How to perform a recovery simulation test for business continuity planning

Our last post discussed performing a simulation test for your IT department. Although the process is similar no matter which department you are testing, there are a few differences. This test involves simulating the actions following a disaster situation using materials and equipment provided for at the recovery location.

Participants

  • Business recovery coordinator
  • Team leaders, customers and alternates
  • Facilitator
  • Other personnel as necessary

Procedures

  • Business continuity coordinator
    • Schedule everyone involved and arrange for facilities to conduct the recovery simulation
    • Make sure all equipment and supplies stored off-site for recovery operations are available to be used during the recovery simulation
    • Assist in documenting the activities that occur during the exercise and discussions during the debriefing
    • Participate in the post-exercise debriefing and evaluation
    • Maintain a file of updated forms to document that the review and test have been performed
    • See that updates are applied to your plan and revised plans are distributed according to the distribution register

Facilitator

  • See that the plan, including exhibits, has been distributed to each participant and has been updated before the exercise
  • Prepare materials and scenarios to be used the simulation, and arrange with the business recovery coordinator for personnel to assist in conducting the exercise
  • Meet with all participants to explain the purpose and scope of the test, explain the sections of the plan to be exercised, and detail assumptions and limitations to be applied during the exercise
  • Describe the disaster scenario (situation) to be used for the exercise backdrop, including:
    • Type of disaster
    • How it was reported
    • Time of day and day of month the disaster was reported
    • Extent of damage to the site and anticipated period of unavailability
    • Extent of damage to equipment, including time frame for replacement or repair
    • Effect on facilities, surrounding geography, voice and data communications, personnel (i.e., injury or death), etc.
    • Plan activation criteria and determine whether the plan is activated under the described circumstances
    • Dismiss the teams to their team leaders to initiate their activities for responding to the situation and recovering operations
    • Monitor the various team activities, noting the performance and understanding of their responsibilities, carrying out activities relevant to the recovery, and coordinating with personnel and teams. Identify enhancements to the plan and team preparation
    • Introduce additional challenges or situations during the simulation to which the team customers need to evaluate and respond. Coordinate “actors” who are assisting with the simulation in their delivery of situations to which the teams are expected to respond
    • Reassemble the teams following completion of the test for a debriefing to discuss general observations, ideas, suggestions and teamspecific changes or suggestions
    • Evaluate the group’s performance in responding to the disaster scenario, identifying enhancements to the plan and the level of team preparednes
    • Meet with the team leaders individually to discuss specific suggestions and changes that will enhance the plan and the future testing environment
    • Prepare a report on the exercise, follow-on activities and recommendations for future exercises
  • Team leader or alternate
    • Review the applicable sections of the plan
    • Prepare the team customers for the exercise
    • Direct the team customers through the recovery process as dictated by the simulated disaster situation
    • Note additions, changes and deletions to the plan
    • Provide the plan maintenance form to appropriate personnel
    • Complete the test results worksheet to help the team document the tests and results
    • Return the completed forms to the person responsible for updating the plan or to the business recovery coordinator by the due date. If no revisions were necessary, the team leader should prepare a brief memo to the business recovery coordinator documenting that no revisions to the plan were necessary
    • Prepare the exercise report, which should contain the following information, and forward to management:
      • Exercise objectives and participants
      • Date exercise was performed
      • Activities performed
      • Degree to which the objectives were achieved
      • Statements about identified revisions to the plan or that no revisions were required
      • Recommendations to further improve preparedness
      • Comments and future exercise recommendations
  • Team customers
    • Review the applicable sections of the plan, understand the duties for recovery of operations and perform the activities described in the plan:
      • Use the equipment and supplies provided for recovery
      • Interact with the actors simulating the situations to be performed
      • Initiate and respond to communications for carrying out the recovery activities
      • Complete all exhibits and worksheets relevant to the exercise
      • Participate in the post-exercise debriefing and evaluation
      • Prepare and assist in plan updates or enhancements