BCM Exercise Plan Template: Injects, Evidence & AAR

Written by: BCM.Center Editorial Team Reviewed by: BCM.Center content review Reading time: 5 min Guide length: 1,005 words Published: 21 Jun 2026 Updated: 10 Sep 2026

Exercises should demonstrate decisions and capabilities, not simply prove that a meeting occurred. Start with specific objectives, choose a scenario that stresses those objectives, define observable success criteria, collect evidence and turn findings into owned corrective actions.

Exercise plan template

Section	Required content
Purpose and scope	Services, plans, sites, suppliers, systems and teams in scope/out of scope
Objectives	3–6 measurable objectives linked to actual continuity risks or recent gaps
Scenario	Plausible disruption with enough ambiguity to require decisions
Assumptions / artificialities	What is simulated, what is real, what systems must not be touched
Participants and roles	Players, controllers, facilitators, observers, evaluators, suppliers
Inject schedule	Timed events that reveal new facts or degrade assumptions
Evaluation criteria	Expected behaviours/outcomes and evidence source
Safety / stop criteria	Conditions that stop or pause the exercise
Communications	Exercise channels, “EXERCISE” labelling and external-message controls
After-action process	Hot wash, evidence review, root cause, action owners, due dates and retest

Scenario library

Scenario	What it tests	Useful complications
Ransomware with data-integrity concern	Cyber/BCM/DR coordination and clean recovery	Backups exist but identity is compromised; key supplier also degraded
Cloud-region failure	Architecture, failover, DNS/network dependencies, business validation	Failover capacity lower than peak; external API allow-list missing
Primary workplace inaccessible	Remote/alternate-site strategy and staffing	Transport disruption and 30% absenteeism
Critical supplier outage	Third-party escalation, substitution, customer prioritisation	Supplier cannot give ETA; alternate requires onboarding lead time
Telecom/contact-centre outage	Customer communications and alternate channels	Mobile network congestion; public misinformation
Payment/market cutoff disruption	Priority rules, transaction integrity, regulatory/customer communication	Backlog approaches cutoff; manual control capacity limited
Severe weather / regional event	Multi-site and people resilience	Power, transport and supplier impacts are correlated

Example 90-minute tabletop inject timeline

Time	Inject	Expected decisions / evidence
T+0	Critical customer platform unavailable; monitoring shows regional infrastructure issue	Assess service impact, start incident log, identify RTO/MBCO and activation authority
T+15	Provider says restoration estimate is 4h; service RTO is 2h	Activate continuity strategy; identify minimum service and priority population
T+30	Alternate environment is available but one identity dependency is failing	Escalate dependency; decide controlled workaround; update forecast
T+45	Social media reports customers cannot access funds/services	Approve customer message; align facts, channel and next update
T+60	Supplier used by both primary and alternate route reports degradation	Re-evaluate assumptions/concentration; protect scarce capacity
T+75	Technology says service is technically restored; reconciliation is incomplete	Do not confuse technical availability with business readiness; define validation gate
T+90	Backlog is growing after restoration	Prioritise backlog, set clearance forecast, define stand-down and lessons actions

Evaluator worksheet

Objective	Observable behaviour	Evidence	Rating
Activate within 20 min	Authority identified; activation decision recorded	Timestamp + decision log	Met / Partial / Not met
Achieve minimum service within RTO	MBCO started and measured	Queue/throughput records	Met / Partial / Not met
Manage communications	First approved message issued to defined audience	Message + approval/time	Met / Partial / Not met
Validate recovery	Business owner completes validation before full release	Test cases/sign-off	Met / Partial / Not met
Manage supplier dependency	Escalation, ETA, workaround and concentration decision tracked	Vendor ticket + decision	Met / Partial / Not met

After-action report structure

Executive summary and exercise scope
Objectives and scenario
What worked and should be preserved
Findings by objective
Root/causal factors where known
Recovery-objective and capability gaps
Decisions that need governance approval
Corrective actions with owner, priority and due date
Evidence repository
Retest criteria and target date

A finding is stronger when it states condition, impact and action. Example: “The DR platform recovered in 95 minutes, but business validation required another 35 minutes because test data and an authorised validator were not pre-arranged. This would exceed the two-hour service RTO. Action: create a controlled validation pack, nominate two alternates and retest.”

Official references and further reading

FEMA exercise resources — US preparedness resources that can support structured exercise planning.
ISO 22398:2013 — International guidelines for exercises and testing in the security/resilience domain.
BCI GPG 7.0 — Includes validation as a professional practice.

Scenario library: vary the dependency, not only the disaster name

Scenario	Primary learning objective	Useful injects
Cyber / ransomware	Decision between containment and rapid recovery; clean restore; communications	Privileged account compromise, backup uncertainty, regulator/customer inquiry
Supplier outage	Concentration, escalation, substitution and contracted capacity	Supplier declares regional incident; alternate supplier has 50% capacity
Workforce loss	Succession, cross-skilling, shift sustainability	40% absenteeism; two key approvers unavailable
Facility loss	Alternate location, remote work, equipment and access	Building closed 72 hours; local transport disrupted
Cloud / SaaS outage	External dependency, failover boundaries, manual workflow	Status page gives no ETA; API unavailable; data export is delayed
Data integrity event	RPO, reconciliation, duplicate/lost transactions	Recovery point uncertain; downstream system processed partial batch
Telecom outage	Multi-carrier, emergency channels, customer routing	Mobile voice degraded; internet circuit also affected
Regional event	Multiple dependencies and scarce resources fail together	Site, staff, supplier and transport constraints overlap

Evaluation rubric

Objective	Pass evidence	Partial	Fail
Activation	Correct authority activates within target and records rationale	Activated with delay or unclear rationale	No activation / wrong authority
Minimum service	MBCO demonstrated with measured throughput	Workaround runs but below required capacity	No viable workaround
Communications	Priority stakeholders receive approved, accurate updates through working channels	Some groups/channels delayed	Critical stakeholder not informed
Recovery validation	Technology and business checks completed before release	Some validation informal	Service released without business/control validation
Learning	Actions have owner, date, risk and retest method	Actions generic	No accountable corrective action

Exercise inject design rules

Each inject should connect to an exercise objective; do not add noise only to make the scenario dramatic.
Give participants enough information to decide, but preserve realistic uncertainty.
Mix operational, supplier, technology, people and communication consequences when testing end-to-end resilience.
Record the expected decision/evidence for evaluators before the exercise starts.
Time-jump only when the objective needs a later consequence; explain the simulated clock clearly.
Do not grade individuals for exploring options in a learning exercise unless evaluation criteria explicitly require a capability demonstration.
End with a formal hot wash, evidence review and action ownership rather than a generic “successful exercise” statement.