# How often should you test DR and business continuity plans? > At least once a year, and again after any major disruption or change. Here is where that yearly minimum comes from, which test to run, and how to run a disaster recovery or continuity exercise step by step. - Published: 2026-10-26 - Topic: [Backup & Recovery](https://futuretechnologyhq.com/topic/backup-recovery/) - URL: https://futuretechnologyhq.com/article/how-often-test-disaster-recovery-plan/ - Publisher: [Future Technology](https://futuretechnologyhq.com/), free to read. Quote as "Future Technology" with a link to the article. ## Key points - Test disaster recovery and business continuity plans at least once a year and after any major disruption, as the Business Continuity Institute advises - Some rules set the yearly minimum outright: the NHS Data Security and Protection Toolkit and PCI DSS requirement 12.10.2 both require at least an annual test - Choose the test to fit the objective: a drill, a table-top discussion or a live-play exercise - Start with the most critical parts of the business, and have a written plan before you exercise it - The NCSC's free Exercise in a Box gives small organisations ready-made exercises, including ransomware ## Article Test your disaster recovery and business continuity plans at least once a year, and again after any major disruption. That is the minimum the Business Continuity Institute (BCI) advises, and some frameworks, such as the NHS Data Security and Protection Toolkit and PCI DSS, write the yearly test into their rules. The rest of this guide covers where that minimum comes from, which kind of test to run, and how to run one. ## How often should DR and continuity plans be tested? The BCI says organisations should, at least, test their plans annually or after major disruptions, with the precise schedule depending on the organisation and its risk levels. It also says the habit of writing a plan and then ignoring it remains strong. Two frameworks set the same yearly floor in their rules: - **NHS Data Security and Protection Toolkit.** The NHS Digital guide says a continuity plan for threats to data security should be tested once a year as a minimum, with a report to senior management, and that a business continuity exercise is run every year as a minimum. - **PCI DSS.** Requirement 12.10.2 says the incident response plan must be tested at least annually, and assessors check documentation from previous testing to confirm it. Treat once a year as the floor. The NCSC suggests using a risk analysis to find the most critical parts of the business and exercising those first, and getting approval for a programme of exercises rather than one at a time. ## Which type of test should you run? The BCI says too many organisations fall into the trap of running generic exercises, and points to the ISO/DIS 22398 standard, which advises a needs and gap analysis to decide what kind of exercise you actually need. The NCSC says there are broadly two types of exercise, and that your objectives may sometimes be better met through a standard drill. The options are: - **Drills.** A standard drill may meet your objectives without a full exercise. - **Table-top exercises.** Group discussions designed to identify your responses to an unfolding cyber incident. - **Live-play exercises.** NCSC-assured providers can help organisations create structured table-top or live-play cyber incident exercises. The NCSC notes that exercising can be resource intensive, so pick the type that best meets your objectives. ## How to test a disaster recovery plan, step by step This sequence follows the NCSC's guidance on creating cyber incident exercises and the BCI's advice on running them. 1. **Have a plan first.** The NCSC says you should not use exercising to create your response plans: they should be in place already, or you have nothing to test. If you do not have one yet, use workshops and consultations to write it. 2. **Set objectives.** Clear objectives from the start keep the exercise focused. Start with the most critical parts of the business. 3. **Get senior backing.** Management will want to know why you are running the exercise, so link it clearly to business and operational risks. 4. **Build a small team.** A temporary team from across the business, however small, brings a wider range of expertise. 5. **Invite the right people.** Include the right job functions and seniority, and any external stakeholders such as contractors and third parties you would call on in a real incident. 6. **Decide how you will measure it.** Define the expected actions at each stage, so you can see what worked and what needs development. The NCSC warns that poorly focused metrics lead to false lessons. 7. **Write the scenario and injects.** Create a storyline and the updates participants will receive during the exercise, and make them realistic. 8. **Brief participants.** Send guidance and the exercise rules a few days ahead. 9. **Run through, then run it.** The BCI suggests a run-through first so participants can perform as planned, and notes that some organisations begin with a start-up briefing to avoid confusion between the simulated and actual event. 10. **Debrief and write it up.** The BCI recommends a post-exercise briefing and an after-action report that sets out successes, issues and remediation actions. The NCSC says to record all key observations, including what did not work so well. ## Do not forget the restore A continuity exercise tests people and decisions. It does not prove your backups restore. Our [3-2-1 backup rule guide](/article/3-2-1-backup-rule-how-to/) covers restore testing and keeping a copy that ransomware cannot reach. ## Free help for small organisations The NCSC's Exercise in a Box is a free online resource that helps organisations test and practise their response to a cyber attack. It has exercises on ransomware, phishing, supply chain, risk management, passwords and vulnerabilities, including table-top group discussion exercises, and you can run them in your own time as many times as necessary. The NCSC says it is used by small and medium-sized enterprises, local government and the emergency services. For larger or bespoke exercises, the NCSC keeps a list of organisations assured to provide exercising services through its Cyber Incident Exercising scheme. ## What the board should see The NCSC's Board Toolkit says exercising your incident response procedures is as important as practising fire drills, and that exercises are a far better way to make sure people know what to do than reading documents. It says the board should expect to see reporting on the exercise and the lessons learned, and, separately, that the incident response plan should be regularly reviewed and maintained as roles and structure change. If ransomware is your main scenario, our guide on [whether to pay a ransomware demand](/article/should-you-pay-ransomware-uk/) covers the decisions your exercise should rehearse. ## Frequently asked questions ### How often should a disaster recovery plan be tested? At least once a year, and after any major disruption. The Business Continuity Institute says organisations should test their plans at least annually or after major disruptions, with the exact schedule depending on the organisation and its risk levels. ### Is annual business continuity testing a legal requirement in the UK? Not for every organisation, but some frameworks require it. The NHS Data Security and Protection Toolkit says a continuity plan should be tested once a year as a minimum, and PCI DSS requirement 12.10.2 says the incident response plan must be tested at least annually. ### What types of disaster recovery test are there? The NCSC describes table-top exercises, where a group discusses its response to an unfolding incident, live-play exercises, and simpler drills. Choose the type that best meets your objectives. ### Where can a small business get a free continuity exercise? The NCSC's Exercise in a Box is a free online resource with exercises on threats such as ransomware, phishing and supply chain attacks, which you can run in your own time as many times as necessary. ### Should the board be involved in testing? The NCSC compares exercising incident response to practising fire drills and says the board should expect to see reporting on the exercise and the lessons learned. ## Sources - [7 steps to a best-practice exercise management programme](https://thebci.org/news/7-steps-to-developing-a-best-practice-exercise-management-program.html) - [DSPT guide 7: continuity planning](https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/data-security-and-protection-toolkit-assessment-guides/guide-7-continuity-planning) - [PCI requirement 12.10.2](https://kirkpatrickprice.com/video/pci/pci-demystified/pci-requirement-12-10-2-review-test-plan-least-annually/) - [Effective steps to cyber exercise creation](https://www.ncsc.gov.uk/guidance/effective-steps-to-cyber-exercise-creation) - [Exercise in a Box](https://www.ncsc.gov.uk/information/exercise-in-a-box) - [Planning your response to cyber incidents](https://www.ncsc.gov.uk/collection/board-toolkit/planning-your-response-to-cyber-incidents)