BCM – Emergency and Crisis Drills
An emergency plan only proves its worth when it works under pressure. Through realistic exercises, we test whether your plans hold up, whether roles and reporting channels are in place, and whether your crisis management team is capable of making decisions. mgm security partners designs, facilitates, and evaluates emergency and crisis exercises—from desk-top exercises to full-scale drills—using a methodologically sound approach based on BSI Standard 200-4 and ISO 22301.
Practice is mandatory, not optional: DORA requires regular testing of business continuity and emergency plans, while BSI 200-4 and ISO 22301 stipulate that testing is an integral part of the BCM lifecycle. Only plans that have been tested are robust plans.
Background
Why Emergency Drills Are Essential
Emergency and recovery plans are developed at great expense, but are rarely tested under realistic conditions. Yet that is precisely where it is determined whether a BCM will hold up in a real emergency. Drills reveal gaps in plans, roles, and communication channels before a real incident makes them painfully apparent, and they give those involved the confidence to act.
We design exercises to match your level of maturity. We often start with a plan review or a staff exercise, and as you gain experience, we move on to functional and full-scale exercises. Each exercise provides documented insights and concrete improvement measures, thereby effectively concluding the “Tests and Exercises” phase of the BCM lifecycle.
From desk exercises to full-scale drills
Exercises vary in terms of effort required, realism, and value. We’ll work with you to choose the format that best suits your skill level and goals, and we’ll increase the intensity as you become more accustomed to the routine.
As the scale increases, so do the realism, the effort required, and the depth of insight gained from the exercise.
The challenge
- Contingency plans are in place, but they have never been tested under realistic conditions
- Roles within the crisis management team, reporting procedures, and alert protocols are unclear in practice
- DORA calls for regular, documented testing of business continuity plans
- Internal exercises often remain too abstract or are not evaluated consistently
- We lack the time and experience needed for planning and impartial moderation
- Lessons learned from exercises are not incorporated into BCM improvements
Our Added Value
- Exercises tailored to your skill level, ranging from a desk-based test to a full-scale exercise
- Realistic scenarios derived from your business impact analysis
- Neutral, experienced facilitation free from institutional blindness
- Compliance with the DORA testing requirement through audit-proof documentation
- Structured Analysis with Prioritized Improvement Measures
- Feeding the Results Back into the BCM Lifecycle
Exercise Formats in Detail
Each format serves a specific purpose. Over time, we combine them into a well-rounded exercise program that makes your BCM more resilient, step by step.
1 - Desk Review
Minimal effort. Review of plans and documents at a desk, without involving the entire team.
- Validation and Completeness Check
- Up-to-Date Contacts and Processes
- The Ideal First Maturity Check
2 - Plan Review
: Minimal effort required. The team works through a scenario together (tabletop exercise), step by step.
- Fostering an Understanding of Roles and Processes
- Identify weaknesses in the plan early on
- Minimal disruption to operations
3 - Staff / Crisis Management Team Exercise “
” Moderate effort. The crisis management team practices decision-making and communication using a dynamic scenario.
- Decision-Making and Reporting Channels Under Time Pressure
- Coordination and Situation Assessment in the Staff
- Internal and External Crisis Communication
4 - Functional Exercise
: High effort required. Individual procedures are tested under real-world conditions, such as the restart of a system or process.
- Practical Testing of Specific Measures
- Recovery Time Objective (RTO) Testing
- Proof of Technical Recoverability
5 - Emergency / Full-Scale Drill
Very high level of effort required. An overall scenario is simulated as realistically as possible under actual conditions.
- Cooperation among all parties involved and plans
- Highest level of reliability regarding load-bearing capacity
- For organizations with established BCM procedures
6 - Exercise Program
Ongoing. We plan your exercises as a multi-year program with increasing intensity rather than as a one-time event.
- Multi-Year Training Plan
- Tailored to regulatory requirements and level of maturity
- Ongoing Demonstration of Efficacy
Here's how a session with us works
Each exercise follows a clear, consistent sequence. This makes the effort involved predictable and ensures that the benefits are documented.
- 1 – Design: Defining the objective, format, scope, and scenario based on your critical processes and risks.
- 2 – Preparation: The script, roles, video clips, and evaluation criteria will be developed and coordinated with you.
- 3 – Implementation: Neutral facilitation of the exercise, monitoring of procedures, and real-time management of the scenario.
- 4 – Evaluation: Debriefing, exercise report including lessons learned, and prioritized measures to improve BCM.
Practicing with a Methodical Approach and a Regulatory Perspective
Our exercises are not an end in themselves. They are an integral part of a methodologically sound BCM and, at the same time, meet the regulatory testing requirements. Testing is an integral part of the BCM lifecycle as defined in the BSI 200-4 standard and ISO 22301. DORA requires regular, documented tests, while NIS 2 mandates proven crisis management. We clarify the scope of applicability and specific requirements as needed through our DORA and NIS 2 consulting services.
- BSI 200-4 & ISO 22301: Exercises as an integral part of the BCM lifecycle, methodically designed and evaluated.
- Mandatory DORA Testing: Regular, documented testing of emergency and business continuity plans as audit-proof evidence.
- NIS-2: Proven crisis management and business continuity as part of risk management obligations.
- Integration with BCM: Scenarios from the Business Impact Analysis, with results fed back into plans and actions.
What We Do During Exercises
We design, facilitate, and evaluate your exercises. You’ll receive the framework and insights you need to make your BCM more resilient with each exercise.
- Design of Training Scenarios and Scripts
- Neutral facilitation and observation of the exercise
- Evaluation, Exercise Report, and Lessons Learned
- Identification of Prioritized Improvement Measures
- Planning a Multi-Year Training Program
- Integrating the Results with Your BCM
Exercises in conjunction with your BCM
Exercises are most effective when combined with a robust BCM and appropriate regulatory frameworks. Depending on the specific situation, we combine them with our other services.
BCM Support
Don't have a robust BCM yet? We'll set up your business continuity management system in accordance with BSI 200-4 and ISO 22301, and then test it through exercises.
Business Impact Analysis
Where do realistic scenarios come from? From the BIA. It provides the critical processes and timeframes that we use to structure our exercises.
DORA & NIS2 Consulting
DORA requires regular testing; NIS-2 calls for proven crisis management. We assess your exposure and design a tailored training program.
Each exercise incorporates lessons learned from real-life incidents
- Over 25 years of experience in IT security consulting
- 5 Practice Formats, from a Paper-and-Pencil Test to a Full-Scale Exercise
- ISO 27001 certified and TISAX-compliant
- Experience from projects for government agencies and operators of critical infrastructure
mgm security partners covers the full spectrum of IT security, from consulting to security analyses and penetration tests to training. This practical experience is incorporated into our training scenarios: You practice scenarios that closely mirror real-world threats rather than contrived scenarios. We are ISO 27001 and TISAX certified and work for the BSI, other government agencies, and KRITIS operators, among others.
Emergency Drills: Quick Answers to Your Questions
Which exercise format should we start with?
That depends on your BCM maturity level. Without much prior exercise experience, we recommend starting with a tabletop exercise or a plan review to test plans and roles without disrupting operations. As your experience grows, you can move on to staff, functional, and finally full-scale exercises. We’ll work together to determine the right starting point.
Do we have to practice regularly because of DORA?
DORA requires affected financial institutions to regularly test their business continuity and emergency plans and to document these tests. Our exercises are designed to demonstrably meet this requirement. We can determine whether and to what extent you are affected through our DORA consulting services.
Will an exercise disrupt our ongoing operations?
This can be managed. Desk-top tests and planning meetings generally proceed without a hitch. Functional and full-scale drills are more time-consuming and more closely resemble actual operations, but they are carefully planned and scheduled. We coordinate the scope and timing so that the benefits justify the effort and risks to operations are minimized.
We don't have a fully developed BCM yet. Can we still conduct drills?
Yes. Even without a fully developed BCM, it is possible to conduct meaningful exercises, such as a review of existing emergency plans. However, it often makes sense to develop the BCM at the same time. We address both aspects in our BCM support, so that development and testing go hand in hand.
What do we receive after a workout?
After each exercise, you will receive an exercise report documenting the process, observations, lessons learned, and prioritized improvement measures. This report also serves as evidence for auditors and regulatory authorities. Upon request, we can assist with the implementation of these measures as part of our BCM support.
Do you also create the scenarios?
Yes. We develop realistic scenarios based on your business impact analysis and your actual threat landscape. We draw on our experience with real-world security incidents and penetration tests so that you can practice responding to relevant and plausible situations rather than contrived scenarios.