Request a proposal
Free Assessment
Cyber Risk Management
Risk Assessments
Security Posture AssessmentFreeCyber Risk Scoring GuideFreeCyber Risk Scorecard + Mitigation Plan$997Security Risk Assessment$997
Technology & AI Risk
Emerging Tech Risk RadarFreeShadow AI Discovery ChecklistFreeAI Acceptable Use Policy Pack$300Emerging Technology Risk Playbook$300AI Attack Surface Report$300Technology Risk Monitoring Retainer$300/moTechnology Risk Management Assessment$497Enterprise Security Modernization Roadmap$4,997
Vulnerability Management
Free Dark Web Scan + Security AuditFreeVulnerability Scan Report$300
Cyber Security Solutions
Threat Intelligence
Free Training: Attacker Threat BriefingFreeDefender Circle$300/mo · $397/yrMulti-Modal Threat Intelligence Program$3,500/mo
Email Security
Phishing and Social Engineering Audit$1,000
Cloud & Data Security
Data Security Governance Starter FrameworkFreeRealtime Adaptive Decisioning$12,500
Cyber Security Operations
Managed Detection & Response
AI-MDR Essentials$597/moAI-MDR Complete$1,197/moAI-Powered MDR Security Plans$397–$2,497/mo
Incident Response
Ransomware Response PlaybookFreeRansomware Readiness ChecklistFreeTier 3 Managed Retainer$6,500/moRansomware Containment Readiness$2,997
AI Threat Detection
AI Threat Exposure AssessmentFreeAI Traffic Anomaly Report$300
Cyber Security Defenses
Endpoint Security
Endpoint Security Scorecard$300Endpoint Security Servicesfrom $497Managed Endpoint Security Plans$300–$797/mo
Application Security
Application Security Pack$300AI Red Team Prompt Injection Kit$300
Network & Infrastructure Security
IoT Attack Surface Report$300Application Dependency Mapping$2,497Microsegmentation Design & Rollout$6,997
Compliance Services
HIPAA Compliance
HIPAA Risk Assessment WorksheetFreeHIPAA Compliance Package$12,500
Compliance Readiness
Compliance Readiness Assessment$997Security Compliance Suite$2,497/moFractional CISO Program$3,500/mo
Vendor & Third-Party Risk
Trust Center Care Plan$300/moCybersecurity Trust Center Build$4,997
HomeAboutBlogContactRequest a proposal

A continuity exercise is a scheduled conversation in which the people who would have to act walk through a simple scenario using only the documents they actually have. Someone facilitates, someone writes down what they observe, and the session ends with a short written list of things to fix. It is a discussion, not a drill, and the useful ones are shorter than people expect.

This article is general information about documentation and planning. It is not legal, compliance or security advice. Recovery targets and technical configuration are decisions for your organization to make with qualified professionals and to record in your own documents, and which obligations apply to you varies by organization, industry and jurisdiction.

What a continuity exercise is for

The purpose is to find out whether your documents work when a person who is not the author tries to use them. That is all. It is not a test of individuals, it is not an audit, and it is not a technical activity.

The things an exercise reliably surfaces are documentation problems: a runbook step nobody can follow, a dependency nobody had written down, a contact list with a person who left, two people who each thought the other owned a task. None of those are visible when the documents are read alone at a desk.

Say the purpose out loud at the start of the session. If people arrive thinking they are being assessed, they will describe the process they are supposed to follow rather than the one they would actually follow, and the exercise produces nothing.

How to schedule a continuity exercise people will attend

Scheduling is most of the difficulty, so treat it as part of the work rather than an administrative step.

  1. Put it in the calendar well ahead. Pick a date far enough out that the people you need can hold it, and name the attendees in the invitation rather than sending it to a group address.
  2. Keep the session short. A focused session covering one process is far more productive than a long session covering everything. People stop contributing once their attention goes.
  3. Pick a quiet period in the business. Avoid close periods, peak season and the week anything major is launching. An exercise that gets abandoned halfway is worse than one that was never booked.
  4. Say what to bring and what not to. Attendees bring the current documents, in whatever form they would really have them. Nobody prepares slides, and nobody writes anything new beforehand.
  5. Name the facilitator and the note-taker in the invitation. Both roles need to be known in advance, because deciding them in the room wastes the opening of the session and usually ends with the facilitator trying to do both.
  6. Protect the follow-up time. Book a short slot in the days after for the facilitator to write up the observations while they are fresh.

Choosing a scenario in plain terms

Keep the scenario short, plain and non-technical. The scenario is a starting condition, not a puzzle, and it should fit in one or two sentences.

Useful starting conditions are deliberately simple. A system people depend on is unavailable, and nobody can say when it will be back. A building cannot be entered today. A key person is unreachable for the week. An outside party you rely on has told you they cannot deliver. A set of records cannot be opened.

Notice that none of those describe a cause. Causes pull the room into speculation and into technical detail, and neither is what you came for. “The records for this process cannot be opened” produces a better conversation than any explanation of why.

Pick one process from your priority list and build the scenario around that. One process per session keeps the discussion concrete.

You can introduce one complication partway through, such as the person who would normally handle a step being unavailable, to see whether the alternate arrangements written in the runbook hold up. One complication is enough. Stacking them turns the session into a game.

Who is in the room

Keep the group small enough that everyone speaks. The people who matter are the ones who would actually act.

RoleWho it isWhat they do in the session
FacilitatorSomeone not responsible for the processPresents the scenario, keeps time, asks the next question
Note-takerAnyone other than the facilitatorWrites observations as they happen, without editing
Process ownerThe named owner from the runbookWalks through what they would do, using the document
PerformersThe people who do the work day to daySay where the written steps do not match reality
Decision-makerWhoever can commit money or authorityAnswers the decisions the scenario raises
ObserverOptional, someone from an unrelated areaAsks the obvious questions insiders skip

The facilitator should not be the person who wrote the documents. An author facilitating will fill gaps from memory without noticing, which is exactly the thing the exercise exists to detect.

Deliberately leave someone out. Running a session without the person who normally handles a process is the fastest way to find out whether anyone else can follow the page.

Capturing observations and writing up the follow-up list

The session has two outputs, and they are produced at different moments. The raw observations are captured live, in the room. The follow-up list is written afterward, from those observations.

How observations get captured

The note-taker writes what happens, not what should have happened. Short, factual entries beat polished prose.

Capture four kinds of thing. Moments where someone could not find a document or a detail. Moments where two people disagreed about who owns something. Steps in a runbook that turned out to be wrong, missing or out of order. Questions the room could not answer.

Write each one with enough context to be understood a week later, and attach the name of the person who raised it. Do not stop the discussion to tidy an entry, and do not let the note-taker become a participant, because the notes are the only durable output of the session.

Timestamping entries roughly is worth the effort. Knowing that the room spent most of the session on one step tells you where the documentation is thinnest.

At the end, spend the last few minutes reading the raw observations back to the room. People correct them immediately, and they will not correct them later.

The written follow-up list

The exercise is not finished when the meeting ends. It is finished when the list exists.

Within a few days, the facilitator turns the raw notes into a numbered list. Each item names what was observed, what document it affects, one named owner, and a date the owner has agreed to. Items without an owner and a date do not get done, and an exercise that produces no completed items teaches the room that the session was theatre.

Keep the list short by merging duplicates and by resisting the urge to add improvements nobody raised. Five real items that get closed are worth more than twenty aspirational ones.

Record the exercise itself alongside the list: the date, the scenario in one sentence, who attended, and what the follow-up items were. That record is what shows the practice is real, and it is the starting point for the next session, which should begin by reviewing whether the last list was closed.

Then schedule the next one before everyone leaves the room. A cadence your organization chooses and writes down turns this from an event into a routine, and the second session is always more productive than the first because the documents have improved in between.

Mistakes that waste a continuity exercise

Letting it become technical. The moment the room starts solving a technical problem, the documentation conversation stops.

Only inviting the people who know. The session exists to test the documents on people who do not.

Skipping the note-taker. A session nobody wrote down produces a good feeling and nothing else.

No owners on the follow-up list. Observations without owners are a list of complaints.

Running it once. A single exercise tells you about one process on one day.

For a facilitator script, an observation sheet and a follow-up list template, see the Free Resources page on this site.

Editorial & AI Disclosure