How to prepare for and plan your organisation's response to severe cyber threat: a guide for CNI
Act now to be ready to withstand and recover from severe cyber attacks.
Pages
Page 22 of 26
4.4 Test and exercise recovery plans
Plans must be tested regularly to ensure they remain fit for purpose. Be aware that crisis response rarely involves just your organisation, so understanding how you will coordinate with others during disruption is essential. Make testing and exercising a routine part of your approach to cyber resilience.
Activity
What to do
Conduct practical exercises.
Run tabletop exercises and technical simulations that test your crisis operations plans.
Include scenarios where:
attackers are still present during transition back to normal operations
primary recovery tools are compromised
key personnel are unavailable
Test with partners.
Exercise your plans with:
external partners
suppliers
sector peers
Validate workarounds.
Don't assume manual processes or alternative systems will work as planned.
Test workarounds under realistic conditions and with the staff who will actually use them during a crisis.
Measure operational impact.
During exercises:
measure how long operations can sustain using alternative processes
identify bottlenecks, resource constraints, and points where alternative processes break down
