Which capability is LEAST likely to be included in the annual testing activities for Business Continuity or Disaster Recovery plans?

Annual Business Continuity (BC) and Disaster Recovery (DR) testing activities are designed to validate plans effectively while managing operational risk. While comprehensive tests are valuable, simulating a complete and unannounced destruction of a primary facility is an extreme, high-risk, and exceptionally costly exercise. Such a test carries a significant chance of causing an actual disruption to production services. More common and practical annual tests include planned failover exercises, component-level recovery tests, and tabletop scenarios, which validate preparedness with a manageable level of risk and resource expenditure.

A. Restoring critical systems from backups at an alternate site: This is a fundamental and common DR testing activity to ensure data and system recoverability.

B. Conducting a tabletop exercise with key stakeholders: This is a very common, low-cost, and effective annual method for testing communication and decision-making processes.

C. Verifying employee contact lists and communication trees: This is a basic, essential, and regularly performed maintenance task to ensure plan activation can succeed.

1. The Shared Assessments Program, "Standardized Information Gathering (SIG) Questionnaire," 2023. The Business Resiliency domain (Section F) asks for evidence of tests, including "full-scope, functional, and/or tabletop exercises," but does not prescribe unannounced, destructive simulations as a standard expectation.

2. National Institute of Standards and Technology (NIST), Special Publication 800-34 Rev. 1, "Contingency Planning Guide for Federal Information Systems," 2010. Section 5.3 describes a spectrum of testing types, noting that full-scale functional exercises are complex and should be conducted in a controlled manner. Unannounced, destructive tests are not listed as a standard practice.