Desk Check Testing in Business Continuity Plan
We often read about testing business continuity plans, but what about planning the test? The two are opposite sides of the same coin and equally important in ensuring that a business continuity plan (BCP) serves its (very important) purpose in the event of operational disruption. In this quick guide, we discuss the downtime consequences of inadequate BC test planning and six ways to test a business continuity plan with minimal downtime.
Risk #1 – Key BCP technical staff and task owners are unavailable
What if a real disaster hit while your key technical staff and BCP task owners were occupied at a secondary site running a full simulation test? The chances are slim, but the point of a BCP is to prepare for the unpredictable. If those responsible for leading continuity plans and technology into action were hampered in their response, your company could face significant yet avoidable downtime as a result.
Risk #2 – Staff being unable to service and deliver to customers
This second risk is not downtime in the IT sense of the word but can still have considerable impact on operational capacity and service availability. Imagine if urgent customer support tickets or sales opportunities were going missed, or production ground to 50% capacity causing knock-on delays in distribution, simply because too many "delivery critical" staff were tied up in a simulation test. The downtime effects are worryingly similar to if disaster struck. Being unable to fulfil customer requests in a timely fashion can have substantial short and long-term impacts!
How do you test a business continuity plan with minimal downtime?
1. Run "beta" BCP tests before a full simulation
Before running a simulation – the closest thing to invoking the BCP – undertake what is known as a "desktop test". This is key in how to test a business continuity plan with minimal downtime. A desktop test will involve all the business continuity and/or crisis management team plus an observer in a meeting. Here, attendees will be presented with a hypothetical disaster scenario and will use the BCP to theoretically tackle it.
The process of a desktop test will reveal any glaring issues that can be quickly rectified before moving to a full simulation – such as a key task owner being unaware of a responsibility, or it being difficult to access the failover system. Therefore, the chances of unnecessary delays and downtime associated with a simulation test are minimised.
Don't think that smoothing over the creases ahead of time isn't cheating a BCP simulation test, though. A desktop test it simply another step to BCP preparedness that allows your company to utilise its resources in the best places. Just remember to update the BCP with your findings and re-test before running a simulation! This leads us on to preparing to run a BCP simulation test with minimal downtime.
2. Be sensible about how often you test
Once you're happy with your desktop test, you can begin planning the logistics of a simulation test. Although we recommend reviewing the BCP quarterly and following a disaster or the emergence of a new threat, a full simulation is advised once a year. Simulation tests see a team (comprising BCP staff owners and general staff) work through a disaster scenario using the BCP procedures and allocated resources. It will usually involve sending teams to a separate disaster recovery location to restart technology or operational functions and the use of alternative equipment and third-party services.
To avoid disproportionately impacting real-time business operations or incurring unnecessary costs, be smart about the date you choose. There's no golden spot on the calendar (if only it was that simple!). The best BCP testing date will be unique to your business. However, we advise taking the following into account:
- Analyse trading peaks and troughs – you do not want key staff and resources triaged into BCP testing when customers need you most and all hands must be on deck
- Choose a date when the business is roster and resource heavy. For example, many organisations have less staff at work during the school summer holiday months and operations can already be stretched. This way you won't risk poor availability or downtime by "borrowing" some colleagues for the day
3. Line up any relevant service providers
As mentioned in point 2, BCP testing often involves third parties: the degree of which depends on how integrated these outsourced companies are with your operations and IT. If your simulation requires participation from service providers (and they cater to it), give plenty of notice. For example, you may wish to arrange extra support for your main operation to ensure it runs smoothly while key staff are out of the business, or draft in a supplier to create the most authentic simulation possible.
Whatever you need a third party for, briefing well in advance will avoid unnecessary delays in beginning the BCP test, place your team back in the business ASAP and provide peace of mind that your main operation is safe from a downtime event.
4. Treat a simulation like an overseas business trip
Plan for a BCP simulation test with the same rigor you would if you were sending your teams overseas for an important meeting or event. Communicate unambiguously and regularly, set out clear itineraries and make sure that logistics such as transport are failsafe. Taking a high-stakes approach to planning is what gets participants at simulation ground zero and fully prepared. It would be a shame if poorly planned logistics extended the test by a day and places pressure on the business, for the simple reason that somebody didn't get the memo.
As with point 3, lining up logistics with military precision is about starting the test as quickly as possible and getting key technology, operational and service staff back to their day jobs in a reasonable, but timely, fashion.
5. Double up on BCP task owner skills
Directly linking back to risk 1, your BCP should never assign a critical task to a single owner. By doing so, it puts your organisation in an exceptional state of vulnerability when a BCP simulation test is being run, as that key person will be unavailable to deliver make-or-break support when it is most needed. The outcome is surely acute downtime and poor systems availability.
Doubling up on BCP task owners is called plan task redundancy and you can avoid it by training at least 2 colleagues to adeptly perform each critical task in your BCP and DR plans. Beyond testing, plan task redundancy is an established industry best practice because it accounts for an imperfect world – sickness, holidays or resignations are 3 examples.
6. Split your delivery critical participants sensibly
And finally, linking back to risk 2, make sure to strike a careful balance of roles when deciding your BCP simulation team. You need to consider including enough participants to realistically simulate a disaster scenario. For the same reason, you must also include a cross-section of skills and departments to effectively create a mini but proportionate workforce, if sensible to do so (small companies may find this impacts main operations too harshly).
However, pulling too many delivery critical staff away from their roles could have a knock-on effect that instigates a downtime event – the very situation your BCP exists to protect against! For example, having too many production staff involved in the simulation could cause serious operational availability issues back at base, or customer care may be so overstretched that they have to temporarily pause some services. Technically speaking, you'd still be online, but facing a damaging drop in output and availability.
We hope this article provided sound advice about how to test a business continuity plan with minimal downtime. If you need help getting the most from IT infrastructure as part of your business continuity plan or testing setup, speak to us. Call us on 0844 579 0800 or complete a contact form here.
Source: https://starcom.node4.co.uk/how-to-test-a-business-continuity-plan-with-minimal-downtime/
0 Response to "Desk Check Testing in Business Continuity Plan"
Post a Comment