CISM · Question #648
An organization recently activated its business continuity plan (BCP). Employees were notified during the event, but some did not fully follow the communications plan. What is the BEST way to…
The correct answer is B. Perform tabletop testing with appropriate employees. Tabletop testing (B) directly addresses the root cause - employees didn't follow the communications plan because they weren't adequately practiced or familiar with it. Tabletop exercises simulate real events, walk employees through their roles step-by-step, and expose gaps in…
Question
An organization recently activated its business continuity plan (BCP). Employees were notified during the event, but some did not fully follow the communications plan. What is the BEST way to prevent a recurrence?
Options
- AUpdate the business impact analysis (BIA)
- BPerform tabletop testing with appropriate employees
- CIncentivize employees for following the plan
- DEnhance external communication instructions in the BCP
How the community answered
(31 responses)- A13% (4)
- B77% (24)
- C6% (2)
- D3% (1)
Explanation
Tabletop testing (B) directly addresses the root cause - employees didn't follow the communications plan because they weren't adequately practiced or familiar with it. Tabletop exercises simulate real events, walk employees through their roles step-by-step, and expose gaps in understanding before an actual incident occurs.
- A is wrong because a Business Impact Analysis identifies critical functions and recovery priorities - it doesn't train employees on how to communicate during an event.
- C is wrong because incentives don't build competency or familiarity with the plan; employees may still fail to follow it correctly even if motivated.
- D is wrong because the problem was internal employee behavior, not external communications - enhancing external instructions doesn't fix internal compliance.
Memory tip: When a BCP or DR plan was activated but not followed correctly, the fix is almost always practice (tabletop, walkthrough, or drill) - not updating documents or changing incentives. Think: "You don't learn to swim by reading about it."
Topics
Community Discussion
No community discussion yet for this question.