CxO™ DELIVERABLE
BCDR Planning & Tabletop Exercises
BCDR planning is the work of deciding what the business must recover, how fast, and how, then proving it works. DAG Tech's fractional CTO runs the business impact analysis, writes your business continuity and disaster recovery policy and runbook, and tests both with incident response tabletop exercises so gaps surface before a real outage does.
Custom proposal · Last updated October 2026
The Short Answer
What Is BCDR Planning?
BCDR planning (business continuity and disaster recovery planning) produces a policy that commits to recovery targets, a runbook that explains how to meet them, and exercises that prove both work. Most BCDR plans fail for the same reasons. IT set the recovery targets without asking the business. The runbook assumes normal conditions: the right people are reachable and the systems needed to recover are up. Backups were monitored but never restored. Nobody knows who can declare a disaster, so the first hour is lost to debate. And the plan was never exercised. The test of a real BCDR capability is simple: when did you last watch someone try to use the plan?
In a CxO engagement BCDR planning draws on an IT assessment for the system inventory and on the IT roadmap for backup and recovery standards. Your fractional CTO leads it with the people who own each business process, because they decide what downtime costs. Ransomware is the scenario most likely to trigger the plan, so the work is coordinated with whoever runs your security operations: your team, another provider or DAG Tech's X-SOC.
At a glance
SPEC SHEET- DELIVERABLE TYPE
- Policy, runbook and exercise program
- ALSO KNOWN AS
- Business continuity plan, disaster recovery plan, incident response tabletop exercise
- PRACTICE AREA
- Technology / Fractional CTO
- BEST FOR
- Organizations with untested plans, new compliance or insurance requirements, or recent incidents
- WHAT WE NEED
- System inventory, backup reports, process owners' time and any existing plans
- NEXT STEP
- Remediation of findings and an annual exercise schedule
Scope
What We Build and Test
We tie recovery targets to business impact, then write and test the procedures that meet them.
Business impact analysis
Process owners rank critical processes, estimate the cost of downtime and map the systems and suppliers each one depends on.
Recovery targets
An agreed recovery time objective (RTO) and recovery point objective (RPO) for every critical system.
BCDR policy
Scope covering outages, ransomware, site loss and supplier failure, plus roles, declaration authority, notification duties and testing commitments.
Recovery runbook
Procedures in execution order, written for degraded conditions, each with a responsible role and a verification step.
Backup and restore validation
Checks that backups cover what the targets require, are protected from tampering and have been restored successfully.
Out-of-band access
Credentials, contacts and documents stored somewhere that survives the incident.
Tabletop exercises
Scenario walkthroughs with real responders and leadership, with complications injected to test the plan.
Review cadence
A schedule for retesting, updating targets and recording the last test date and result for each system.
Also Included
Incident Response Tabletop Exercises
An incident response tabletop exercise is a facilitated, discussion-based walkthrough of a realistic incident with the people who would actually respond.
We build each scenario around your environment: ransomware that encrypts a file server and its backups, a compromised executive email account used for payment fraud, loss of a primary site, or failure of a key cloud or software supplier. Leadership, IT, legal, finance and communications work through decisions in real time as the facilitator adds complications, such as an unavailable step owner, a second affected site or a reporter calling for comment.
Every gap becomes a numbered finding with an owner and a due date. Where useful, a technical restore test runs alongside the discussion so the team sees actual recovery times against the targets in the policy. Regulations and contracts such as NYDFS Part 500, HIPAA and many cyber insurance applications expect incident response and recovery plans to be tested, and a documented tabletop is common evidence of that.
- Executive tabletop: Decision-focused session for leadership on disaster declaration, notification, ransom and communication choices.
- Technical tabletop: Step-by-step walkthrough of the runbook with IT staff and providers under degraded conditions.
- After-action report: Findings, owners, due dates and updates to the policy and runbook.
The Deliverable
What You Receive
- Business impact analysis with downtime cost and dependency map
- BCDR policy with agreed RTO and RPO per system and declaration authority
- Recovery runbook in execution order with roles and verification steps
- Tabletop exercise scenarios, facilitation and after-action report
- Numbered findings register with owners and due dates
- Sign-off page and annual review and testing schedule
How It Works
How It Runs
- STEP 01
Kickoff
We confirm scope, collect existing plans and backup reports, and identify process owners.
- STEP 02
Analyze Impact
We work with process owners to set recovery targets and map dependencies.
- STEP 03
Write and Exercise
We write the policy and runbook, then run tabletop exercises and restore tests against them.
- STEP 04
Readout
We present findings, get leadership sign-off and set the testing schedule.
When to Start
Signs You Need BCDR Planning
- Your disaster recovery plan has never been tested.
- Nobody is sure who can declare a disaster.
- Backups are monitored but rarely restored.
- Recovery targets were set by IT without input from the business.
- Your insurer, auditor or a client is asking for evidence of testing.
- You have never rehearsed a ransomware attack with leadership.
Compare
BCDR Planning vs. 24/7 SOC
| BCDR Planning & Tabletop Exercises | X-SOC 24/7 Managed SOC | |
|---|---|---|
| Question it answers | How do we keep operating and recover when something goes wrong? | How do we detect and contain threats as they happen? |
| Output | Policy, runbook, tested recovery targets and exercise findings | Continuous monitoring, alert triage and incident response |
| When | Before an incident, then retested on a schedule | Running all the time |
| Led by | Fractional CTO | Security operations analysts |
Related
Often Paired With
FAQ
BCDR Planning & Tabletop Exercises Questions
What is the difference between business continuity and disaster recovery?
Business continuity keeps critical processes running during a disruption, including manual workarounds. Disaster recovery restores the systems and data those processes depend on. A BCDR plan covers both so they work together.
What are RTO and RPO?
Recovery time objective (RTO) is how long a system can be down before the impact is unacceptable. Recovery point objective (RPO) is how much data, measured in time, you can afford to lose. Both are set by the business, not IT.
What is an incident response tabletop exercise?
It is a facilitated discussion where responders and leadership work through a realistic incident, such as ransomware, step by step. It tests decisions, roles and communication without touching production systems, and produces a list of gaps to fix.
How often should we run a tabletop exercise?
At least once a year, and after major changes such as a new core system, an acquisition or a real incident. Some regulations and insurers expect annual testing. Rotating scenarios keeps the exercise useful.
Can you run a tabletop if we already have a plan?
Yes. We can review your existing plan and run exercises against it, then update the policy and runbook based on the findings.
How much does BCDR planning cost?
It is scoped in hours at the CxO rate, based on the number of critical systems, sites and exercises. Your proposal shows the total before work starts.
Get Started
Request BCDR planning
Tell us what you need. We scope the hours and send a CxO proposal.
Sent with your request: CxO: vCTO: BCDR Planning & Tabletop Exercises
- 01A scoping call with a fractional executive
- 02Every task, deliverable, hour and cost in one proposal
- 03A roadmap with start date
The CxO™ Program
Explore Every Practice Area
About DAG Tech BCDR Planning & Tabletop Exercises
BCDR planning is the work of deciding what the business must recover, how fast, and how, then proving it works. DAG Tech’s fractional CTO runs the business impact analysis, writes your business continuity and disaster recovery policy and runbook, and tests both with incident response tabletop exercises so gaps surface before a real outage does.
BCDR planning (business continuity and disaster recovery planning) produces a policy that commits to recovery targets, a runbook that explains how to meet them, and exercises that prove both work. Most BCDR plans fail for the same reasons. IT set the recovery targets without asking the business. The runbook assumes normal conditions: the right people are reachable and the systems needed to recover are up. Backups were monitored but never restored. Nobody knows who can declare a disaster, so the first hour is lost to debate. And the plan was never exercised. The test of a real BCDR capability is simple: when did you last watch someone try to use the plan?