A Business Continuity Plan should be tested:

A.
Once a month.

B.
At least twice a year.

C.
At least once a year.

D.
At least once every two years.

Explanation:
Once a continuity plan is developed, it actually has to be put into action. The people who are assigned specific
tasks need to be taught and informed how to fulfill those tasks, and dry runs must be done to walk people
through different situations. The drills should take place at least once a year, and the entire program should be
continually updated and improved.
Incorrect Answers:
A: Once a month would be too much. The Business Continuity Plan should be tested at least once a year.
B: The Business Continuity Plan should be tested at least once a year. Twice a year is not necessary.
D: The Business Continuity Plan should be tested at least once a year. Once every two years is not
recommended.

Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, 2013, p. 951