---
title: "Exit Exercise: test your exit plan in practice | Codekeeper"
description: Codekeeper specialists rebuild your software from the deposit alone, restore the data, deploy it, test each function, and record every gap in a report.
canonical_url: https://codekeeper.co/exit-exercise
---

# Exit Exercise. Your exit plan, _tested in practice._

Our specialists recover your software from the deposit alone, without the vendor or the original developers, bring the data back, deploy it, and test the business functions you nominate. You get an Exit Exercise Report and Certificate for your file.

Request a scoping call See an example report

**An add-on to any Codekeeper plan, from $12,000.** Quoted at scoping. The customer or the vendor can request one.

  * 10+ years securing software
  * ISO/IEC 27001:2022 certified

![A bank's operational resilience team reviews its exit plan in the boardroom](https://codekeeper.co/hubfs/codekeeper-site/images/scenes/verification-1200.webp)

![The sample evidence pack for an example Exit Exercise: the Exit Exercise Certificate, the Exit Exercise Report, a summary, and pricing](https://codekeeper.co/hubfs/codekeeper-site/images/papers/exit-exercise-evidence-pack.webp)

Trusted by 3 500+ teams in over 150 countries, from regulated enterprises to fast-growing software vendors

![Airbus](https://codekeeper.co/hubfs/codekeeper-site/logos/customers/airbus.svg) ![Bayer](https://codekeeper.co/hubfs/codekeeper-site/logos/customers/bayer.svg) ![European Parliament](https://codekeeper.co/hubfs/codekeeper-site/logos/customers/eu-parliament-dark.svg) ![General Motors](https://codekeeper.co/hubfs/codekeeper-site/logos/customers/general-motors.svg) ![Intuit](https://codekeeper.co/hubfs/codekeeper-site/logos/customers/intuit.svg) ![Nestlé](https://codekeeper.co/hubfs/codekeeper-site/logos/customers/nestle.svg) ![PepsiCo](https://codekeeper.co/hubfs/codekeeper-site/logos/customers/pepsico.svg) ![Pfizer](https://codekeeper.co/hubfs/codekeeper-site/logos/customers/pfizer.svg)

Why an Exit Exercise

## Without the vendor. _Without the original developers._

An exit plan only holds if it works without the people you'd lose. An Exit Exercise puts that to the test: our specialists work from the deposit alone and check each business function you nominate.

Left out on purpose

  * The vendor's engineersNot used
  * The original developersNot used
  * Know-how that was never written downNot used

What the exercise uses

  * The depositThe only source
  * Your data, brought backRestored
  * Codekeeper specialistsRun the exercise

Claims Portal · deployed as scoped

Each business function you nominated, tested

4 of 4 functions passedExit Exercise Certificate

Example application. Names and values are illustrative.

Why test the exit

## Written isn't the same as tested.

An exit plan says what you'd do if a critical supplier failed. Until someone tries it, every step in it is an assumption. Regulators now expect exit plans to be tested, and an Exit Exercise tests yours in practice.

EUDORA · Article 28(8)

> "Exit plans shall be comprehensive, documented and, in accordance with the criteria set out in Article 4(2), shall be sufficiently tested and reviewed periodically."

Regulation (EU) 2022/2554, [Article 28(8)](https://eur-lex.europa.eu/eli/reg/2022/2554/oj) . Applies to ICT services supporting critical or important functions.

**For your file**An Exit Exercise Report with an annex mapped to Article 28(8). [DORA and Codekeeper](https://codekeeper.co/solutions/dora)

UKPRA SS2/21 · Paragraph 10.24

> "Firms should take reasonable steps to test exit plans; in particular, those relating to stressed exits."

PRA Supervisory Statement SS2/21, [Outsourcing and third party risk management](https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/outsourcing-and-third-party-risk-management-ss) , paragraph 10.24.

**For your file**An Exit Exercise Report with a framework annex, from an exit tested as if your vendor were gone. [PRA SS2/21 and Codekeeper](https://codekeeper.co/solutions/pra-ss221)

The same evidence is also used for exit plans under [AUCPS 230 Australia](https://codekeeper.co/solutions/cps230) [EUESMA cloud outsourcing guidelines](https://codekeeper.co/solutions/esma)

An Exit Exercise gives you evidence that your exit plan has been tested. It doesn't make you compliant on its own: whether it meets a specific requirement is for you and your assessor to decide.

What we test

## Rebuilt from your deposit, then put to work.

An Exit Exercise goes further than proving the software builds. Every step your exit plan takes for granted is tried for real, and the result is written down.

| Area | What the plan says | What the Exit Exercise does |
| --- | --- | --- |
| The software | "We'd rebuild it from the escrow deposit." | Rebuilt using only what's in the deposit. Anything missing is recorded as a gap. |
| The people | "We wouldn't need the vendor." | Done by Codekeeper specialists, without the vendor or the people who wrote the software. |
| The data | "Our data comes back with it." | The data is brought back alongside the software, because without it your teams can't keep working. |
| The deployment | "We'd have it running for our users." | Deployed and running the way you'd need it in a real exit, sized for your application at scoping. |
| The business | "The business would keep working." | Each function you nominate is tested and recorded as pass or fail. |
| The gaps | Not known until the day you need it. | Every gap is written down, so the vendor can close it before a real exit. |

How it works

## From scoping call to report on file.

  1. 1
    ### Scope Both parties and Codekeeper
    Tell us about the application, its data, and how it runs today. We confirm your technology stack is supported, agree with both parties on which functions to test and what the exercise needs to prove, and set the timeline.
  2. 2
    ### Groundwork Codekeeper's AI agents
    The agents study the deposit and work out how the software is built, in hours.
  3. 3
    ### Clean-room rebuild Codekeeper specialists
    Our specialists rebuild the software by hand in a clean room, using only what was deposited.
  4. 4
    ### Data and deployment Codekeeper specialists
    They bring back the data and deploy the software the way you'd need it in a real exit.
  5. 5
    ### Function tests Codekeeper specialists
    Each function you nominated is tested and marked pass or fail. Anything that stops the software from working is recorded as a gap.
  6. 6
    ### Report and certificate For your file
    You receive the Exit Exercise Report and the Exit Exercise Certificate: the result, the gaps, and the date, with an annex mapped to your framework.

0:00 / 1:35

**Exit Exercise**Your exit plan, tested in practice1:35

The Exit Exercise film, 1 min 35 s. Captions show while the sound is off.

**The original developers aren't involved at any step.**In a real exit, they might not be there. The exercise is run the same way, so the result shows what your own plan can rely on.

**On a Pro plan? Go in knowing it builds.**Agentic Verification rebuilds your deposit up to four times a year, on supported technology stacks, in Escrow Pro, Resilience Pro, and Continuity Pro. Run one before the exercise.
[How Agentic Verification works →](https://codekeeper.co/agentic-verification)

Request an Exit Exercise

## Start with a scoping call.

Tell us about the application and the framework you report against. We'll agree with you on what the exercise needs to prove, which functions to test, and the timeline.

**If you rely on the software**Show your board, your auditors, or your regulator that your exit plan has been exercised, not just written down.

**If you supply it**Answer a regulated customer's questions about your software in their exit plan with evidence, not assurances.

Rather talk it through first? [Book a demo](https://codekeeper.co/book-a-demo)

### Request a scoping call

We'll use these details to arrange your scoping call.

### Request received.

We'll be in touch to arrange your scoping call.

What you put on file

## The result, every gap, and the date.

Each Exit Exercise ends with an Exit Exercise Report and an Exit Exercise Certificate, plus an SBOM of the software as it was rebuilt.

![An example Exit Exercise Report for a fictional application: the result and the date, how the exercise was run, each function tested as pass or fail, every gap, and the framework annex](https://codekeeper.co/hubfs/codekeeper-site/images/papers/exit-exercise-report-paper.webp)

Example report with fictional values. Contents vary by application.

  * ### The result and the date
    One answer up front, dated, so a reviewer can see when your exit plan was last exercised.
  * ### How it was run
    What the specialists started from and who did the work, so nobody has to take the method on trust.
  * ### Pass or fail, function by function
    Every function you nominated at scoping, each with its own result.
  * ### Every gap
    What was missing or stopped the software from working, so the vendor can fix it and you can run the exercise again.
  * ### An annex for your framework
    The results mapped to the framework you report against, such as DORA Article 28(8), PRA SS2/21, or CPS 230.

![Example Exit Exercise Certificate for a fictional application with example values: result passed, recovery time, exercise details, and each stage with its result](https://codekeeper.co/hubfs/codekeeper-site/images/papers/exit-exercise-certificate-paper.webp)

Example certificate with fictional values.

### Also in your file

### Exit Exercise Certificate

A dated record of the exercise and its result, to keep next to your exit plan.

### SBOM of the rebuilt software

A software bill of materials for the software as the specialists rebuilt it, also used for Cyber Resilience Act requests.

Pricing

## Add it to any plan.

The Exit Exercise is an add-on, so you don't need to change plans to get one.

Add-on

### Exit Exercise

From **$12,000** Quoted at scoping

The customer or the vendor can request one.

Request a scoping call

| Plan | From | Agentic Verification | Exit Exercise |
| --- | --- | --- | --- |
| Escrow | $199 | Not included | Add-on |
| Escrow Pro | $449 | Included | Add-on |
| Resilience | $399 | Not included | Add-on |
| Resilience Pro | $649 | Included | Add-on |
| Continuity | $1,449 | Not included | Add-on |
| Continuity Pro | $1,699 | Included | Add-on |

Starting prices are for software applications. Agentic Verification runs up to four times a year, on supported technology stacks. [See all prices](https://codekeeper.co/pricing)

Frequently asked questions

## Before you book the scoping call.

Timing, independence, the evidence, and how it fits your plan.

[More answers in the FAQ →](https://codekeeper.co/faq)

### The exercise

How long does an Exit Exercise take?

An Exit Exercise takes as long as the application and its data need. We agree on the timeline with you at scoping, before any work starts. If you have an audit or review date, tell us when you request the exercise and we'll plan around it.

Are the original developers involved?

No, the original developers aren't involved at any point. Codekeeper specialists rebuild and test the software from what was deposited, without the people who wrote it, as a real exit might require.

Which technology stacks can you rebuild?

We confirm which technology stacks we can rebuild for your application at scoping. Tell us what the application is built with when you request the exercise.

Is an Exit Exercise a recovery?

No, an Exit Exercise isn't a recovery. It tests your exit plan; it doesn't release the deposit or keep anything running. If a release condition is ever met, your plan handles the recovery. With Escrow, the deposit is released to you, and your team runs the recovery. With Resilience, the deposit comes to Codekeeper, and Codekeeper's engineers run it. Continuity also keeps the live environment paid and switched on for an agreed period, bills recharged at cost.

### The evidence

What's in the Exit Exercise Report?

The Exit Exercise Report contains the result of the exercise, a pass or fail for each function tested, every gap found, and the date. It comes with an Exit Exercise Certificate, an SBOM of the rebuilt software, and an annex mapping the results to the framework you report against, such as DORA Article 28(8), PRA SS2/21, or CPS 230.

What happens if the Exit Exercise fails?

If the Exit Exercise fails, you still receive the full report, showing what stopped the software from working and why. Every gap is recorded so the software vendor can fix it, and you can run the exercise again once the gaps are closed.

Does an Exit Exercise make us compliant?

An Exit Exercise doesn't make you compliant on its own. It gives you a dated record that your exit plan has been tested, which you can use as evidence toward DORA Article 28(8) and PRA SS2/21. Whether it meets a specific requirement is for you and your assessor to decide.

### Plans and pricing

Who can request an Exit Exercise?

The customer who relies on the software or the vendor who supplies it can request an Exit Exercise.

Do we need a Pro plan?

No, you don't need a Pro plan to add an Exit Exercise. You can add one to any Codekeeper plan, from Escrow through to Continuity Pro.

How is an Exit Exercise priced?

Each Exit Exercise is quoted at scoping, from $12,000. It's an add-on, so your plan stays as it is.

How is it different from Agentic Verification?

An Exit Exercise and Agentic Verification test different things. Agentic Verification shows the deposit builds: Codekeeper's AI agents rebuild it in the sealed Codekeeper AI Verification Lab, up to four times a year on Pro plans, on supported technology stacks. An Exit Exercise shows the whole exit works: our specialists rebuild the software by hand, bring back the data, deploy it, and test each function you nominate. See [how Agentic Verification works](https://codekeeper.co/agentic-verification) , or [compare them side by side](https://codekeeper.co/verification.html#compare) .

## Your exit plan, _tested in practice._

Our specialists recover your software from the deposit alone, without the vendor or the original developers, bring the data back, deploy it, and test the business functions you nominate.

Request a scoping callGet the sample evidence pack