All ISCPs should be reviewed and tested at the organization defined frequency (e.g. yearly) or whenever there is a significant change to the system. Provide information and a schedule for the testing of the system. For low-impact systems, a yearly tabletop exercise is sufficient. The tabletop exercise should include all ISCP points of contact, and be conducted by an outside or impartial observer. A formal test plan is developed prior to the tabletop, and an exercise and questions are developed to include key sections of the ISCP, including a walk-through of the following:

• Notification procedures;
• System recovery on an alternate platform from backup media;
• Internal and external connectivity; and
• Reconstitution procedures. Results of the test are documented in an After Action Report, and Lessons Learned are developed for updating information in the ISCP.