Day 1: Leadership Accountability for Resilience and Continuity

Governance within the Continuity System

• Define board management and BCMS-owner responsibilities
• Separate oversight from operating response plans
• Connect continuity policy with business objectives
• Diagnose unclear accountability within a scenario

Disruption Appetite and Acceptance Limits

• Define outage levels organization cannot tolerate
• Connect disruption thresholds with impact/obligations
• Review RTO/RPO as business decisions
• Challenge unrealistic recovery objectives

Approving BIA and Recovery Strategies

• Test assumptions behind impact and prioritization
• Assess whether proposed strategies meet objectives
• Request supplier/technology capability evidence
• Simulate committee review of recovery strategy

Day 2: Crisis Structures, Escalation, and Decision Information

Crisis Leadership Structure

• Differentiate response from executive crisis leadership
• Assign crisis declaration, activation, escalation rights
• Prevent competing decision rooms and confusion
• Map leadership for an enterprise-wide disruption

Decision Cadence During Crisis

• Choose briefing frequency matching event velocity
• Define minimum information needed before decisions
• Maintain decision, assumption, rationale logs
• Simulate leadership updates every thirty minutes

Communication and Accountability

• Define approval rights for stakeholder messages
• Base communication on confirmed actionable information
• Define external notification/escalation requirements
• Draft approval protocol for crisis communication

Day 3: Readiness Indicators, Exercises, and Learning

Demonstrable Readiness Indicators

• Measure plan currency, contacts, resources, dependencies
• Track unresolved dependence on individuals/suppliers
• Distinguish completed training from response capability
• Build a leadership readiness dashboard

Applied Exercise Program

• Select scenarios covering different critical exposures
• Link exercise objectives to decisions/capabilities
• Increase complexity from tabletop to simulation
• Build an annual exercise calendar

Post-Crisis and Post-Exercise Review

• Identify success/failure through observable evidence
• Assign improvement actions to accountable owners
• Track closure before considering learning complete
• Present learning report to governance committee

• Governance cases distinguishing oversight from operating response
• BIA and recovery-strategy reviews from a risk committee perspective
• Crisis simulation requiring escalation decisions and messages
• Design of a readiness dashboard and annual exercise program