: why are we running this exercise?How the purpose of the exercise influences the exercise designWriting the exercise objectivesKnow: Improving knowledgeDo: Practising skillsWork: Teamwork and leadershipCheck: Validating plans, strategies and systemsFeel: Building confidence and continual improvementHow the achievement of the objective will be measuredNote
11 Deciding on the scope of the exercise
Who will be exercised?Who will lead the planning of the exercise?Are any external parties to be invited to take part in the exercise?Which plans and procedures will be exercised?
12 Designing the scenario
What should the scenario achieve?Using a design team to get the fine scenario detailsChoosing the scenarioOvercoming issues when choosing a scenario
13 Determining the type and structure of the exercise
Factors which determine the type of exerciseDividing the exercise into distinct phasesThe importance of training prior to the exerciseCall-outExercising elements within the planTabletop phasesIncident team meetingsStructuring a SIMEXA functions phase or working groupsThree-phase exercise conducted over three daysProviding a finale to the exerciseMultiple team exercisesChoosing where and how the exercise is deliveredShould you run a no-notice exercise?
14 Developing the storyboard
How the scenario, storyboard and injects or questions fit togetherUnderstanding the impact of the scenario on the organizationDeveloping the storyboard frameworkDeveloping storyboard contentChecking there are issues for all
15 Verisimilitude: making your exercise come to life
Ways to deploy verisimilitude in your exerciseSimulating social mediaInternal communicationsCall with regulators, government bodies or parent organizationsMedia interviewsCasualtiesDealing with groups of peopleUse of props
16 Developing tabletop questions or injects
Developing tabletop exercise questionsDeveloping scripts and a briefing documentDeveloping a set of injects for SIMEXGuidance for writing injectsUpdating the storyboard after injects have been writtenFinal task
17 Evaluating the incident team’s performance and assessing the exercise
Evaluation considerationsEvaluation against a recognized frameworkA simple evaluation criteria frameworkTabletop evaluation criteria: ‘What does good look like?’Complex evaluation criteria frameworks (expanded PICTS)Development of performance indicators (PIs) tied to objectivesAssessing specialist responsesExpected response to injectQuantitative assessmentsCapability assessmentsConducting the evaluation or assessment: the umpire’s roleContinual improvement and demonstrating organizational valueNote
18 Delivering the exercise
Planning for the delivery of the exerciseThe week before the exercise‘Dress rehearsal’ if requiredArrival and set-up on the day of the exerciseExercise briefingConducting the exerciseEnding the exerciseHot debrief and feedback
19 Cold debrief and follow-up
Conducting a cold debriefStructured debriefingAfter action reviewNext steps and follow-upReflection on exercise delivery
20 Exercise documentation
Writing the exercise instructionThe post-exercise report
Appendix: Guidance on conducting cyber incident management exercises
What is cyber incident management and how does it differ from cyber incident response?Why conduct a cyber incident management exercise?Is there a difference between planning cyber as compared with ‘normal’ exercises?Planning a cyber exerciseDefining the cyber exercise objectivesDuration of cyber exercisesPotential cyber incident management scenariosElements which can be included within the exercise scenarioThe use of ransom notes in cyber exercises
Glossary
Index
Copyright

Content preview from Practical Business Continuity Exercises

12 Designing the scenario

When the planning starts for a new exercise the discussion almost immediately turns to discussing the scenario. In my experience, this can very quickly become the primary focus. In some cases, the scenario is already determined before planning starts, perhaps as part of a multi-year exercise programme or due to a regulatory or contractual requirement. For some exercises the focus is on the scenario, such as responding to a ransomware attack. However, in other situations, the scenario is just a way to frame the exercise, and the real ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Business Continuity Management

Kush Srivastava, Waddah S Ghanem Al Hashmi

ISO 22301:2019 and business continuity management – Understand how to plan, implement and enhance a business continuity management system (BCMS)

Alan Calder

Business Continuity and Disaster Recovery Planning for IT Professionals, 2nd Edition

Susan Snedaker

Technology Strategy

Tom Clark

Publisher Resources

ISBN: 9781398628243

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Practical Business Continuity Exercises

by Charlie Maclean-Bristol

12 Designing the scenario

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.