Writing a continuity plan does not by itself show that it works. Evidence should connect analysis to strategy and implementation to current exercise results.

01

Show the basis of the plan

Link impact and risk analysis findings to selected strategies, resources and responsibilities. Maintain accessible contact lists, supplier arrangements, staff assignments and plan versions. A new site or significant service change may require renewed analysis; changing the file date alone is insufficient.

02

Set exercise success criteria beforehand

In a hypothetical move to an alternative site, an objective might be to operate the selected team, application and communication channels within the required time. Record the start, scenario steps, observations, achieved time and gaps. Attendance is not evidence of success. ISO 22398 guides planning, conducting and improving exercises; it does not mean every organisation must use an identical scenario or deliberately interrupt live operations.

03

Close findings and plan the budget

For missing access or failed notification, define an owner, action, deadline and repeat verification. Divide preparation into analysis, resource provision, training and exercises. Alternative site or system investment differs from independent certification fees. Check audit, surveillance, recertification and additional review terms. A fixed readiness date or incident-free service promise is not justified.

04

Understand certificate boundaries

Verify number, legal entity, activities, sites, edition and current status through official channels. Do not extend a scoped certificate to all services where an activity is excluded. It does not guarantee recovery within specified minutes in every disaster. The decision comes from the certification body’s independent evaluation, not a preparation consultant’s assurance.

Sources and application limits

The exercise example is not a customer incident. Plans and evidence must reflect current activities and the organisation’s own objectives.