Gestisci i cookie
Questo sito utilizza i cookie per raccogliere informazioni sulle tue attività di navigazione al fine di fornirti contenuti e materiale promozionale più pertinenti, e per aiutarci a comprendere i tuoi interessi e a migliorare il sito. Visita la nostra informativa sui cookie per saperne di più.
Gestisci i cookie
Impostazioni dei cookie
I cookie necessari al corretto funzionamento del sito sono sempre abilitati.
Gli altri cookie sono configurabili.
Cookie essenziali
Sempre attivi. Questi cookie sono essenziali per consentirti di utilizzare il sito web e le sue funzionalità. Non possono essere disattivati. Vengono impostati in risposta alle tue richieste, come ad esempio l'impostazione delle preferenze sulla privacy, l'accesso o la compilazione di moduli.
Cookie analitici
Disabile
Questi cookie raccolgono informazioni che ci aiutano a capire come vengono utilizzati i nostri siti web o quanto sono efficaci le nostre campagne di marketing, oppure ci aiutano a personalizzare i nostri siti web per te. Consulta qui l'elenco dei cookie analitici che utilizziamo.
Cookie pubblicitari
Disabile
Questi cookie forniscono alle società pubblicitarie informazioni sulla tua attività online per aiutarle a mostrarti annunci pubblicitari più pertinenti o a limitare il numero di volte in cui visualizzi un annuncio. Queste informazioni possono essere condivise con altre società pubblicitarie. Consulta qui l'elenco dei cookie pubblicitari che utilizziamo.
Confermare
Esercitazioni di continuità operativa | Resilience Guard GmbH
Home / Consulting / Business Continuity Exercises

Business continuity exercising

An unexercised plan is a hypothesis.

Tabletop, functional, cyber and full scale exercises that prove your plans work, sharpen the people behind them, and produce the evidence ISO 22301, NIS2 and DORA expect.

Book a consultationHow an exercise runs

What is a business continuity exercise?

A business continuity exercise is a controlled rehearsal of how your organisation responds to disruption. It takes the plans you have written, a cyber attack, a site loss, a supplier failure, a data centre outage, and tests them against a realistic scenario, with the people who would actually have to respond. The output is evidence: what held, what failed, and what to fix before reality runs the test for you.

Exercising is also an obligation. ISO 22301 requires a standing exercise programme, NIS2 expects continuity and crisis measures whose effectiveness is assessed, and DORA requires financial entities to test digital operational resilience against severe but plausible scenarios. One well designed exercise produces the assurance and the audit trail at the same time.

4
Exercise formats, tabletop to full scale
3
Regimes evidenced: ISO 22301, NIS2, DORA
12
Industries we serve and exercise
1
Board ready report after every exercise

The exercise ladder

Four formats, from low disruption to full realism. Most programmes climb the ladder over time: each rung builds the confidence, and the evidence, for the next.

The exercise ladder Four exercise formats ascend from tabletop to functional to cyber crisis to full scale. Realism and disruption increase along the ladder, and so does the assurance gained. REALISM AND DISRUPTION ASSURANCE GAINED 01 · TABLETOP Talk the plan through Leadership, low disruption 02 · FUNCTIONAL Test one capability for real Teams and systems in scope 03 · CYBER CRISIS Face a live cyber attack IT, comms and leadership 04 · FULL SCALE Activate end to end Sites, systems and people The exercise ladder Four exercise formats from tabletop to full scale. Realism, disruption and assurance increase down the ladder. REALISM, DISRUPTION AND ASSURANCE INCREASE 01 · TABLETOP Talk the plan through Leadership, low disruption 02 · FUNCTIONAL Test one capability for real Teams and systems in scope 03 · CYBER CRISIS Face a live cyber attack IT, comms and leadership 04 · FULL SCALE Activate end to end Sites, systems and people

The formats, compared

Which exercise fits depends on what you need to prove, to whom, and how much disruption you can absorb.

FormatoWho is in the roomDurata tipicaWhat it proves
Tabletop exerciseExecutive and crisis teams around one tablemezza giornataRoles, decisions and escalation paths are understood, and the plan holds as a document.
Functional exerciseOne team or capability, with its real toolsHalf to one dayA specific capability, such as IT recovery, relocation or emergency communications, works in practice.
Cyber crisis exerciseIT, security, communications and leadership togetherOne dayThe organisation can decide, communicate and recover under a realistic cyber scenario such as ransomware.
Full scale exerciseMultiple teams, sites and systems, liveOne to two daysThe whole response works end to end under conditions close to a real disruption.

How an exercise runs

Six steps, from scoping to the corrective actions that feed the next cycle. Designed and facilitated by practitioners who have managed real crises.

Step 1
Scope and objectives
What must be proven, for which plans, teams and obligations. Success criteria agreed with you up front.
Step 2
Scenario and inject design
A severe but plausible scenario from our library, tailored to your industry, with a timed sequence of injects.
Step 3
Delivery and facilitation
Run by senior practitioners who have managed real crises, with trained observers scoring against the criteria.
Step 4
Hot debrief
Immediate structured feedback while the experience is fresh, captured from every team in the exercise.
Step 5
Evaluation report
A board ready report: what held, what failed, evidence for ISO 22301, NIS2 and DORA, and a corrective action plan.
Step 6
Corrective actions into the next cycle
Findings update your plans and training, and set the objectives of the next exercise. Assurance compounds.

Scenarios that feel real

Scenarios come from our library and are tailored to your industry and threat profile. They are severe but plausible: hard enough to expose weaknesses, close enough to reality that the lessons transfer.

  • Ransomware and destructive cyber attack
  • Site loss and denial of access
  • Critical supplier or shared platform failure
  • IT and data centre outage
  • Power and utilities disruption
  • Workforce absence and pandemic conditions

How often to exercise

Tabletop exerciseevery 6 months
Functional exerciseevery 12 months
Cyber crisis exerciseevery 12 months
Full scale exerciseevery 18 to 24 months

Typical intervals between exercises of each format. Your cadence is calibrated to your risk profile, regulatory obligations and maturity during scoping.

What the regulators and standards expect

One exercise, run properly, produces the evidence several regimes ask for.

StrutturaWhat it expectsWhat the exercise gives you
ISO 22301An exercise programme that validates continuity strategies and plans over time (Clause 8.5).A documented exercise record, evaluation report and corrective actions, ready for certification audits. See our BCM service.
NIS2Business continuity and crisis management among the Article 21 measures, with their effectiveness assessed.Evidence that continuity and crisis arrangements are tested, not just written. See our NIS2 service.
DORAA digital operational resilience testing programme for financial entities, including severe but plausible scenarios.Response and recovery tested against realistic ICT disruption, with board ready reporting. See our DORA service.
EASA Part-ISTested readiness to detect and respond to information security events in aviation.Aviation scenarios exercised across operations and information security. Read our Part-IS guide.
ISG svizzeraResilient arrangements for critical infrastructure operators in Switzerland.Exercised response arrangements that stand up to regulator scrutiny. Read our Swiss ISG guide.

Prefer to build the capability in house?

We also train your own people to design and run exercises, through our accredited training practice.

Formazione

Esercitazioni di gestione delle crisi

Learn to design, run and evaluate crisis exercises inside your own organisation.

Scopri il programma › Formazione

Top Team Simulations

High pressure simulations for executive teams and boards.

Scopri il programma › Formazione

Operazione HELVETIA

Our flagship immersive exercise experience.

Scopri il programma ›

Domande frequenti

What is a business continuity exercise?
A controlled rehearsal of your organisation's response to disruption. It tests real plans and real people against a realistic scenario, and produces evidence of what held, what failed and what to fix.
What is the difference between a tabletop and a full scale exercise?
A tabletop talks the plan through around one table with low disruption. A full scale exercise activates teams, sites and systems live, end to end. Most organisations climb from tabletop to full scale over successive exercises.
How often should we exercise?
As a rule of thumb: tabletops every six months, functional and cyber crisis exercises annually, and a full scale exercise every eighteen to twenty four months. The right cadence depends on your risk profile and regulatory obligations, and is agreed during scoping.
Do exercises satisfy ISO 22301, NIS2 and DORA requirements?
They produce the evidence those regimes ask for. ISO 22301 requires a standing exercise programme, NIS2 expects the effectiveness of continuity and crisis measures to be assessed, and DORA requires resilience testing against severe but plausible scenarios. Each exercise ends with a documented evaluation report and corrective action plan.
Will an exercise disrupt our operations?
Only as much as you choose. Tabletops are near zero disruption. Functional and full scale exercises are scoped with you so that realism is maximised while operations stay protected.
Who designs and runs the exercise?
Senior Resilience Guard practitioners who have managed real crises, supported by trained observers who score the exercise against agreed criteria.

Scopri di più

Servizi correlati

CONTINUITY AND RESILIENCE

Gestione della continuità operativa

Strategia, piani e validazione conformi alla norma BIA e ISO 22301: un programma di continuità operativa progettato per resistere a un'interruzione reale.

Scopri il servizio ›REGULATION AND CRISIS

Gestione delle crisi

Dottrina, strutture e comunicazioni che contengono il picco e abbreviano i tempi di recupero, basate sulla norma ISO 22361.

Scopri il servizio ›CONTINUITY AND RESILIENCE

Resilienza organizzativa

La struttura sopra i piani: rischio, continuità, crisi, sicurezza informatica e persone su un'unica base di governance, secondo ISO 22316.

Scopri il servizio ›CYBER AND SECURITY

Resilienza informatica

Oltre la prevenzione: la capacità di resistere, reagire e riprendersi, garantendo al contempo la continuità dei servizi essenziali.

Scopri il servizio ›CYBER AND SECURITY

Sicurezza delle informazioni

Riservatezza, integrità e disponibilità garantite da un ISMS dinamico e conforme alla norma ISO 27001.

Scopri il servizio ›CYBER AND SECURITY

Sicurezza della catena di approvvigionamento

Il rischio che ereditate dai fornitori e dalle piattaforme condivise: mappato, garantito, contrattualizzato ed esercitato, secondo le norme ISO 28000, NIS2 e DORA.

Scopri il servizio ›REGULATION AND CRISIS

Conformità NIS2

Dalla determinazione dell'ambito di applicazione alle misure previste dall'articolo 21 e alla prontezza di presentazione dei rapporti entro 24 ore ai sensi della direttiva (UE) 2022/2555.

Scopri il servizio ›RISK AND GOVERNANCE

Gestione del rischio

Dall'universo dei rischi al rischio gestito: identificazione, valutazione consapevole dello stress, trattamento personalizzato e monitoraggio in tempo reale.

Scopri il servizio ›RISK AND GOVERNANCE

7A Quadro di riferimento per la gestione del rischio

Il nostro modello operativo proprietario incentrato sulle decisioni: esposizione e affidabilità delle decisioni misurate separatamente, per il consiglio di amministrazione.

Scopri il servizio ›RISK AND GOVERNANCE

Governance e resilienza dell'IA

La governance ha avvolto ogni livello dei sistemi intelligenti, dal comportamento dei modelli alla responsabilità del consiglio di amministrazione e alla norma ISO 42001.

Scopri il servizio ›SECTOR FRAMEWORK

Quadro di riferimento DAEDALUS per la resilienza aeroportuale

Il Framework per la Resilienza Aeroportuale: cinque ambiti come un unico modello operativo per l'intero aeroporto, basato sul motore 7A, nelle edizioni per l'aviazione commerciale, cargo e business.

Scopri il servizio ›

Find out whether your plans survive contact.

Tell us what you need to prove, to your board, your auditor or your regulator, and we will design the exercise that proves it. Conversations are confidential.

Book a consultationRead the case studies