Testing & Exercise Programs Flashcards
7 cards from real DRI practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Testing & Exercise Programs flashcards as text
DRI Professional Practices recommend that business continuity plans should be exercised at minimum:
Answer: At least annually
DRI Professional Practices and most industry standards require BC plans to be tested at least annually to validate their continued effectiveness.
Which regulatory framework most commonly drives exercise frequency requirements for financial institutions in the United States?
Answer: FFIEC Business Continuity Management booklet
The FFIEC Business Continuity Management booklet sets examination expectations for U.S. financial institutions, including testing frequency and scope requirements.
What is the primary benefit of conducting unannounced exercises?
Answer: They test genuine response readiness without opportunity for artificial preparation
Unannounced exercises reveal true operational readiness because participants cannot pre-stage resources or rehearse responses, providing a more accurate picture of actual capabilities.
When should third-party vendors or suppliers be included in business continuity exercises?
Answer: When the organization's recovery depends on critical vendor services or systems
Vendors providing critical dependencies should participate in exercises when their systems, staff, or services are integral to the organization's recovery strategy.
What is the concept of 'progressive exercise complexity' in a multi-year test program?
Answer: Systematically advancing from simpler exercise types to more complex and realistic ones over time
Progressive complexity builds organizational exercise competency by starting with orientations and tabletops and advancing toward functional and full-scale exercises as maturity increases.
Which of the following is an example of a 'capability-based' exercise objective?
Answer: Activate the emergency operations center within 30 minutes of incident notification
Capability-based objectives measure specific operational outcomes—such as activation speed—that directly reflect the organization's ability to meet defined recovery targets.
An organization's exercise program consistently tests IT systems recovery but never involves business unit representatives. This gap primarily risks:
Answer: Validating technical recovery without confirming business processes can actually resume operations
IT recovery without business unit participation cannot confirm that recovered systems actually support the business processes needed to meet RTOs, leaving a critical validation gap.