Business Continuity Awareness Week (BCAW) North Americas

June 21–27, 2009

This year’s Business Continuity Awareness Week (BCAW) runs from June 21 until June 27, 2009. The theme is Testing Recovery Capabilities. With this in mind, BCAW is designed to provide you with practical information you can begin using immediately to improve your own recovery capabilities.

A definition: “The purpose of testing is to achieve organizational acceptance that the business continuity solution satisfies the organization's recovery requirements. Plans may fail to meet expectations due to insufficient or inaccurate recovery requirements, solution design flaws, or solution implementation errors.”

Source: BCI Good Practices Guidelines (2008)

Testing, a.k.a. exercising, is one of the key stages in the BCM life cycle and yet it is the one stage that gets the least attention and investment. Without testing, all work completed cannot be confirmed or improved upon.

Just to put testing into perspective, you wouldn’t hire a juggler without first seeing if they could juggle, and you certainly would not want to be operated on by a brain surgeon who had not actually performed this operation before, would you? So why would you go to all the trouble of producing business continuity and disaster recovery plans without testing them at some point? An untested plan is an unproven plan.

Testing BC and DR plans is one of the most crucial steps in overall BC methodology. Without testing you cannot complete the continuous improvement cycle. Testing provides organizations with a proven method of validating their plans and actual recovery capabilities. Testing can provide confirmation that all of the described plan ingredients are fully in place and executable. Testing also provides a way to confirm or adjust as necessary your business-defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO), matching expectations with reality.

And what exactly is the difference between testing and exercising? The former implies a pass / fail model, while the latter emphasizes practice and facilitates validation and continuous improvement. The goal of BC / DR testing is to provide a “blame free” environment that enables discovery and improvement opportunities: therefore, it is important to avoid a pass / fail mentality. However, both terms have equal validity and are often used interchangeably.

There are many ways to approach testing and they all depend on a company’s BC maturity level. Initially, walkthroughs or tabletops may be conducted to provide low-cost and low-impact fine-tuning of plans. These are usually followed by more sophisticated off-line or parallel operation exercises validating high-impact services and, finally, full recovery testing to validate the entire plan. Exercises are typically announced in advance, but there are times when you may wish to consider conducting a surprise test.

Follow a proven testing methodology. Tests are purpose-designed, covering the goals, the scope and the test plan for the exercise. One approach is to use the test plan to build the test timelines. The results of the exercise are mapped to the plan as actual RPO and RTO results and issues are logged for follow up change management. This methodology allows you to see what the gaps are and to take steps for continuous improvement.

Testing should be conducted at least annually and also after significant changes in the business, key personnel or technologies. Testing your plan on a regular basis helps to improve responsiveness as the participants will be more familiar with the plan.

To further assist, the BCAW website features:

• Useful links to checklists, handbooks and tools aimed to help you improve your organization’s Testing Recovery Capabilitie.
• Related DRIE member articles outlining real examples of Testing Recovery Capabilities paying off.
• A blog to allow you to share you own Testing Recovery Capabilities stories.