There’s more to Business Continuity (BC) disaster recovery drills than tabletop exercises, but you wouldn’t know it from the practices of most organizations. Most companies limit themselves to tabletop drills, the most basic type of recovery exercise.
In today’s post, I’ll introduce you to the full range of BC drills, and explain why it’s important for your organization to push itself and tackle the more demanding and realistic types of exercise.
Related on MHA Consulting: 8 Dos and 1 Don’t for Conducting Disaster Recovery Tests
As I’ve said before, too few organizations conduct any kind of recovery exercises at all. Of those that do, too many limit themselves to conducting only tabletop tests, which are the least realistic and demanding type of BC drills.
These organizations are not truly testing and validating their ability to recover from a disaster. Because of this, they are gambling with the welfare of their companies. They are also missing out on the opportunity to identify and bridge gaps in their recovery planning.
Companies that only do tabletop testing remind me of those beginning golfers who carry a full bag of clubs but hit every shot with a 7-iron, because that’s the only club they know how to hit.
Obviously, if you want to get good at golf you have to push yourself and master all the clubs. If you want to make sure your organization can recover from a business disaster, you have to learn about and push yourself toward the more complex type of recovery exercise.
Some business continuity professionals think that “tabletop testing” and “business continuity testing” mean exactly the same thing. In fact, tabletop testing is only one kind of BC testing; there are many others.
How many others? Well, the Federal Financial Institutions Examination Council (FFIEC) breaks Business Continuity Plan (BCP) testing down into four types.
Their description of these is excellent, so I’m going to give it to you in full (for the original, click here):
A tabletop exercise/structured walk-through test is considered a preliminary step in the overall testing process and may be used as an effective training tool; however, it is not a preferred testing method. Its primary objective is to ensure that critical personnel from all areas are familiar with the BCP and that the plan accurately reflects the financial institution’s ability to recover from a disaster. It is characterized by:
A walk-through drill/simulation test is somewhat more involved than a tabletop exercise/structured walk-through test because the participants choose a specific event scenario and apply the BCP to it. However, this test also represents a preliminary step in the overall testing process that may be used for training employees, but it is not a preferred testing methodology. It includes:
Functional drill/parallel testing is the first type of test that involves the actual mobilization of personnel to other sites in an attempt to establish communications and perform actual recovery processing as set forth in the BCP. The goal is to determine whether critical systems can be recovered at the alternate processing site and if employees can actually deploy the procedures defined in the BCP. It includes:
Full-interruption/full-scale test is the most comprehensive type of test. In a full-scale test, a real-life emergency is simulated as closely as possible.
Therefore, comprehensive planning should be a prerequisite to this type of test to ensure that business operations are not negatively affected. The institution implements all or portions of its BCP by processing data and transactions using backup media at the recovery site. It involves:
Source: FFIEC
You have to walk before you can run, and you shouldn’t try to do a full-scale interruption test as your first recovery exercise. A full-scale exercise is something you build toward.
But you definitely should build toward it!
As your BC program matures, and your team gains in expertise and confidence, you should gradually work your way toward the more realistic, comprehensive exercises. These are the best way of finding out how prepared you are to get through a major business disruption.
Are you one of these super-confident BC professionals who thinks his or her program is hot stuff? Well, great. Now put it to the test. Conduct a full-scale exercise to find out if you’re really as good as you think you are. It’s easy to ace a tabletop exercise. Dominating a full-interruption exercise is a different story. And if you do sail through, then good for you and your team. Your company is lucky to have you. If not, learn from the results, close your gaps, and try your BC drills again.
The fact is, recovery exercises are a lot like physical exercises. It’s not a one-and-done proposition. It’s a lifestyle of pushing yourself and your boundaries, and gradually developing new capabilities. It’s not easy, but it is satisfying. BC drills are also the best way of ensuring that your organization, and everyone who depends on it, will be protected if and when disaster strikes.
For more on BC drills and other hot topics in business continuity management, check out these recent posts from BCMMETRICS and MHA Consulting: