1. From theory to practice: The value of exercising, training and awareness in building resilience.
Gianluca Riglietti, CBCI
Research & Insight Manager, BCI 1

2. BCI Good Practice Guidelines Training Course Introduction Version 1.2
Today’s agenda
Introduction
Emergency communications preparedness
Supply chain preparedness
Trend analysis
Cyber preparedness
Key takeaways
The structure of this presentation follows the different issues addressed in the report.

3. Partner organizations
Over
8,000 members
Members in
124
countries
What is the BCI?
A global membership and certifying organization for business continuity and resilience professionals
Member-Owned, Not-for-Profit Professional Association
Established in 1994 in the United Kingdom
Chapters: Asia, Australia, Canada, Japan, Nordic, South Africa, Switzerland and United States
Over 8,000 members in more than 120 countries working in an estimated 3,000 organizations in private, public and third sectors
Our membership grades provide assurance of technical and professional competency 10
Chapters and over 50
local forums
150
Partner organizations

4. Exercising emergency communications plans
BCI Good Practice Guidelines Training Course Introduction Version 1.2
Exercising emergency communications plans
Two out of five respondents exercise their plans at least once a year (42%); this shows a slight drop
from last year (49% to 42%). On the other hand, 30% of the organizations claim to do so regularly, a
9% increase from last year. Further, 14% of the organizations either never exercise their plans or do
so on an ad hoc basis (Figure 13).

5. Exercising your plan Organizations exercising their plans
Organizations not exercising their plans
Organizations activating their emergency communications plans within one hour
90%
66%

6. Training and education programmes
BCI Good Practice Guidelines Training Course Introduction Version 1.2
Training and education programmes
Training and education programmes for emergency communications are central components of this
study. They play a key role in strengthening key skills needed to effectively implement plans during a
disruption. The vast majority of respondents (75%) include emergency communications plans in their
training and education programmes (Figure 11). However, only 57% of them report to have done so
regularly (Figure 12), showing an 8% decrease from last year (65% to 57%). This highlights the need to
maintain and raise awareness on emergency communications plans, which have the potential to save
lives as well as avoid losses for organizations.

7. Training and education
Organizations with training and education programmes
Organizations without training and education programmes
Organizations activating their emergency communications plans within one hour
91%
80%

8. Exercising in the supply chain
Organizations running exercises among their suppliers
Organizations not validating their suppliers’ plans in any way
Organizations not having full visibility of their supply chain disruptions
21%
38%

9. Top management buy in
Organizations running exercises among their suppliers
Organizations not validating their suppliers’ plans in any way
Organizations with high top management commitment
44%
24%

10. Longer term trend analysis
BCI Good Practice Guidelines Training Course Introduction Version 1.2
Longer term trend analysis
Nearly a quarter do not conduct longer term trend analysis (23%), even though most of respondents do.

11. Longer term trend analysis
BCI Good Practice Guidelines Training Course Introduction Version 1.2
Longer term trend analysis
The data shows how there is some lack of communication within organizations, as 29% do not have access to trend analysis.

12. BCI Good Practice Guidelines Training Course Introduction Version 1.2
Detection

13. BCI Good Practice Guidelines Training Course Introduction Version 1.2
Response

14. BCI Good Practice Guidelines Training Course Introduction Version 1.2
Cyber disruptions

15. Exercising your cyber detection plans
Organizations exercising their plans and conducting awareness-raising initiatives
Organizations not validating their plans
Organizations detecting a cyber incident within 24 hours
88%
77%

16. Exercising your cyber response plans
Organizations exercising their plans and conducting awareness-raising initiatives
Organizations not validating their plans
Organizations responding to a cyber incident within one hour
40%
23%

17. Business continuity arrangements
BCI Good Practice Guidelines Training Course Introduction Version 1.2
Business continuity arrangements

18. Case study: Tesco Bank

19. Key takeaways Preparedness is key to ensuring resilience
Training can help make staff familiar with the organization’s response plans
Exercising plays a vital role in embedding the plan
Trend analysis allows a better visibility of the threat landscape
Figures show the clear benefits of following best practice.

20. Thank you