Business Continuity Plan Test Templates - the starting block for your BCP test
It’s accepted good practice to test a business continuity plans – but where to start?
Initially, consider where you are in terms of the maturity of your business continuity. Is this a relatively new business continuity plan undergoing it’s first test or a fairly well established and trusted plan that the organisation is reasonably confident with?
For new business continuity plans, a full-blown simulation might be too much too soon. In this case consider a walkthrough with some challenges to confirm that the plan is based on firm principles. The walkthrough can be broken down into bite-size “chunks” that evaluate individual parts of the plan such as:
The essential components of a business continuity plan walkthrough test
BCP walkthrough test of Incident Discovery & Notification
Evaluate the inclusion of the following in the plan documentation and the response team knowledge of the process and facilities available
-
Incident notification
-
Mobilisation & assembly of Incident Management team
-
Establishing scene control
-
Emergency services notification
-
Accounting for staff contractors and visitors
-
Staff advice & assistance
BCP walkthrough test of Operational Recovery
Walkthrough the response and recovery plans with individual response team members or response team leaders (i.e. those responsible for critical functions like customer service, finance or call centre) ensuring that the following (where appropriate) are factored into their plans:
-
Alternative workplace Accommodation: Relocation logistics, capacity & resources available at alternative working location
-
Remote working capabilities
-
Customer Management activities
-
Handling & prioritisation of customer commitments
-
Sourcing replacements for damaged or destroyed equipment / stock / raw materials.
-
Order management / fulfilment resumption / work-in-progress recovery
-
Relationships with other parts of the organisation (such as the incident management team, facilities management and information technology)
BCP Walkthrough test of Internal & External Communication
Ensure that there is clear ownership of all aspects of communication (including ownership & understanding of the platforms used for messaging) for the following:
-
Incident responders & Recovery Teams
-
Communication nd information sharing the wider organisation
-
Social Media
-
Mainstream Media
-
Regulatory Agencies
BCP walkthrough test of Infrastructure
Ensure that the envisaged procedures for the following are in place, are proven and understood by the recovery leadership for each function below
-
Information systems recovery
-
Voice communications recovery
-
Establishing operations at an alternative workplace
Essential components of a business continuity plan scenario test
If your business continuity plan is more mature and you are confident in the results of walkthrough tests, you are probably ready for a more rigorous test based around a specific scenario and where the whole response organisation assumes the roles that they would be expected to adopt during a major incident. This type of test is often called a simulation because it focusses on evaluating the plan in a situation that realistically mimics a real incident such as cyber-attack or damage to property. This type of test requires significantly more planning and facilitation than a basic plan walkthrough.
The overarching objective here is to create an impact scenario of sufficient magnitude that would require the necessary business continuity plans or incident response plans to be invoked. There are several factors to consider in meeting this objective:
Scale of the incident scenario
An example of incident scale might be, "will our business continuity arrangements mitigate staff unavailability of 35% either through travel difficulties or a virus outbreak", The scale of the incident should be challenging enough to warrantplan invocation but not so servere that it is impossible to address
Duration of the incident scenario
This is something can be achallenge because the time normally allocated to a scenario based incident test is normally much less than the duration of an actual incident. The incident simulation scenario has to be designed so that participants are aware of the actal duration of the incident as part of their response activities. Having some guidance on the real-life impact duration of different types of incident scenario can be helpful in creating realistic scenario tests. (our business continuity plan testing templates provide some guidance on the impact duration of actual incidents.
Pacing the incident scenario
Pacing the incident simulation is an art rather than a science. All tests are constrained by time, and this is one area where some accommodation has to be made. Many major incidents occur over a timeframe of days – and sometime weeks. Clearly, it’s not practical to keep participants involved in a BCP test for that period. The time constraint requires that some thought is given to how quickly participants are advised of impact (bearing in mind that establishing the overall impact of a real incident, could take several hours or days). This can be overcome by creating inserts that provide updates on overall impact and at the same time inform test participants that, for the pruposes of the scanrio test several hours have passed since the last update
Establishing the expected outcome of the response to the incident scenario
During this type of Business Continuity Plan test, the test timeline will include expected actions to be taken. The expected action should be those outlined in the business continuity or incident response plan and taken in reaction to impacts and events that emerge during the test. Expected actions will be monitored by the BCP test support team who would be expected to follow the test timeline as the incident simulation unfolds. Establishing expected actions in advance forms a major part of the BCP test plan and the BCP test Results report.
Organising the facilitation of the incident scenario
A simulation test also requires more organisation than a walkthrough test. They normally involve more participants and there will be significantly more interaction between participants as they perform their designated roles. For this reason, any simulation will require some support to effectively coordinate and manage the test. The support roles required are:
Test Facilitator: the simulation test needs a facilitator to guide the test and ensure that the test timeline is adhered to.
Observer(s): During a simulation test, because of the number of participants, it can be challenging to capture issues and opportunities for improvement. One or more people dedicated solely to scrutinising what is going on during the test and evaluating whether correct actions are being taken so that lessons learned from the test are captured and logged.
The overall principle with testing your incident response and business continuity plans is to start simple & gradually build more complex tests as your confidence and expertise. Having the right tools to support the development of a business continuity plan test can ensure that your tests are as effective as they can be and are developed in line with accepted good practice
Follow or connect with Steve, RiskCentric's owner & founder via LinkedIn