Most organizations rely heavily on their information systems without
contingency planning in the case of a disaster. Imagine an organization
that never tests its business continuity plan (BCP). Is that
organization ready to respond effectively and resume operations of
mission critical services with minimal disruption?
The objective of the BCP is to provide the information and procedures
necessary to respond to a disaster, notify necessary personnel,
assemble business recovery teams, recover data, and resume operations to
ensure minimal disruption to the company’s operations.
The BCP identifies the information, material, facilities, personnel
and procedures required to facilitate a rapid recovery from a disaster.
The successful recovery of operations depends on performing a periodic
comprehensive test of the BCP. Therefore testing your BCP is an
integral component of a successful recovery of operations, if disaster
strikes.
The BCP should include documented and tested procedures which will
assist in ensuring the availability of critical resources and in
maintaining the continuity of operations during an emergency situation.
The BCP should aid in ensuring organizational stability through an
orderly recovery process in the event of significant problems and
disruptions. The plan should not be intended to be a procedures manual
of how to perform all departmental functions; it should include only
those high priority tasks required to ensure successful recovery from a
business disruption.
Testing The BCP
Every component of the BCP should be tested annually. Critical
and/or highly volatile components should be tested at least quarterly
and after any major technology change. Call trees should be tested at
least semi-annually, and any component which fails the test should be
re-tested as soon as possible. The tests to be performed should address
important business processes and related systems classified as highly
critical. Management should consider additional non-highly critical
processes and systems to be included on future tests as previous tests
of highly critical processes are successfully tested. Under no
circumstances should the testing of highly critical processes be limited
or excluded. The following considerations should be evaluated during
the planning, coordination, and execution of business recovery tests.
- Management formal approval of the costs associated with the
tests, normal business deadlines, resource requirements (human,
material, equipment), and impact on daily operations due to key
personnel participating on tests.
- Definition of recovery scenarios (e.g. partial or full destruction
due to natural and man-made disruptions, date and time of simulated
event, affected business processes, etc).
- Definition of test objectives, scope, expected results as well as
the criteria to be used to consider the results of the test as
successful. The objectives must have measurable goals such as maximum
time to recover, time limit to recover, amount of items completed or
failed procedures to determine the effectiveness and successfulness of
the tests.
- Documentation of the test objectives, scope, expected results, and test results.
The main reasons for testing the BCP include:
- Determining the feasibility of the business recovery process.
- Verifying the compatibility of alternate processing sites, hardware, software, and telecommunications.
- Identifying deficiencies in existing procedures.
- Identifying areas in the BCP that need modification or enhancement.
- Providing training to the Team Managers and Team Members.
- Ensuring the adequacy of procedures relating to the various teams involved in the recovery process.
- Demonstrating the ability of the organization to recover within a reasonable time.
- Providing a mechanism for maintaining and updating the BCP.
Standards For Testing The BCP
An annual test of the BCP is required. Segments of this test process
can be staged throughout the year to minimize disruption and yet
facilitate testing of the BCP. Depending on your testing methodology and
organizational strategic plans, your organization can leverage the
following types of tests to ensure the effectiveness of the BCP:
- Process Review Testing – A third party evaluates whether all critical processes for services are addressed.
- Checklist – Copies of the plan are sent
to department and business unit managers to verify and review BCP
procedures corresponding to their functional area. This is a simple test
and should be used in conjunction with other tests.
- Structured Walk-through – Team members
and other individuals responsible for recovery meet and walk through the
plan step-by-step to identify errors or assumptions.
- Simulation – This is a simulation of an
actual emergency. Members of the response team act in the same way as if
there was a real emergency.
- Parallel – This is similar to simulation
testing, but the primary site is uninterrupted and critical systems are
run in parallel at the alternative and primary sites.
- Full interruption – This test involves
all areas of the company in a response to an emergency. It mimics a real
disaster where all steps are performed to test the plan. Systems are
shut down at the primary site and all individuals who would be involved
in a real emergency, including internal and external organizations,
participate in the test. This test is the most detailed, time-consuming,
and expensive test.
Testing Report
For item reviews, equipment, and procedures testing, a checklist will
work well to illustrate what was tested and the results. The checklist
should be prepared in advance. Sampling techniques can be used to review
telephone numbers per critical call list, addresses of individuals,
vendors, equipment, employee information, and forms.
Test Results
Test results should be reviewed and approved by Management. Tests will be analyzed on the basis of the following criteria:
- Actual time to complete BCP recovery procedures and steps versus projected time.
- Elapsed time to perform each activity in a recovery mode.
- Analysis of the accuracy of each activity and event in the recovery effort.
- Amount of work completed.
The test should be rated:
- Satisfactory. Minimal disruption or problems noted; any exceptions would be easily overcome during a real disaster recovery situation.
- Partially Satisfactory. In these instances, while certain
aspects of the test may have been performed satisfactorily, the
following situations would result in this rating: too many minor errors
were noted; confusion in the process of recovery occurred during the
test; slow recovery time; breakdowns in communications; the need for
focused improvement.
- Unacceptable. Significant problems occurred and the
institution is at risk. This rating reflects some aspect of resumption
that did not test well, which in turn may produce problem situations in
accomplishing orderly business resumption.
Senior Management should review the test results and note areas
for enhancement to the BCP and Recovery Procedures. A plan and record of
testing should be maintained by the BCP Coordinator to ensure that each
relevant area of the BCP and Recovery Procedures are tested at least
annually.
Trying Times
In trying times such as the ones we are experiencing today, an
organization’s ability to get back on its feet quickly and efficiently
when disaster strikes is critical to both customer retention and
business reputation. It could mean the difference between success and
failure. Test Thy BCP!
