Testing and Exercising

Your business continuity plan may be backed by good technology and written documentation, but unless it's brought out and tested every now and then, there is still a risk that everything may not work as it should when a real emergency does occur. Think of it as a parachute� you have to know you can trust it! The articles below can help you plan, prepare for, and conduct BC exercises.

An exercise's effectiveness has a direct correlation to the amount of planning and preparation completed beforehand. (Item #1)   If your exercise is not uncovering problems, you may not be doing it right. (Item #2)   Things will get fairly hectic during a typical large-scale disaster recovery exercise. As an observer, what must you know? (Item #3)  

Playing the role of an attacker can make your team better at defense. (Item #4)   Looking for a good plot line for your next BCP exercise? (Item #5)   There were a number of lessons learned in the three exercises described here. (Item #6)  

Are you on LinkedIn? If so, check out our group - Business Continuity Plan - Testing & Exercising. Now there is a place to gather and share valuable insight with knowledgeable people. If not, go to LinkedIn.com and sign up.

As always, we look forward to hearing your comments & insights regarding business continuity. If you have a topic you'd like us to cover, email me at [email protected].

Bob Mellinger, President
Attainium Corp

1. The art of effective exercising

As we are all aware, a business continuity plan is only effective if it accurately reflects the needs, technology and structure of the organization. But, more importantly, a business continuity plan can only be considered to be truly effective if the content and the components of the plan have been exercised.
http://www.continuitycentral.com/feature0739.html

2. Exercising: The Secret to Successful Business Continuity Plans

Exercises that appear to be "successful" and uncover no problem should be suspect. Maybe the objectives were too easy or the situation was unrealistic. Exercises present opportunities to fix problems before a disaster happens.
http://bcmnow.com/Summerpg2.html

3. Help! I'm an observer at my first disaster recovery exercise...

I was recently asked by a colleague to share checklists which would help a new observer at a business continuity or disaster recovery exercise. The request forced me to think back on my own observer role, when I began to work in BCM. If I could change one thing from then, what would it be? The answer was deceptively simple: I wished I had known what questions to ask. So, as you read on, look for the questions sprinkled throughout the article. Perhaps you could extract them and build your own observer checklist.
http://www.continuitycentral.com/feature0626.html

4. Red Team Versus Blue Team: How to Run an Effective Simulation

Red team-blue team exercises take their name from their military antecedents. The idea is simple: One group of security pros--a red team--attacks something, and an opposing group--the blue team--defends it. Originally, the exercises were used by the military to test force-readiness. They have also been used to test physical security of sensitive sites like nuclear facilities and the Department of Energy's National Laboratories and Technology Centers.
http://www.csoonline.com/article/221695/ Red_Team_Versus_Blue_Team_How_to_Run_an_Effective_Simulation

5. Some thoughts on exercise scenarios and plot lines

For many business continuity practitioners, one of the most challenging assignments is the development and delivery of realistic but stimulating exercises. Perhaps the toughest aspect is choosing a suitable basic plot line which can be adapted and embellished to form the basis of an imaginary event in line with your objectives and purpose.
http://www.continuitycentral.com/feature0298.htm

6. Using the CREW Scenario: Three Tabletop Exercises

Three organizations used that scenario as a basis for their tabletop emergency exercises in 2005-06. Some of the lessons observed in these exercises are summarized here, along with information on designing exercises.
http://www.crew.org/PDF%20docs/Using%20scenario%207%20(2).pdf