Plan Testing and Exercising

How often should you test your business continuity plan? As often as possible and as much of it as possible. Unless the plan is brought out and tested on a regular basis, there is the risk that some things won't work if a real emergency does occur. If your plan needs testing, this week's articles focus on the importance of testing and provide information on how to do it.

A large percentage of organizations do not test their business continuity plans. (Item #1)   There's nothing like a crisis to show you what's not working. (Item #2)   The key components of an effective exercise can be broken down into three simple activities. (Item #3)  

You won't know if your plan works unless you test it. (Item #4)   Here are some sample table-top exercise scenarios to help you put your plans into action. (Item #5)   Exercises and tests offer different ways of identifying deficiencies in IT plans, procedures, and training. (Item #6)  

As always, we look forward to hearing your comments & insights regarding business continuity. If you have a topic you'd like us to cover, email me at [email protected].

Bob Mellinger, President
Attainium Corp

1. Improving business continuity testing and exercising

Continuity Central asked various business continuity experts why it seems that many organizations neglect the area of testing and exercising and what individual organizations can do to improve. Each expert was asked the same three questions were asked and the various comments received in response are summarized here.

2. In-crisis decision making: practice makes perfect

Like so many things in life, in order to become proficient in any physical or mental process, it is necessary to practice. Some say there is no better learning curve in crisis management than managing through an actual crisis. However, what you actually apply during a crisis is your capabilities that exist at that time, including: inefficiencies in how your organization responds to a crisis; how it is managed; and how decisions are made.

3. The art of effective exercising

A business continuity plan is only effective if it accurately reflects the needs, technology and structure of the organization. But, more importantly, a business continuity plan can only be considered to be truly effective if the content and the components of the plan have been exercised.

4. Exercising: the secret to successful business continuity plans

In reality business continuity plans are useless until you exercise them. Fortunately, many types of exercises are possible, ranging from simple to very complex. The key is to incorporate exercising as part of the overall business continuity management process.

5. Tabletop Exercises: Three Sample Scenarios

A tabletop exercise is a great way to get business continuity plans off the written page without the interruption of a full-scale drill. Rather than actually simulating a disaster, the crisis management group gathers for three hours to talk through a simulated disaster.

6. Guide to test, training, and exercise programs for IT plans and capabilities

This guide from the National Institute of Standards and Technology provides guidance on designing, developing, conducting, and evaluating TT&E events so that organizations can improve their ability to prepare for, respond to, manage, and recover from adverse events that may affect their missions. The scope of this document is limited to TT&E events for single organizations, as opposed to large-scale events involving multiple organizations, involving internal IT operational procedures for emergencies.

Quote of the Week:

"Testing leads to failure, and failure leads to understanding."
-- Burt Rutan

Contact Us:

Attainium Corp
15110 Gaffney Circle
Gainesville, VA 20155