I know of a few departments that have done it. Frequently when we talk about plans, people say, “Well, you have plans, but what does it mean?” I've brought in the scenario that we prepared. We've put it on a website internal to the government and we've offered it to all departments that want to try it. We know that 40% of the departments that have critical services have done one exercise, and others are planning to do it. This can be as simple as taking about three hours, if you want to do it well; or if you want to do it quickly, you take two hours.
We have this scenario that we've provided to everybody. It is something they can tailor to their own business continuity component, what they want to exercise. Then they sit down and bring in the appropriate officials, and as we bring in the injects, whoops, all of a sudden the dynamic in the room changes and people say, “Oh, I need that from you. You would do this, and no, I wouldn't do this; and he would do this.” That's what happens. About 40% of the departments that have critical services have undertaken an exercise.
In my department, we've done one. We've identified some weaknesses. We will be doing another one in three weeks.