A business continuity plan only helps if it works, and the only way to know is to test it. The right business continuity exercise scenarios are how you find out where your plan breaks, in a conference room instead of in the middle of the real thing.
Most plans fail quietly: an outdated call tree, a recovery dependency nobody mapped, a workaround that lives in one person’s head. As we say on our business continuity exercises page, untested plans are assumptions with formatting.
Here are the seven scenarios we’d test first, what each one exposes, and the questions your team should be able to answer.
| Old View | New View |
| Write a plan for every type of disaster | Plan for four consequences: loss of people, place, technology, or a third party |
| Test the scenario the team handles best | Test the scenario the organization is avoiding |
| Read the plan aloud and call it a test | Make people execute the workaround |
| One annual exercise for the auditors | A cadence where each exercise retests what the last one found |
Think in Consequences, Not Causes
There are hundreds of ways to be disrupted. There are only four consequences that matter to a business continuity plan:
- Loss of people. Your team can’t work, or can’t get to work.
- Loss of place. A facility, site, or workplace is unavailable.
- Loss of technology. Systems, applications, networks, or data are down or untrustworthy.
- Loss of a third party. A critical supplier, vendor, or service provider can’t deliver.
A good scenario forces one or more of those consequences on your plan. As you read the seven below, notice which consequences each one tests. A set of exercises that covers all four over a year or two tells you far more than seven variations on the same theme.
Run the business impact analysis (BIA) first. The BIA tells you which processes matter most and how long they can be down. Your scenarios should push on exactly those processes.
Types of Business Continuity Exercises
Pick the format before the scenario. They run from low stress to high:
- Plan review. The plan owner and team walk through the plan line by line. It catches stale contacts and missing steps. It is a check, not a test.
- Plan validation tabletop. A facilitated discussion of one plan or function against a realistic disruption. It is the right first test for most continuity programs. Ready.gov’s business exercise guidance describes the format for private-sector teams.
- Functional exercise. Teams execute real procedures: activate the alternate process, run the manual workaround, make the notifications. It tests execution, not discussion.
- Recovery exercise. IT disaster recovery and business recovery run together, for real.
- Enterprise continuity simulation. A regional event takes down multiple sites at once, run as a full simulation with injects through real channels.
Start where your team is. A new plan needs a tabletop. A team that has sailed through three tabletops needs a functional or recovery exercise.
7 Business Continuity Exercise Scenarios
Each scenario links to the matching entries in our Scenario Library, where we publish the scenarios we design and run.
1. Ransomware and cyberattack
Tests: loss of technology, often with loss of data integrity.
Ransomware is a business continuity problem, not only an IT incident. Today’s attacks often steal data before (or instead of) encrypting it, and they can take down the systems your workarounds depend on. Technical recovery is a fraction of the response; the rest is how the business keeps serving customers while IT rebuilds.
- Which critical processes can run manually, and for how long?
- Do your workarounds depend on the same systems that are down?
- Who decides which applications come back first, and on what basis?
- How do you communicate with employees if email and chat are compromised?
See Ransomware and Double Extortion in the library.
2. Pandemic and public health threats
Tests: loss of people, across every site at once.
COVID-19 broke the most common continuity strategy: move the work to another location. When every region faces the same disruption at the same time, there is nowhere to move it. A public health scenario tests whether your plan works when absenteeism is high everywhere.
- Which roles must be on site, and which can work remotely without a drop in service?
- Who can cover a critical role if 30 percent of a team is out?
- Which processes depend on one person’s knowledge?
- How do payroll, benefits, and leave policies hold up?
See Global Health Threat in the library.
3. Physical disruptions: fire, active assailant, and workplace violence
Tests: loss of place and loss of people, with life safety first.
Fire drills and evacuation drills cover the first minutes. The continuity questions start after the building is cleared. Where does the team work tomorrow? Who supports the people who were there? Keep life-safety drills realistic but humane: no simulated gunfire or staged violence in employee drills.
- If the building is a crime scene for a week, where do the people and the work go?
- How do you account for every employee, contractor, and visitor?
- Who supports affected employees and their families?
See Active Shooter and Active Assailant and Workplace Violence in the library.
4. Natural disasters
Tests: loss of place, loss of people, and often loss of third parties in the same region.
Hurricanes, tornadoes, winter storms, wildfires, and earthquakes vary by geography, so match the scenario to where your facilities, people, and suppliers actually are. The trap is assuming the disaster hits only you. Your employees’ homes, your local suppliers, and the roads between them are affected too.
- What can you do in the days of warning a hurricane gives you?
- What happens when employees can’t come in because their own homes are damaged?
- Which suppliers sit in the same disaster zone you do?
See the natural disaster scenarios in the library.
5. Extended power outage
Tests: loss of place and loss of technology at a site.
A storm knocks out power and the utility says restoration will take several days. Generators buy time, but only if they have fuel, maintenance, and enough capacity for what you actually need to run.
- What do the generators power, and for how long on the fuel you have?
- Which processes move to another site, and who goes with them?
- What happens to temperature-sensitive inventory, equipment, or data?
See Wildfire and Regional Power Loss in the library.
6. Network and cloud outage
Tests: loss of technology, often at a provider you don’t control.
Most organizations now depend on cloud platforms and software-as-a-service vendors for work that used to run in their own data center. Moving to the cloud shifts risk; it doesn’t eliminate it. And failover rarely happens as automatically as the architecture diagram suggests.
- Which critical processes stop if your primary cloud region or a key SaaS platform is down for a day?
- Has anyone tested the failover, or is it an assumption?
- How do remote employees reach what they need if the VPN or identity provider is unavailable?
See Cloud Provider Outage in the library.
7. Loss of emergency communications
Tests: whether you can coordinate the response at all.
Most organizations run their response on Teams, Zoom, or Slack, and almost none practice losing that platform. A communications scenario asks whether you can reach the right people quickly when the usual channel is gone.
- If email and chat are down, how does the team convene?
- Is your emergency notification system current, and does it reach personal phones?
- Does everyone know the backup bridge line or meeting point?
- Who sends the first update to employees, and how fast?
Fold this one into the others. Take away the primary channel in the middle of any scenario and watch what happens.
The Eighth Scenario Most Plans Skip
Notice that only one consequence barely appears above: the loss of a critical third party. Your biggest single point of failure may not work for you. A critical vendor failure, a business process outsourcing outage, or a sole-source supplier loss tests whether your plan has any answer besides “call the vendor.” See Supply Chain and Third Party scenarios in the library.
How to Get More From Every Exercise
- Train before you test. A team that has never seen the plan will make the plan look broken.
- Target what you haven’t exercised. When a major U.S. healthcare organization asked us to run a series of business continuity exercises, it specifically targeted functions that had never been exercised. The organization put the recommendations in place, and the follow-up exercise the next year showed marked improvements.
- Write it down. Every exercise ends with an After-Action Report (AAR), and every recommendation gets an owner and a due date.
- Retest the fixes. The next exercise should test what the last one said needed fixing.
- Build a cadence. Exercise critical functions at least annually, and build each exercise on the last. How to Build a Crisis and Business Continuity Exercise Strategy covers the building blocks.
The exercises section of our Ultimate Guide to Business Continuity covers formats and cadence in more depth.
A plan that has never been tested is a hypothesis. Pick a scenario and find out.
Keep Going
A few ways to go deeper if this was useful.
- Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Business Continuity.
- Run your next exercise. Exercise in a Day® builds a full custom tabletop in one business day, and Exercise in a Box® gives your business leaders 15 scenarios they can run themselves.
- Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
- Talk to us. Set up a call to think through your next continuity exercise with us.
