A Business Continuity Plan should be tested:

The correct answer is C. At least once a year. Industry best practice and most regulatory frameworks (such as NIST SP 800-34 and ISO 22301) require that a BCP be tested at least once a year. Annual testing ensures the plan remains current, personnel are familiar with their roles, and any gaps or outdated procedures are…

Submitted by yuriko_h· Apr 18, 2026Incident Response and Recovery

Question

Options

AOnce a month.
BAt least twice a year.
CAt least once a year.
DAt least once every two years.

How the community answered

(32 responses)

A
3% (1)
B
3% (1)
C
88% (28)
D
6% (2)

Explanation

Industry best practice and most regulatory frameworks (such as NIST SP 800-34 and ISO 22301) require that a BCP be tested at least once a year. Annual testing ensures the plan remains current, personnel are familiar with their roles, and any gaps or outdated procedures are identified and corrected. Testing less frequently (e.g., every two years) risks the plan becoming stale. Monthly or bi-annual testing may be appropriate for high-criticality environments, but the minimum standard baseline is annual testing.

Topics

#Business Continuity#BCP Testing#Continuity Planning

Community Discussion

No community discussion yet for this question.

Full SSCP Practice