When would an organization review a Business Continuity Management (BCM) system?

A Business Continuity Management (BCM) system is a set of policies, procedures, and plans that aim to ensure the continuity of critical business functions in the event of a disruption or disaster. A BCM system should be reviewed at planned intervals, such as annually or biannually, to ensure its effectiveness, suitability, and alignment with the organization’s objectives and needs. Reviewing the BCM system at planned intervals also helps to identify any gaps, weaknesses, or changes that need to be addressed. Reviewing the BCM system only when major changes occur on systems, when personnel changes occur, or before and after Disaster Recovery (DR) tests is not sufficient or consistent enough to maintain a reliable and up-to-date BCM system. References: CISSP Official (ISC)2 Practice Tests, Third Edition, Domain 7: Security Operations, Question 7.8, page 272; CISSP All-in-One Exam Guide, Eighth Edition, Chapter 10: Business Continuity and Disaster Recovery Planning, page 635.