Testing
& Maintenance |
 |
 |
Test (exercise)
Any contingency plan is only as good as its ability to recover vital processes and technologies
inside the recovery window set by your business requirements. The key to validating the integrity
and functionality of your current or future business recovery plan is through an integrated test
(exercise).
The purpose of performing an exercise is to demonstrate to both management and technology
teams the ability of one or more vital business processes to continue functioning inside the
identified timeframe post a business interruption event. An exercise is not a pass/fail work
effort but an opportunity to identify vulnerabilities and gaps in your recovery plan. Once
identified, then your team can build a continuous improvement roadmap that will mitigate and/or
eliminate these gaps and vulnerabilities.
Contingency Now offers three types of exercises:
- Tabletop
- Functional Drill
- Full Scale
Tabletop Exercise
A tabletop exercise is a paper supported and process driven exercise leveraged to
validate the ability to recover vital business processes, technology based systems and
infrastructure for the management team. In general, a table top exercise consists of the
following:
- Provides a verbally simulated business interruption event while
ensuring personnel fully understand their functions
- Is performed at no set time with flexible scheduling
- Allows the client to review their policies, procedures
and internal action plans.
- Should contain question and answer period.
- Should have a continuous improvement program associated with the exercise output.
Functional Drill
A functional drill is an exercise that allows actual performance of an identified business
interruption response. These exercises are more invasive to your operations than a table top
exercise. The functional drill will specifically identify where and why short comings exist
in the client's disaster recovery plan. In general, a functional drill exercise consists of
the following:
- Focused on a single event response to a function and/or process.
- May be limited to a specific entity or department.
- Consists of human, natural and technical affects.
- Allows the client to review their policies, procedures and internal action plans.
- Should contain question and answer period.
- Should have a continuous improvement program associated with the exercise output.
- Can simulate main server loss, power outage, biohazard, telecom loss, etc.
- Is managed in "real time".
- Has emphasis on specific emergency mode functions.
- The client's emergency operations center may be activated on a per function basis.
Full Scale
A full scale exercise is an exercise that allows actual performance of a staged/realistic
emergency response to a company-wide affected business interruption event. These exercises are
more invasive to your operations than a functional drill exercise. The functional drill is more
complex, takes more time to prepare and is more financially costly than any other exercise. This
exercise is predominantly performed within the government sector but may be fully supported in
private industry. In general, a full scale exercise consists of the following:
- Actual performance of a staged/realistic company -wide business interruption event with
emergency response.
- Is managed in "real time".
- Is coordinated with local public officials such as FEMA, Red Cross, Hazmat,
fire and police.
- Exercises multiple emergency functions simultaneously.
- The client's emergency operations center is activated. Should contain
question and answer period.
- Should have a continuous improvement program associated with the exercise output.
Maintenance
Every business recovery plan is considered a "live document". As your business or business
technology changes over time so must your business recovery plan. If you don't keep your plan
in lock-step with either business process or technology changes, your plan will become obsolete and rendered
useless. Contingency Now will work closely with your team to identify and help you manage your
on-going planning maintenance requirements. In general, Contingency Now recommends the
following for recovery plan maintenance:
- Electronic and physical formats in multiple "secured" locations
- Quarterly updates on resources information
- Semi-annual updates on strategies and procedures
- Updates performed whenever a "significant" enterprise process, system, or technology changes
If your enterprise has or will have a recovery plan then maintaining
it properly can make a difference between an effective and timely recovery or possible
bankruptcy.
|
|
