Organizations are constantly exposed to risks and threats that may prevent business operations from running smoothly. Business interruptions may be caused by threats such as natural disasters, cyber-attacks, server failure or human error. Having a business continuity plan in place is important because this will help the company sustain its operations and recover valuable digital assets in the event of work interruption, data breach or data loss.
However, determining the effectiveness of a company’s business continuity management system in the real-world setting is also crucial. This can be done by testing the Business Continuity Plan (BCP) through the following schemes.
BCP Content Audit
The most basic way to validate the soundness of a BCP is by reviewing the contents of the plan itself. Representatives from the management team and other key officers must be gathered to review the plan and evaluate its feasibility and accuracy. Reviewing the plan means to check for items that are no longer applicable or to include new material that may further strengthen the plan. BCP audits must be done regularly, or at least every quarter to ensure that the plan remains updated and responds to the current needs, strategies and business directions of the organization.
Walk-Through or Run-Through
Conducting drills or live activities will allow employees to put into action what actually needs to be done during an unforeseen incident. This will determine how well employees follow procedures and measure response times which are both useful in evaluating if Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO) are met. Walk-throughs and run-throughs also facilitate better long-term memory retention of process components, compared to simply reading the contents of BCP plan.
Simulation
A simulation test, considered as the most realistic way to test a BCP, involves performing business continuity and disaster recovery duties in an actual work setting. BCP full-scale simulation tests will require participation of the management team, vendors, partners and employees. Tests may be held in a mock office environment and participants will be presented with realistic scenarios. Participants will have to perform the necessary procedures to determine how well they can carry out critical functions consistent with the BCP. The following are some examples of simulation tests that can be used to determine the effectiveness of the BCP:
- Data loss due to ransomware and other cyber-attacks, server/drive failure or human error
- Data recovery. If possible conduct a test that involves loss of massive amount of data
- Network outage due to loss of electricity
- Power or network outage due to on-site danger such as typhoon, earthquake, bomb threats or gas leaks
- Communication protocols during emergency situations
Simulations may be repeated to identify any plan improvements that need to be done or to increase the efficiency of response times. However, if time and resources will not allow repeated simulations, walk-throughs may be conducted instead.
After conducting the above tests, participants should evaluate the over-all performance of the plan by summarizing key observations and pointing out areas that need to be replaced, changed or strengthened.
As mentioned, BCP testing is an important step in measuring the effectiveness of a business continuity plan. Test results and observations provide valuable insights not only about the effectiveness of the plan but also the readiness of the company and its employees in case of disaster.
