Company B has an established continuity and resilience programme, however a client requested an external audit to verify their capability to keep the services they provide running during a disruption and a couple of recommendations were identified to improve their programme.

They need to perform a more severe exercise scenario, to validate their continuity strategies, response capabilities and recovery timeframes. Completion is required, with evidence provided to the client of the exercise outcomes and action plan, within two months.

While Company B does have some inhouse experience to manage their programme, they don’t currently have the resource to address the audit actions as quickly as their client has requested…

Company B contacts Rule28 to discuss the scope of the project and the timescale required for delivery. Rule28 recommends the following services to address the audit actions:-

• A review, with key stakeholders, of the exercise scenarios previously performed, to ensure the design of a more severe scenario for this exercise;
• The design, and approval by key stakeholders, of a scenario that is appropriate for the company and their clients risks, aims and objectives;
• The design of exercise materials to support the delivery of the exercise (to include discussions and data from key stakeholders to support the realism of the scenario);
• Facilitation of the exercise;
• Facilitation of a post exercise debrief and the identification of any lessons to learn;
• An exercise report, with action plan, to address any lessons identified.