What should an executive support continuity exercise prove?

Abstract

NIST contingency guidance treats a plan as something to train and exercise, not merely store [1]. Incident-response and cybersecurity frameworks also emphasize preparation, recovery, and improvement [2][6]. Executive support is not an information system, but its calendar, briefing, travel, approval, and communication dependencies can be tested with the same discipline.

Methodology

This synthesis applies ten NIST, CISA, GAO, and privacy sources to executive-office continuity [1][2][3][4][5][6][7][8][9][10]. Technical controls are translated by function: identity, authority, alternate access, communication, recovery, and learning. The analysis does not claim certification or impose a federal standard on a private office.

The hypothesis an exercise should test

State a service claim before choosing a scenario: an urgent calendar change reaches an authorized owner, the current briefing source can be found, or an open commitment transfers to accepted coverage. This turns the exercise into a testable proposition instead of a dramatic rehearsal.

Three scenarios with different failure modes

Assistant unavailability tests handoff and role knowledge. Device loss tests alternate access and secure communication. Revoked access tests whether backup coverage depends on the wrong identity. NIST distinguishes preparation, response, and recovery, so each scenario should have a start condition, evidence target, and safe stop [1][2].

Access is not authority

Zero-trust and security-control guidance separates identity, authentication, and authorization [3][4]. A backup who can open a calendar may still lack authority to move a board meeting or approve travel. The exercise should record what the backup may do, what needs escalation, and what should remain inaccessible.

A continuity scorecard

Measure handoff acceptance, time to locate the authoritative source, access success, unresolved commitments, escalation accuracy, and restoration time. Telework and CISA guidance supports secure alternate paths [5][7][8]. A failed assumption should become an owned correction with a retest date.

Safety boundary

Use tabletop, sandboxed, or otherwise controlled conditions. Do not interrupt live stakeholder communications, impersonate staff, or expose protected information for realism. GAO and NIST sources guide design but do not certify the resulting private continuity program [9][10].

Key findings

  • A continuity claim should be stated before the scenario is chosen.
  • Different scenarios isolate handoff, device, identity, and authority failures [1][2][3].
  • Being able to access a system does not confer decision authority [3][4].
  • Recovery measures should produce owned corrections and a retest.
  • Controlled exercises protect live stakeholders and sensitive information.

Sources

  1. Contingency Planning Guide for Federal Information Systems, National Institute of Standards and Technology
  2. Incident Response Recommendations and Considerations, National Institute of Standards and Technology
  3. Zero Trust Architecture, National Institute of Standards and Technology
  4. Security and Privacy Controls for Information Systems and Organizations, National Institute of Standards and Technology
  5. Guide to Enterprise Telework, Remote Access, and BYOD Security, National Institute of Standards and Technology
  6. Cybersecurity Framework 2.0, National Institute of Standards and Technology
  7. Cyber Guidance for Small Businesses, Cybersecurity and Infrastructure Security Agency
  8. Cybersecurity Performance Goals, Cybersecurity and Infrastructure Security Agency
  9. Standards for Internal Control in the Federal Government, U.S. Government Accountability Office
  10. Privacy Framework, National Institute of Standards and Technology

Return to the Research Content library