FRAMEWORK GUIDES
The regulations and standards that mandate exercise testing, explained in plain language, with the exercise obligation each one creates.
Last verified: September 2026
What the CMS Emergency Preparedness Rule requires for testing exercises — who it covers, the inpatient and outpatient cadences, what surveyors ask for, and where the rule is deliberately silent.
CMS Emergency Preparedness
Read the guide →Last verified: September 2026
DORA's digital operational resilience testing obligations, article by article — the yearly floor in Article 24, what Article 25 actually lists, and why Article 26 is not the scenario-testing article it is usually cited as.
DORA
Read the guide →Last verified: September 2026
What ISO 22301's exercise clause asks of a business continuity management system — who it binds, what Clause 8.5 covers in substance, why it sets no frequency, why no source names an exercise type, and what a certification audit looks at.
ISO 22301
Read the guide →Last verified: September 2026
What ISO/IEC 27001 asks of an exercise program, and what it doesn't. Why it is an information security management standard rather than an exercise mandate, the one conditional testing control in Annex A, the evaluation and improvement duties every ISMS carries, and why exercising still earns its place.
ISO 27001
Read the guide →Last verified: September 2026
What NERC CIP-008 asks of incident response testing, in the standard's own words. A mandatory test at least once every 15 calendar months, not annually; three acceptable methods, a tabletop exercise among them; which systems are in scope; what has to follow every test; why reporting is a separate duty; and where realistic exercises earn their place.
NERC CIP
Read the guide →Last verified: September 2026
The FFIEC's business continuity exercise and testing expectations, from the booklet and the examination work program — who they reach, why "should" is not "must", why there is no FFIEC interval, and what a tabletop can and cannot prove.
FFIEC
Read the guide →READINESS STARTS BEFORE THE CRISIS.
Build your first scenario and turn preparation into measurable progress.