This control is a subset of the Business Continuity control. It defines that, a Business Continuity Plan (BCP) must be tested and updated on a regular basis to ensure its effectiveness in the event of a disaster and its continuing relevance to the Business. The process should include the testing of data recovery, information asset management, leadership response and recovery procedures. A process to do a full simulation of these, at least once each year with different, realistic scenarios that test the effectiveness of IllumiDesk's Business Continuity plan should be the goal.