Written by: Daniel J. Poucher, CBCP
You’ve been busy on your business continuity plan (BCP), and you think your disaster recovery test plan is up-to-date. You know how long it will take you to get your systems back up. Your alternate site is selected and ready to spring into action should the need arise. But what about everything that comes before? Do the people in your organization know what to do prior to the disaster declaration? Are you 100% certain they would know what to do and who’s responsible for what? Are you willing to bet the organization on it?
If you can’t respond to these critical questions with a resounding “yes,” then conducting a tabletop test as part of your disaster recovery plan (DRP) could be the missing piece in your BCP Testing program.
What is Tabletop Testing?
A tabletop test provides you and your colleagues an opportunity to test assumptions and confirm definitions based on real-world scenarios. In the exercise, you’ll go over the internal and external communication chains, notifications, assessment of damages, and the decision to declare a disaster. The people participating should be the key individuals responsible for the execution of the BCP. You will first organize different disaster recovery scenarios to test. Then, you will review specific details in the plan together and designate disaster recovery best practices, all while keeping in mind the Maximum Allowable Downtime.
During a typical disaster recovery test, the focus is on the recovery of systems to ensure that transactions can be processed from a location other than the production environment. These tests are usually performed from the point following the formal disaster declaration and focus specifically on the recovery of technologies and the performance of business functions. Tabletop testing could aid in your company’s preparedness to mitigate the disruption caused by these potential threats by assembling a plan to assure practices can be carried out in an environment separate from the crisis.
Keeping it Friendly
While tabletops can be done with no outside assistance, many people find using a third party offers objectivity and removes the elements of the exercise that could become political within the organization. It may be challenging for people who have spent a lot of time and effort creating the plan to recognize where there is missing or incomplete information. The role of the third party moderator is to gently highlight the challenges and decision making that may not be possible with those so close to the disaster recovery testing strategy. As an independent party with industry experience the third party can often bring a different perspective grounded in best practices and provide constructive criticism to make your plan even better.
