.png)
.png)
Business continuity testing is how we find out if our recovery plans will actually work when we need them most. Yet many organizations skip testing, don’t test enough, or aren’t sure how to approach it. Here’s what you need to know to build testing into your program the right way.
What Is Business Continuity Testing?
Business continuity testing checks whether your recovery plans are practical and executable under pressure when a disruption occurs.
As business continuity professionals, we write plans in three areas, business continuity (BC), information technology/disaster recovery (IT/DR), and crisis management (CM). The goal of these plans is to ensure that these areas are resilient and can be restored quickly or handled efficiently in the wake of disruptions or emergencies.
How Do You Know Your Plans Will Work? Test Them.
The only way to know if your plans will work is to test them, not to cross your fingers and hope for the best.
The fact is, every responsible organization should have recovery plans addressing the three areas mentioned above. Every organization with recovery plans needs to test them to ensure they work, identify any gaps, and train employees on their use.
Business Continuity Testing Is a Marathon, Not a Sprint
Some people assume BC testing is a one and done proposition. Nothing could be further from the truth. The commonly understood activity that has the most similarities to BC testing is training to run a marathon.
No one spends three months lying around on the couch eating potato chips then gets up one morning and runs 26.2 miles. You have to train over a period of months, gradually increasing the distance you run. By making yourself run progressively longer distances, you steadily build up your strength.
I’ve run two marathons, in San Diego and New York. If you are also a distance runner, you’ll know this instinctively: No one succeeds at running 26.2 miles at a good pace simply by making a heroic effort on race day. You succeed by gradually building up your fitness ahead of time—and then you make a heroic effort on race day. And (if you’re like me) the last six miles are still torture. However, you keep going and cross the finish line, ideally at or ahead of your desired time. It feels great to finish. And of course it wouldn’t have been possible if you hadn’t systematically built up a foundation of endurance over the preceding weeks and months.
It’s the same with business continuity testing. It’s not realistic to expect to be great out of the gate. The key to becoming proficient is to start slowly and gradually increase your capabilities. Incrementally develop your organization’s knowledge and capacity. Be patient. Think like an athlete. Adopt the perspective of a long-distance runner.
The Four Types Of Business Continuity Testing
There’s a lot of confusion out there regarding what business continuity testing is and the types of testing. Let’s clear it up right now.
There are four types of business continuity testing. They are:
1. Tabletop
This is when a couple of people sit in a room and go through the plan as a discussion exercise. It’s more talking than doing. It’s a good chance to see if your plan is missing anything, such as someone’s phone number or a high-level task. Tabletop testing is good as far as it goes, but it only goes so far.
2. Walkthrough
A walkthrough test is basically a tabletop test plus a scenario. You’re not just reviewing the plan, you’re pretending that a certain specific disaster has happened (such as a flood or data breach). You then talk through the steps for dealing with this scenario. Walkthroughs are more stressful than tabletop exercises. The situations can seem very real. However, like tabletop exercises, walkthroughs are about talking more than doing. You might pretend that you escort everyone to an alternate work site, but in reality no one goes anywhere and you never leave your chair.
3. Semi-functional
In a semi-functional test, the pressure is really ratcheted up. Now you are not only working through a specific disaster scenario, you actually implement your plan, at least to a degree. You might really relocate your group to an alternate work site and have some people work from home. This level of testing is rigorous enough that it typically unearths a lot of problems. For example, people working from home might discover that they are unable to log on to the company computer network. People at a remote location might find that they are missing critical supplies. All problems encountered should be documented and fixed. The amount of time spent working in the alternate locations is typically shorter than it would be in a real-life disaster.
4. Fully functional
This is as close to the real thing as you can get without it being real. In a fully functional test, you will be running all 26.2 miles, so to speak. The object is to implement the recovery plan fully in order to make sure you can really do it when the time comes. People work from home or at the alternate location not just for an hour but for a day or two. Fully functional exercises can be either announced or unannounced. They are the most stressful and time-consuming, but also the most revealing type of exercise.
Prioritize Business Continuity Testing by Criticality
The last of my three points is about the importance of matching the level of testing to the criticality of the process or application.
I’m always surprised when I find organizations spending a lot of time and money running intensive tests of unimportant processes.
The Boy Scout motto is “Be Prepared,” not “Be Overprepared.” And yet, many organizations do overprepare.
I recommend dividing your processes into three categories based on when they need to be recovered in order to prevent a significant impact to the organization:
- Level 1: Critical. Must be recovered within 48 hours of the disruption.
- Level 2: Important. Can be recovered within a window of 48 hours after the disruption to up to 5 days after.
- Level 3: Routine. Can be recovered in a time frame greater than 5 days after the disruption.
Once you determine the criticality of your various processes and applications, you can test them at the appropriate level as shown below:
- Level 1: Process should be tested at the level of tabletop all the way through fully functional.
- Level 2: It is sufficient to test the process from tabletop through semi-functional.
- Level 3: Testing the process at the level of tabletop only is probably sufficient.
The exact decisions in terms of levels and timing will probably vary with the organization. The important thing is to be logical in terms of where you devote your resources. Match the intensity of the testing to the criticality of the process.
This approach will lead you to invest your testing time and resources in the processes that are the most critical to the well-being of the organization.
How to Keep Your BCM Program Moving Forward
Business continuity testing is how you find out if your plans will really work when the pressure is on. But testing is just one piece of the puzzle. To keep your program strong, you also need to understand where you stand and where you need to improve. That’s where BCMMetrics comes in. Our business continuity software solution measures your program’s readiness, tracks compliance, and sees your risk clearly, so you can keep moving your BCM program in the right direction. If you want to see how it works, take a virtual tour of BCMMetrics today.
FAQ: Business Continuity Testing
What is business continuity testing?
Business continuity testing is the process of checking if your recovery plans will actually work when a disruption happens. It helps uncover gaps, trains your team, and builds confidence that your plans are practical, not just theoretical.
Why is business continuity testing important?
Testing your business continuity plans helps ensure your organization can respond effectively to disruptions. It’s the only way to know if your plans will work under pressure and helps you find issues before they become problems.
How often should you test your business continuity plans?
Testing your business continuity plan isn’t a one-time activity. Like training for a marathon, it should be done regularly and incrementally, building your organization’s capacity over time. The frequency and intensity of testing should match the criticality of each process you’re testing.
What are the different types of business continuity testing?
There are four main types of business continuity testing: tabletop (discussion-based), walkthrough (scenario-based discussions), semi-functional (partial implementation), and fully functional (full-scale exercises). Each type helps you test different aspects of your plans and should be used based on the criticality of your processes.
