Guidance that exercises, tests among them, check that the organization can respond, recover and keep its business functions running as intended in particular disruptive situations, and that the organization uses exercises and their recorded results to make sure its plans work and are ready. Each exercise or test has clear aims and objectives and a scenario that serves them; it may have a set outcome or leave room for the organization to find new solutions; and it is realistic, thoroughly planned and agreed with the parties concerned so that it is unlikely to cause disruption or an incident of its own, which can be managed by running it in a controlled, separate environment as long as what is being tested is not compromised. Scenarios serve the objectives and can build on threats from the risk assessment or on earlier disruptions; where individuals or post holders need particular knowledge, skills and understanding, these are provided before the exercise so they can be applied. Exercises are designed and run to deliver one or more of: proof that activity RTOs, and those of dependencies and supporting resources, can be met; confidence that the information and data needed are fit and current; better understanding of reliance on suppliers' and others' continuity; greater awareness of the organization's context and priorities; better understanding of what the procedures say and how they apply; more confidence in incident response; a chance to build capability; a judgement of how useful and applicable continuity solutions are; a judgement of whether capabilities and resource allocation are adequate; discovery of requirements and practices for handling disruption that were never written down; discovery of other gaps in the procedures and in how they are carried out; confidence that procedures can be invoked when needed; more confidence among interested parties in the organization's readiness; and a way of meeting regulatory, contractual or management requirements. The kind of exercise depends on context, objectives, programme maturity, participants' experience, budget, who is available and how well the organization can absorb disruption caused by the exercise; the organization acts on the results by making the approved changes and improvements. Exercises are either discussion-based (a plan review of one to two hours, tabletop sessions on or off site of two to three hours, workshops on one or several plans of three to five hours) or simulations (single- or multi-site workshops of three to five hours and organization-wide full-scale exercises lasting from half a day to a week, demanding and tightly controlled so that they meet their aims without causing disruption), as Table 6 describes. Each exercise includes a scheduled review in which all participants discuss the issues and lessons, recorded with procedures updated as needed; afterwards results are debriefed and analysed against the aims and objectives and an exercise report is produced with recommendations and deadlines; lessons from exercises and real incidents are checked again in later exercises, and an exercise that exposed serious weaknesses or errors is repeated once corrective action is taken. The benefits include confirming assumptions, solutions and plan coverage; confidence that facilities, resources and alternative facilities work; faster, more efficient processes through repetition; better awareness among interested parties; and more competent and aware participants. ISO 22398 gives fuller guidance on exercise types and on planning, running and improving exercise programmes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.