RUEN
Home/Materials/Continuity drills
Implementing BCM

Business continuity drills: why and how to run them

A continuity plan that has never been tested usually fails in a crisis. Drills are the practice that reveals gaps in advance. We break down the types of drills and how to run them.

Updated: June 28, 2026 · Author: Evgeny Telenkov · ≈ 6 min read

Why drills matter

Drills verify that the business continuity plan (BCP) works in practice: people know their roles, contacts are current, backups are available and target recovery times (RTO) are achievable. Regular testing is a mandatory requirement of ISO 22301.

Types of drills

  • Tabletop. The team works through a failure scenario "at the table" by role. Cheap and fast, it surfaces most gaps in the plan.
  • Simulations. A close-to-real incident: alerting, decisions in real time.
  • Technical tests. Actual recovery of IT systems from backups (part of the DRP).
  • Full-scale exercises. Testing the whole chain — from detection to recovery.

How to run one: step by step

  1. Choose a scenario (for example, ransomware or loss of office).
  2. Define the goal and participants, assign an observer.
  3. Run the drill, noting where the team stumbles.
  4. Collect findings: what did not work, which contacts/resources were missing.
  5. Update the plan and assign owners for the fixes.
Tip: start with a tabletop drill on one scenario every six months. It is inexpensive and delivers the most value early on.

FAQ

Which type of drill should I start with?

Tabletop — the team works through a scenario at the table. It is inexpensive and surfaces most gaps in the plan.

How often should drills be run?

Basically once or twice a year on one scenario, with more frequent technical recovery tests for critical systems. The key is regularity.

From standard requirements to a working system

The assessment shows the gap between documents and reality. The system is then built by your people in the programme or by ours turnkey.

Take the free assessment → Continuity turnkey → ERGP certification →
Evgeny Telenkov
Evgeny Telenkov
Director, business continuity practice · PhD in Economics · Academic Director & Chief Examiner
Risk Manager of the Year in Russia 2020 (RusRisk). Built business continuity from scratch at Nornickel, more than 20 plans; led risk functions at Beeline, Rosneft and EY. Chief risk officer of a 20 billion dollar petrochemical megaproject. Deputy chair of Rosstandart technical committee 010 "Risk management", co-author of six national standards. Author of the ERGP and SAFE programmes.
Read also
7 days of downtime: a cyberattack lesson →
A real ransomware case at a major insurer: 7 days of downtime, website and app offline. Which BCM mechanisms w
BCM, BCP, DRP — the difference →
How BCM, BCP, DRP and risk management differ in plain language. A clear levels diagram, comparison table and e
5-minute assessment →
Your resilience level, three main risks and first steps. Free.