This document discusses the importance of testing security and business continuity plans through exercises and drills. It provides reasons for testing such as determining the soundness of policies, enhancing compliance, and assessing readiness. The document outlines dimensions of testing like prevention, detection, and response. It also gives examples of planning tests for IT security and a physical disaster. After tests are conducted, the document recommends reviewing results, discussing observations, documenting issues, and updating plans.

1. Keeping Score on Testing Marjorie Windelberg, Ph.D. SecureIT Conference March 2006 Copyright Marjorie Windelberg 2006. This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the authors. To disseminate otherwise or to republish requires written permission from the author.

14. Example 1: IT Security

15. Example 1: IT Security

16. Example 1: IT Security

17. Example 2: Physical Disaster

18. Example 2: Physical Disaster

19. Example 2: Physical Disaster

21. Example 1: IT Security

22. Example 2: Physical Disaster

24. Example 1: IT Security

25. Example 2: Physical Disaster