View in browser | Unsubscribe

No business continuity plan can be presumed ready if it isn't tested. Testing will determine if the plan can be counted on to work, if people understand what they're supposed to do and help discover any flaws in the planning. Check out the articles below for some helpful tips and best practices with regard to testing your plan.

BC tests are valuable given that they are typically the most realistic training event possible. (Item #1) To remove the risk of ineffective testing you should first focus on what requires testing, and then on how you will test it. (Item #2) What are the benefits of disrupting your business to test your plan? (Item #3)

The tabletop exercise provides valuable training to recovery personnel and enables planners to enhance continuity plans without causing major interference of normal operations. (Item #4) Testing objectives should start small, and gradually increase in complexity and scope. (Item #5) Testing improves business resilience through planning for people. (Item #6)

As always, we look forward to hearing about your concerns with regards to business continuity. If you have a topic you'd like to see covered, please email me at [email protected]

Best Regards,

Bob Mellinger
President
Attainium Corp

Quote of the Week

"An untested plan is only a strategy."
- Richard Gagnon -

Articles

1. Business Continuity Plan Testing: Considerations and Best Practices
Organizations face the daunting task of validating the plans created by their organizations and training their recovery personnel to use the new documents. This article captures thoughts, observations and industry best practices regarding plan testing.
http://www.isaca.org/Template.cfm?Section=Publications1&CONTENTID=7888&TEMPLATE=/ContentManagement/ContentDisplay.cfm

2. Creating effective business continuity plans
The two main problems that lead to business continuity plans failing are: (1) building on incorrect assumptions and (2) ineffective testing. If you examine the testing activities that are carried out, you commonly find that time and money was spent on testing unimportant things, while a lot of more important, but more difficult elements were neglected.
http://www.continuitycentral.com/feature0258.htm

3. Is it really necessary to disrupt business by testing the plan? What kinds of things have companies discovered when testing a plan?
USAA put together a plan and realized that testing was imperative. USAA ultimately found that employees who walked through the simulation were in a position to observe flaws in the plans and offer suggestions. Furthermore, those who practice for emergency situations are less likely to panic and more likely to remember the plan.
http://www.csoonline.com/fundamentals/abc_continuity.html#4

4. Best Practices for Tabletop Exercises
Having a completed business continuity plan does not mean it will lead to an effective recovery when employed or that the people assigned to teams fully understand their tasks and responsibilities in a recovery situation. Only through repeated and continuous testing can planners have a measure of assurance that the plan will work as designed and personnel will know what to do.
http://www.strohlsystems.com/Software/_files/IncidentManager/Tabletop.pdf

5. Overall Testing Strategy
The development of testing strategies requires a business decision regarding the level and frequency of testing needed to ensure recovery objectives can be achieved during a business interruption or disaster. The frequency and complexity of testing is based on the risks to the institution.
http://www.ffiec.gov/ffiecinfobase/booklets/bcp/bps_07_proc_risk_monitor.html

6. Human Impact Preparedness: It's about the people!
The final component of Human Impact Preparedness addresses issues of maintaining awareness of the plans and a level of personal preparedness through testing and training.
http://www.globalcontinuity.com/thought_leadership/human_impact_preparedness_it_s_about_the_people