A BCM plan should be reviewed and updated regularly, at least annually or whenever significant changes occur in the organisation or its environment. This ensures that the plan remains relevant and effective in mitigating the impact of cyberattacks and other disruptive events.