BC & ITDR Testing, Training & Exercises

Once you create your Business Continuity (BC) and IT Disaster Recovery Plan (DRP), the most beneficial steps are to train your staff on their roles and responsibilities before, during, and after an emergency and test the plan using various exercises. Testing the BC/DR plan is one of the most valuable ways to ensure that the process you have created is as effective in practice as it is on paper. Through testing, you will be able to flow through each step, notate areas for improvement, and then make corrections that will improve the effectiveness of the plan. 

To test the plan, you could use a variety of testing methods. 


Scenario Testing

One method of testing is to schedule a day of scenario-styled exercises that allow you to run through a simulated version of a disaster. Here, you are able to choice the exact disaster that you would be responding to and you could also try several different disaster scenarios. These tests could be in depth simulations that include actually turning off systems and using recovery methods, or it could be more of a discussion activity where participants are asked to state what they would do or to walk through the steps they would take. To be effective, the scenario needs to be as close as possible to a real-life situation as it would occur in reality. This type of testing is beneficial for evaluating staff process knowledge, but it may not be an accurate reflection if the systems themselves are not tested and if the staff members are not putting the test to physical action. 


Escalation Testing

If your business finds itself in an-almost disaster that can be recovered before it turns into an actual disaster, this could be a great chance to test the BC/DR plan. By determining what the next steps would have been, you can continue through the process to analyze how the process would have worked had it needed to be initiated. Although this type of testing is similar to scenario testing, it is more powerful because the scenario is very real, fresh, and is an on-the-spot test rather than a planned test. However, like scenario testing, this may not be the most accurate test of the system if they are not physically tested. 


System Testing

For this method, you don’t need a specific scenario or storyline to run the test. You simple run your recovery processes to ensure that they work smoothly. This is a good method for ensuring that the systems are responsive and that the processes work as planned. System testing can be scheduled downtime, which will help reduce or eliminate disruptions to business operations during testing. 


It is a good idea to use more than one testing method to get the most out of your testing, and you should also consider how frequently testing is run. There is not a one-size-fits-all testing schedule, as testing depends on the complexity of the systems and processes as well as the business’s budget and cost of testing. However, once the business continuity plan has been fully tested, revised for improvement, and set in stone, everyone who plays a role in the disaster recovery process will need to be trained on their steps in the event of a disaster. It is important that any changes made to the plan during testing be shared with the effected staff members so that they are as up-to-date with the process as possible. An effective disaster recovery plan has many processes that rely on people to initiate and/or fulfill individual processes within the plan, so it is important that each person learn their part. In addition to catching and solving potential gaps in the plan, BC/DR testing is also beneficial for staff members to practice their responses and become familiar with their roles and responsibilities’ before, during and after an emergency situation. In the middle of a disaster, tensions and anxiety will be high, and this may cause the process to become more difficult, especially in the event that the business is not as prepared as possible to respond to the event. This is another reason why having staff members already familiar with the processes will be largely beneficial in helping the business reach its RPO/RTO goals. 


The importance of BC/DR testing is about maintenance and continuous improvement. The bottom line is that by maintaining and revising the plan, the business is able to prepare itself and its staff to effectively respond to a disaster so that the business is able to continue operating with as little disruption as possible. 

Have Questions?

Want to find out more about how Resilience3™ security, risk, and compliance solutions will improve your business resiliency?