Business Continuity Exercises & Testing (ISO 22398) Training Course

The Business Continuity Exercises & Testing (ISO 22398) Training Course equips business continuity, crisis management, emergency response, and IT disaster recovery professionals with the knowledge and practical skills needed to design, conduct, evaluate, and learn from exercises and tests that validate business continuity, crisis, and recovery capabilities. Plans that are never exercised create false confidence: contact details are outdated, roles are unclear, recovery times are not achievable, technology fails over incorrectly, and decision makers are unprepared for real disruption. ISO 22301 requires organizations to exercise and test their business continuity procedures, and regulators, boards, and customers increasingly expect evidence that recovery capabilities actually work. Well-designed exercise programs build competence and confidence, reveal gaps before real incidents occur, and drive continual improvement. The course covers exercises and testing from program design to improvement, informed by ISO 22398 guidance for exercises, the exercise requirements of ISO 22301, and recognized good practice in exercise design and evaluation. Participants learn the purpose and types of exercises and tests, including discussion-based exercises such as seminars, walkthroughs, and tabletop exercises, operations-based exercises such as drills, functional exercises, and full-scale simulations, and technical tests such as call tree tests, alternate site activation, backup restoration, and IT disaster recovery failover. The program then addresses building a progressive multi-year exercise program, setting exercise objectives and scope, forming the exercise planning team, designing realistic scenarios, scenario event lists, and injects, assigning exercise roles, and managing safety, logistics, and communication. Participants also examine facilitating and controlling exercises, evaluation methods and criteria, observation and data collection, debriefs, after-action reports and improvement plans, tracking corrective actions, crisis management and executive exercises, cyber incident exercises, involving suppliers, regulators, and external agencies, and measuring exercise program effectiveness. The course is delivered through exercise design workshops, a live tabletop exercise run by participants, evaluation and debrief practice, and case studies of exercise programs and real incidents. Participants leave with a multi-year exercise program template, an exercise planning and objectives template, a scenario and inject development template, an exercise evaluation and observation guide, and an after-action report and improvement plan template. This course builds practical exercise design and evaluation skills and is not an official ISO certification; participants should confirm the current editions of referenced standards.