AE/SCNS/NCEMA 7000 training course: six modules online, working artefacts, a verifiable certificate

Course programme, module by module

Each module ends with a working document you build for your own organisation, so by the end of the course the evidence file an assessor asks for already exists.

1. Resilience governance and the board — disruption risk appetite, committee architecture, delegated authority, three lines of defence. Artefact: a resilience governance policy and governance map.
2. From enterprise risk management to business resilience — the risk register, key risk indicators, scenario analysis, linking risk management to continuity. Artefact: a resilience risk register with KRIs.
3. Impact analysis and the economics of recovery — business impact analysis, maximum acceptable outage, minimum business continuity objective, RTO and RPO, impact tolerance, the cost of downtime. Artefact: a completed BIA with defended targets.
4. Crisis management and decision making — the crisis team, escalation, communications, decisions under pressure, the exercise programme and its reports. Artefact: a crisis response plan and an exercise scenario.
5. AE/SCNS/NCEMA 7000 and the regulatory layer — the standard in depth and its mapping to ISO 22301; CBUAE operational resilience, DORA and the UK regime for context; what government contracts expect from suppliers. Artefact: an organisation mapping matrix against NCEMA 7000 and ISO 22301.
6. Assurance, reporting and maturity — the resilience dashboard, the board report, audit readiness, the maturity model. Artefact: a dashboard and a board report template.

Capstone: a board-level resilience report on your own organisation, defended before the examiner. Below, for those choosing between providers, is what any NCEMA 7000 course has to contain to be worth the fee.

Competence is a clause, not a courtesy

Organisations usually discover their training gap in the same place. AE/SCNS/NCEMA 7000:2021 requires the organisation to determine what competence the people running continuity need, to make sure they have it, and to keep documented evidence that it exists; the clause structure behind that requirement is set out on our page about the standard itself. The plans are there, the recovery targets look defensible, and then the question lands: who wrote them, what were those people trained on, and where is the record? Nobody can produce a syllabus, a date or a result. A missing training line does not sink an assessment on its own, but it weakens every other answer, because a management system nobody was taught to run is a document set with ambitions. That is why NCEMA 7000 training is bought as evidence, not as an event.

Three audiences, three depths

Buying one course for everybody is the most reliable way to waste a training budget: three populations need three different products. Awareness — everyone named in a plan or a call tree: 60 to 90 minutes, once a year, with three objectives only, recognise the trigger, know who is authorised to declare, know where the current plan lives. Practitioner — the continuity lead, process owners, IT recovery, department coordinators: 16 to 24 contact hours spread across three to six weeks, because the work done between the sessions is the course. Executive — the board, the executive committee, the audit committee: two to three hours, aimed at approving an appetite for disruption, understanding what the maximum tolerable period of disruption actually costs, and asking the three questions that change a plan. A fourth group is growing quickly: supplier teams assembling continuity evidence for government tenders, who need the practitioner track compressed and pointed at the evidence pack.

What a course has to contain to be worth the week

A syllabus is easy to judge once you know what has to be in it. Six components separate a working course from a reading of the standard.

• The standard applied, not recited. A clause-by-clause walk-through is reference material and belongs in a handout — our clause checklist covers that side. Classroom time should go on how a clause becomes a decision.
• A business impact analysis on the participant's own activities. Not a case study about a fictional airline: their processes, their dependencies, their cost of a lost day.
• Recovery economics. Recovery time objectives and the minimum service the business can survive on, justified in money — not numbers chosen because they sound ambitious.
• Response structure and the first hour. Who declares, what authority they hold before the crisis team convenes, and what happens when the two named people are on the same flight.
• Exercise design and the report that follows it. The exercise report is usually the first document an assessor opens, and the one most courses never teach anyone to write.
• An assessment with a threshold. A test that can be failed, plus a piece of the participant's own work reviewed by a human being, is what converts attendance into evidence.

Telling a working course from a formal one

Five questions, asked before the purchase order, sort providers quickly.

1. Show me the artefact list. If nothing leaves the room except slides, nothing was produced that an assessor can look at.
2. Who teaches it, and what have they built? Ask for the last three continuity systems the trainer implemented, and whether they have sat on either side of an assessment interview.
3. What is the pass mark? And what happens to a participant who misses it — a resit, or a certificate anyway?
4. Is the material available in Arabic? Where plans are executed in Arabic and the training was English-only, the gap shows up during the incident rather than during the exam.
5. What happens after the last session? A review of the participant's own draft plan four to six weeks later is worth more than an additional day of teaching.

Three claims deserve open scepticism. A one-day "certification" — competence in a management system cannot be assessed in six hours. A certificate issued before any work has been submitted. And any suggestion that a commercial course is accredited by the authority: NCEMA publishes the standard free of charge and its compliance programmes look at organisations, not at course vendors, so verify such a claim at source before it enters your evidence file.

From training to proven competence, and how long it takes

Set the clock honestly. Awareness costs about an hour and a half per person per year. A practitioner needs 16 to 24 contact hours, plus 20 to 30 hours of their own work to produce artefacts that survive review, plus the assessment itself — six to ten weeks of elapsed time for one person doing this alongside a full job. Compare that with the organisation's own timeline, where a mid-size company runs three to six months from gap assessment to audit-ready. The two schedules only work together if the training runs ahead of the implementation, otherwise the impact analysis gets done twice and the first version was the expensive one. This is the sequence the ERGP programme was built around — six modules, an artefact at the end of each, and a capstone defended before an examiner, in Arabic as well as English. Whichever route you take, insist on the same shape: teach, apply, produce, assess, record.

What should be in your hands when it ends

• A business impact analysis for your own scope, with the process owners' names against it.
• Recovery targets with the arithmetic visible, not only the numbers themselves.
• A plan skeleton that names people and deputies rather than departments.
• One exercise scenario and the report template that goes with it.
• A competence record — name, role, syllabus, date, assessor, result — filed where the management system keeps its documented information, so that internal audit finds it without asking twice.
• A retraining trigger with a date on it: annually, and on any change of role, plan or site.

If the only thing left after the course is a PDF with a decorative border, the organisation bought attendance. The next audit will ask for competence — a different purchase.

NCEMA 7000 courses at a glance

Frequently asked questions