A featured contribution from Leadership Perspectives, a curated forum for enterprise technology leaders, nominated by our subscribers and vetted by the CIOApplications Editorial Board.
and a top Veterans Administration (VA) and Federal Housing Administration (FHA) lender in the U.S.
The Importance of Testing Continuity Plans
Through this article, Nancy Valente emphasizes the critical importance of testing business continuity plans to ensure organizational resilience in the face of disruptions. Valente provides practical advice on what to test, the methods to use, and how to prepare for and follow up after tests. The article underscores the value of uncovering gaps in a controlled environment and offers guidance on building a robust testing program that evolves with organizational maturity.
You have finished creating your company’s recovery plans...now what? How do you know that the plans are robust, complete and viable during a crisis? By testing it, of course!
Testing is a process for evaluating how practicable your plans are, and overall, how well your company is prepared for disruptions to its business. There are generally two ways to gain this understanding – through testing, exercising, and responding to an actual disaster event. If you do not exercise your plans, it limits the organizations’ leaders’ knowledge of their ability to respond, recover and restore business in the event of a major disruption. The more mature an organization is in its exercise management practices, the greater its success in recovering from a disaster.
Test vs exercise
An exercise with key members to respond to a potential incident is a rehearsal of the response and necessary tasks for restoration. An exercise’s intended goal is to demonstrate and assess the staff’s Business Continuity Management (BCM) competence and capability related to the objectives and scope of the exercise. The intent of an exercise is to learn from the event to improve recovery plans.
A test is a stand-alone event or component of an exercise where the goal is to demonstrate the recovery of a business or IT resource in response to a disruption. Tests typically are pass or fail types of events rather than a full assessment of competencies and capabilities.
Benefits And Challenges Of Testing
It is better to uncover gaps in a controlled environment rather than during an actual crisis, although both will give you similar takeaways. Performance in an exercise offers crucial evidence to business and IT regarding the ability to recover in a crisis.
Benefits
● Identify gaps.
● Ensure that there are adequate resources to perform response and recovery activities.
● Validate that business and IT recovery procedures are sufficient.
● Assess the capability of recovery team members.
● Identify improvements to the plan.
● Without testing, BCM leaders will not have sufficient knowledge to develop strategies.
● Priority of primary job functions trumps the availability of resources to test.
● Lack of leadership support for time, resources, and budget.
What To Test
You are typically testing a plan, such as a Business Continuity Plan, Crisis Management Plan, Supplier Contingency Plan, a Disaster Recovery Plan, etc.
Test Types
● BCP/Recovery plans.
● Emergency Evacuation.
● Emergency Notification.
● Work Area/Alternate Site.
● Crisis Management.
● IT Disaster Recovery.
-
The more mature an organization is in its exercise management practices, the greater its success in recovering from a disaster.
Test Methods
● Walk-through: Assesses the viability of any type of recovery plan. A plan review is done internally with the plan author and stakeholders.
● Tabletop: One or multiple recovery teams review plans. These exercises are facilitated and include outage scenarios.
● Component: Evaluates the ability to recover one or more components of a recovery strategy.
● Functional Rehearsal: This type exercises all parts of a plan and may include recovery tasks, crisis communication, leadership response, and relocation.
● Cutover:Moves operations from production to recovery for an extended period of time, ranging from weeks to months.
Scenarios
Scenarios are a great way to set expectations up front and identify what you are testing so everyone is on the same page. You can find scenarios everywhere—look at current headlines, past experiences and the outcome of risk assessments. However, the outcome of risk assessment scenarios should be realistic, or you risk that the test participants don’t take the test seriously.
Test Checklist
There are several items to plan in advance, often documented in a Test Plan, as well as steps to take after the test. These include:
Prior to the Test
● Establish the exercise format.
● Determine the duration required based on the type of exercise.
● Identify success criteria and evaluation metrics.
● Creation of an issues log and recording action items or issues during the exercise.
● Develop script templates and complete them during the exercise.
● Identify the roles participating in the exercise – this will vary, but you most always need:
♦ Scribe – someone to take notes and write post-exercise tasks and minutes.
♦ Observer(s) – helpful to get independent feedback.
After the Test
● Collect all exercise scripts from the participants.
● Collect all notes from the scribe/observer.
● Gather feedback from the exercise participants.
● Host a ‘post-mortem’ session with all stakeholders.
● Identify training opportunities resulting from lessons learned.
● Write a post-exercise report within three weeks.
● Update recovery plans with any changes or contingencies identified.
Post-exercise reports are a good way to show your auditors and regulators evidence that you are testing your plans. Additionally, these reports provide senior leaders with insights into how prepared your team is or isn’t in the event of an incident.
If you have never conducted tests and exercises before, start small with a tabletop exercise of a Business Continuity Plan with a few scenarios. In this way you will know if your Business Continuity Plan is solid or needs to be updated. As your program matures, tests should increase in complexity and scope.
