Have Disaster Recovery plans? Tested them lately?
An organization’s Disaster Recovery Planning program should include periodic Testing and Exercising of their DR Plans. Organizations whose BCM programs are not mature enough, or where their plans are in preliminary stages might not exercise or test IT DR Plans. There are also organizations who do not believe that anything “bad” will happen to them and who don’t see a need to exercise or test their Disaster Recovery plans.
Here are 5 other benefits of exercising the BC DR Plans:
Validate Viability: Exercising Disaster Recovery plans is critical to establish the viability of the recovery strategies and validating the recovery time objectives (RTO) of those plans. Cross-training participants, by assigning roles to alternates during a recovery exercise, can validate the thoroughness of the plan documentation.
Validate Assumptions: Because you can’t anticipate the nature of possible disruptive events, response plans tend to be based on many assumptions including assumed scenarios, the availability of resources, the priorities of business resumption and the state of the supply-chain, among many others. Disaster Recovery testing will bring these assumptions to the fore where they can be validated by the test participants.
Create Awareness: Planning a Disaster Recovery exercise and can take days -or even months – and may involve people from many business units across many locations. This can be used as an opportunity to create awareness of the disaster recovery program within the organization. Participants in the recovery exercise will become familiar with the plan contents as well as their role if the plans are ever invoked in response to a disruption or other incident.
Test Collaboration: During a disaster event there are many roles and participants who need to collaborate to achieve the desired business objectives. Upstream responders have to be able to communicate to downstream responders when the tasks are completed to complete smooth hand-offs and ensure effective recovery. Also there is a constant stream of communication to various stakeholders – notifications, status updates to business owners, communication with external agencies, customers, financial institutions. All needs to be tested for protocols and timeliness. Disaster Recovery testing can exercise the communication plan and validate its protocol as well as the timeliness of the messages.
Find Gaps: Every recovery plan, when created, are designed with certain assumptions and designed to meet a particular set of objectives. During a disaster incident many plans may be invoked simultaneously. The same responder or resource might have different roles in many of these plans and there could be spider-web of interdependencies between the plans. Do these Disaster Recovery, Crisis Management and Business Continuity Plans play well together at time of an incident? There is only one way to find out: exercise them at the same time.
Exercise outcomes are not really relevant. Grading exercise results – even on a pass/fail basis – places an unnecessary focus on the results, rather than the benefits. No lessons are learned and nothing of substance is achieved if the recovery exercise is a guaranteed success.
Practice makes perfect – whether it’s a Disaster Recovery plan, a Business Continuity plan, or any other type of plan. Practice, practice, practice.
