You can't say you have business continuity or IT disaster recovery capabilities unless you know they work. And the only way to guarantee your capabilities are real is to test them. Many organizations avoid “testing” because of the “pass or fail” implications, and choose to use terms like “exercise” to soften and sometimes, lower expectations. However, when organizations do this, they are missing a great opportunity to realize the value of their BC/DR investment, and improve their capabilities.
Most BC/DR exercises are designed to succeed and meet specific objectives -- like passing an audit. Unfortunately, using this model results in missed opportunities to truly try out your capabilities, and identify gaps and opportunities for improvement.
A different approach, and a good way to improve the value of your testing investment, is to follow a more disciplined, coordinated approach in all phases of the testing process. Including:
- Initiation: identify the business objectives for the test “why are we testing?” Check with senior management to confirm the objectives are meaningful to them.
- Plan: determine the right scope and required resources to meet the business objectives. Incorporate a structured walk-through early in the planning process to identify weaknesses and deficiencies and improve recovery capabilities before the actual test.
- Prepare: arrange the people, process and technologies necessary to effectively support the test. Use Tabletop Exercises (role playing scenarios) to ensure your plans are actionable and effective, and to validate your organization’s readiness for an actual test (go-no-go decision).
- Execute: orchestrate and document/keep a detailed log of test activates. Create supporting schedules, logs and communication plans to facilitate orchestration. Consider including a third party monitor to ensure an unbiased view of issues.
- Close: conduct debriefing sessions to identify what worked, what didn’t and develop an action plan. Produce a formal post-test report to celebrate the wins and get organizational commitment to close gaps.
When done correctly, BC/DR testing will not only reduce time, money and stress, but it will also:
- Help align business priorities with BC/DR capabilities
- Rise executive awareness of the true state of BC/DR
- Provide a true validation of BC/DR capabilities – help us know what we don’t know.
- Promote a BC/DR culture
- Serve as a primer to promote higher BC/DR maturity
And remember, there is no such thing as a failed test as long as a lesson is learned from the attempt.