TechAdvisory.org

Technology Advice for Small Businesses

Business continuity exercise 101

BusinessContinuity_Apr20_BDisasters, whether in the form of man-made errors or natural causes, are a business’s worst fear. Imagine coming to your office one morning to find the internal servers destroyed overnight by a massive flood. This could be the end of the road for your company, unless you have a business continuity plan (BCP) to cope with the situation. But coming up with a well-thought-out BCP is only the start – you need to test the plan to see whether it works. An exercise process should therefore be included in the plan. Here’s all you need to know about running BCP exercises.

Set objectives

The first step to any efficient exercise is having clear objectives. Think about the results you want to see at the end of the exercise. These outcomes may include, but are not limited to, IT disaster recovery, evacuation routines, off-site recovery plans, and supplier management. If there are measurable targets that can be put into the equation, then all the better. For instance, meeting a recovery objective after a disaster within x number of hours.

Select the right type of exercise

Essentially there are four levels of exercises, each increasing in complexity and difficulty.

  • A walkthrough – this exercise involves a team meeting to discuss whether the present BCP has everything covered and is up-to-date.
  • Desktop exercise – ideal for new or intermediate teams. A desktop exercise takes place in a room where delegates discuss a fictional scenario delivered via a series of powerpoint presentations. Role-playing and dramatic simulations are not part of this stage of the process.
  • Functional exercise – this level allows employees to perform their duties in a simulated environment. It is designed to exercise specific team members, procedures, and resources in the event of a disaster.
  • Live or real time – this is a full-scale exercise performed in real time with normal business suspended. The aim is to see whether people can do what’s expected of them within a set timescale. A live exercise is often complicated and costly to organize, but will generally ensure a much smoother process if the worst does happen.

Develop a scenario

Take what you’ve learned from the team, the objectives and plan to develop a scenario. Depending on the type of exercise, you should have a scenario tailored to suit your objectives. Be creative when simulating incidents. You may need only two or three to keep your employees busy for a couple of hours – during that time you can monitor their performance.

Prepare employees

Assign a group of representatives responsible for making announcements and preparing conference rooms to relay the plan to employees. Be specific about who in the company are participants, observers, and facilitators for the purposes of the exercise. Explain courses of actions to everyone involved in the plan. Remember, your BCP’s success depends on your employees’ cooperation, so do your best when you’re clarifying the plan.

Run the exercise!

If you can’t measure it, you can’t improve it. After careful planning and scheduling, it’s time to put your plan into action. Make sure you observe the exercise closely and ask yourself these questions: Are there any potential areas that can be improved? What should you do more of, or differently? What went well, and what didn’t? End the exercise with a feedback session where employees can express their opinions and share their ideas.

If you don’t get it right the first time, then go back to the drawing board and schedule another exercise. It only gets better with every practice.

Are you ready even if disaster should strike? Contact us today and we can help you develop a business continuity plan that keeps your company in the game.