Invoking BCPs
A BCP cannot be considered reliable until it is invoked and has proved to be workable, especially since false confidence may be placed in its integrity. Pre –invokation exercises include: validating plans; rehearsing key staff; and testing systems which are relied upon to deliver resilience (e.g. uninterrupted power supply). The frequency of exercises will depend on the organisation, but should take into account the rate of change (to the organisation or risk profile), and outcomes of previous exercises (if particular weaknesses have been identified and changes made).
It is important to ensure that relevant people across the organisation - and in other organisations where appropriate - are confident and competent concerning the plan. A training programme should be developed and run for those directly involved in the execution of the BCP.