2 cissp ® Official Study Guide Eighth Edition

119
Testing and Exercises
The BCP documentation should also outline a formalized exercise program to ensure that 
the plan remains current and that all personnel are adequately trained to perform their du-
ties in the event of a disaster. The testing process is quite similar to that used for the disaster 
recovery plan, so we’ll reserve the discussion of the specific test types for Chapter 18.
Summary
Every organization dependent on technological resources for its survival should have a com-
prehensive business continuity plan in place to ensure the sustained viability of the organiza-
tion when unforeseen emergencies take place. There are a number of important concepts that 
underlie solid business continuity planning practices, including project scope and planning, 
business impact assessment, continuity planning, and approval and implementation.
Every organization must have plans and procedures in place to help mitigate the effects 
a disaster has on continuing operations and to speed the return to normal operations. To 
determine the risks that your business faces and that require mitigation, you must work 
with a cross-functional team to conduct a business impact assessment from both quantita-
tive and qualitative points of view. You must take the appropriate steps in developing a con-
tinuity strategy for your organization and know what to do to weather future disasters.
Finally, you must create the documentation required to ensure that your plan is effec-
tively communicated to present and future BCP team participants. Such documentation 
should include continuity planning guidelines. The business continuity plan must also 
contain statements of importance, priorities, organizational responsibility, and urgency 
and timing. In addition, the documentation should include plans for risk assessment, accep-
tance, and mitigation; a vital records program; emergency-response guidelines; and plans 
for maintenance and testing.
Chapter 18 will take this planning to the next step—developing and implementing a 
disaster recovery plan that includes the technical controls required to keep your business 
running in the face of a disaster.
Exam Essentials