testing the business continuity plan

What is BCP testing?

Published on November 15, 2022

Jump to a section

Everything you need to know about business continuity, straight to your inbox.

Business continuity planning is only half the battle. An effective business continuity strategy must be effective in multiple scenarios and for various uncontrollable events.

You have put together a team responsible for crisis management and implementing your disaster recovery scenarios. To ensure business continuity, your key personnel must also ensure that these strategies have been tested and reviewed for effectiveness.

BCP testing involves a series of exercises and simulation tests to mimic the effects of the crisis. An effective testing approach must involve various scenarios so your team can handle any situation with ease. Your testing should encompass readiness for different BC incidents , whether a small-scale issue like a power outage or a large-scale event like a cyber attack or a natural disaster.

Why is it essential to conduct BCP testing?

As a business owner, a positive mindset can go a long way. But it isn't particularly helpful if you're conducting a risk management and assessment strategy. You need to anticipate, plan for, and mitigate risks before they occur. If you don't, the entire organization could crumble and your business continuity would be at risk.

Testing the business continuity plan (BCP) is a must when you are developing your operational resilience strategies. If you are not conducting BC plan testing, you have no way to ensure that the strategy you have in place is the best at managing your perceived risks and threats.

BCP testing enables you to achieve the following:

• Identify any gaps in your existing business continuity plan, develop ways to address them and take corrective actions to increase the plan's maturity.
• Identify interdependencies in various departments of your disaster recovery plan. You can use the test findings to develop a coordinated plan among department heads in the event of a disaster.
• Speed up your company's response to a crisis and ensure compliance requirements are met.
• Avoid having a damaged reputation because you can show your customers resilience during times of crisis.
• Ensure that your business continuity plan is current and updated. Take actionable findings from your business continuity plan testing to identify where improvements are needed.

As a business owner, you have the responsibility to assess your continuity plan and whether regular testing is needed to avoid revenue loss resulting from an inadequate plan.

How often should you perform testing on business continuity plans?

Many businesses perform an annual plan review while others do it every six months. There are no hard and fast rules on the frequency of performing business continuity plan testing. It depends on the unique circumstances and needs of your company, as well as the type and nature of risks.

One thing is definite, though: the more complex the plan is, the more it requires testing and review.

For example, a large multinational organization will require a more complex business continuity plan than a startup consisting of only five employees. The type of products or services offered by the company will also determine the complexity of the business continuity strategy and the subsequent business continuity tests to be done.

An extensive supply chain has more moving parts and that requires the company to ensure all those parts are working efficiently. Any disruption to the critical component of the company can result in the business temporarily halting operation, or inefficiencies in its operation.

Regulation is another factor that impacts the frequency of testing your business continuity plan. The healthcare and finance industries are two of the most highly regulated industries. If your company is part of this industry, you need to regularly conduct business continuity testing to ensure that you satisfy all the requirements for operation even during disruptive events.

The use of technological tools that automate business continuity plan testing is a smart investment for companies of all sizes. The automated review ensures that you don't have to perform regular manual testing of your business continuity strategy.

Why do companies fail to test their BCP?

In a nutshell, companies tend to realise how important business continuity planning is when disruptions have already affected their business. There are many factors and reasons why companies don't invest much time and effort in planning and testing, including:

1. Assumptions

Where time, effort and money have already been spent in the creation of a plan, businesses assume that the plan is and will always be effective.

Exercising will highlight assumptions such as whether all staff listed in the plan are available and able to complete their duty as required, if access is prohibited in required areas and for longer than anticipated, and if all IT systems and applications will be restored within expected timeframes and access to data be as expected.

It is these knock-on effects that have to be addressed in exercising, by coming up with solutions and going on to further exercise these.

For example, carrying out regular checks of the company call tree allows a company to evaluate the response rate of staff members and verify telephone numbers communication is of ultimate importance during an incident, and as we know, contact details can change at any time.

The crisis management team should then be able to use the plan effectively during an incident, and the individuals listed in the plan will be better equipped to respond to their assigned duties.

2. Prioritization

Secondly, where resources are sparse and time and personnel are vital, testing as a priority can get pushed down the list. Lack of commitment, budgets, complacency and buy-in can lead to any scheduled testing getting shelved. These will put your business resilience at risk.

Experience shows that untested plans have a greater likelihood of failure, resulting in lost revenue, damage to reputation and impeded customer fulfilment.

As vital as testing is to the success of BCM, you must however not put the business at risk through the process of testing. As this activity can be time and resource heavy, it can be a complex process which is costly to an organisation of any size. Taking people out of their jobs at critical times, highlighted in your BIA, can be expensive and unnecessary. Good testing should have focus and planning to avoid this.

3. Compliance

Another way in which a lack of exercise and testing can negatively affect a business is the relationship these activities have with compliance. To fulfil the requirements outlined within the official ISO standard for Business Continuity, ISO 22301 , exercising and testing must be conducted at regular intervals by an organisation, which must then evaluate and record the findings of these events to continually improve and update its BCMS.

The standard is focused around the 'Plan-do-check-act' management model, and in this case, testing and exercise would fall into the check' step within the model, which is defined by ISO as to monitor and review performance against business continuity policy and objectives, report the results to management for review, and determine and authorize actions for remediation and improvement '.

An organisation therefore must conduct these activities regularly should they wish to certify, or even align with these standards as they certainly will not be successful in doing so if not.

How to Perform BCP Testing

BCP testing should be able to provide you with confidence and validation that the BC and crisis management plans & strategies are feasible, and that all team members and staff are familiar with and understand their roles in the BC process.

Good testing should be focused and varied. There are various ways to test your business continuity plan. Make sure you use all of these methods so you can address various areas of your continuity plan and keep it updated.

The first tier of business continuity plan testing is the tabletop exercise. This testing method involves specific disaster situations and evaluating how your crisis response team deals with these scenarios. The goal of this test is to assess if any gaps weren't previously addressed.

To conduct the tabletop test, you must identify a realistic threat to the organization. Make sure that this threat is relevant to your industry or organization. Identify your continuity objectives for performing the tabletop test and create a schedule for how and when it will be conducted.

Use whatever information you obtain in the test, such as strengths and weaknesses, to create a successful continuity plan.

Plan Review

A plan review is like an audit of your business continuity plan details. It involves the business continuity team, department heads, and C-level management. They will take an in-depth look at the plan details to see if any areas need revision or if there are missing components.

The plan review is crucial for managers as they will be responsible for passing on this information to the rest of the employees. It's also a good opportunity to update the contact information of the BCP team as part of the emergency communication strategy.

It is also a type of test that is important if you have new employees. It should be included as part of their onboarding or training.

Walk-Through

A structured or walk-through exercise is another example of a test that you can use for the continuity plan. Unlike the tabletop test, this one is more active. It specifically deals with disaster recovery functions, such as restoring backup systems for data loss, verification of redundant systems, and addressing various mission-critical functions.

The walk-through test will involve the critical personnel who are part of your business continuity team. The critical personnel will be discussing plan details and designate roles on how to respond to a real-world disaster and the most disruptive events.

Full Simulation

The full simulation test is another method of testing your continuity plan details. This test must be performed to mimic the effects of a real disaster or disruptive event. You can also conduct a single-team simulation as part of testing a specific team's capacity to respond to specific disaster recovery scenarios.

A full-scale exercise is ideally done at full capacity; this means all of your employees and critical personnel are involved in the test. Make sure you undergo the previous exercises before you move on to the full-scale exercise.

Tips for keeping BCP current

Testing your business continuity plan ensures that it fits your organization's needs. It also minimizes the impact of multiple scenarios and disruptive events on the critical component of continuity.

However, test findings update your existing continuity plans to ensure that they are relevant even as the circumstances affecting your company might have changed. The industry and the conditions that it operates in are constantly changing. You have to develop a methodical and systematic review of your continuity plans to meet your specific needs and enable faster recovery.

The following tips will enable you to come up with actionable findings that ensure your continuity planning is relevant and accurate.

Regular testing is a must

Regular tests are important if you want your business continuity planning to succeed. Things are constantly changing in the business landscape. There are known threats to your company and there are also new threats that emerge. Some of the things that were not previously a threat to your business existence might be a significant factor that can lead to revenue loss or damaged reputation .

You need to conduct testing to be able to gather the critical information and plan for how you can prepare for these different scenarios.

Internal communication is key

Communicating the overall risk and benefits that can come from an effective exercise and testing programme should be key to aid buy-in, support and uptake.

Making sure departmental awareness training is up-to-date is vital and makes testing more worthwhile. If an incident does occur and those listed in the plan have been trained and had their roles communicated effectively, then there is a greater chance of executing the plan successfully.

Integrate your business continuity planning with your Business Impact Analysis (BIA)

The most effective and updated continuity plans are those that accurately measure the scale of a disastrous event's impact on your company and its revenue potential.

Test your vendor's continuity plan

This approach is critical if your business relies on an effective supply chain management system. You need to ensure your vendor's success as it is also critical to your business success. It's a good idea to conduct facilitated discussions with critical vendors as they are an integral part of your continuity.

The Bottom Line

A business continuity plan provides your organization with a blueprint for what steps to take in the event of a disaster. However, continuity planning is only as good as it fits the purpose. BCP testing is one of the ways that you can evaluate if the current plans and measures are aligned with your goals and needs.

Creating the business continuity plan is only the first step. You have more work to do in terms of testing and reviewing the results to ensure that it's doing its job in protecting your company from disruptive events, and enabling you to stay open.

An effective business continuity plan will help your business get through any operational downtime. Utilising a tool or software to assist in your BCP planning, including your testing and exercises can significantly improve your processes and simplify things for everyone involved.

Benefits of using web-based software to aid your Business continuity plan testing

At Continuity2, the Exercising module creates the exercise types according to your specific organisational needs, schedules the test, invites the relevant employees by email, defines the aims of the exercise, and communicates the details to the participants.

Once completed, the software reports on the observations of the exercise and records recommendations and actions raised as a result of the exercise. All reports are distributed and signed off via the software and held within the system for Audit purposes.

Exercises are created and calendared via a simple to use interface where all of the exercises for an entire organisation can be planned and communicated easily, i.e. 15 minutes to plan and document an exercise and 20 minutes to report on the exercise after completion. Post-exercise reports are automatically produced by the system. Actions to improve are automatically captured in the systems action tracking module and included as part of the corrective action or continuous improvement function if desired.

Book a demo today to see the software in action and learn how to maximise your BCP testing processes and results.

Written by Aimee Quinn

Resilience Manager at Continuity2

With an Honours degree in Risk Management from Glasgow Caledonian University and 6+ years in Business Risk and Resilience, Aimee looks after the design and implementation of Business Continuity Management Systems (BCMS) across all clients. From carrying out successful software deployments to achieving ISO 22301, Aimee helps make companies more resilient and their lives easier in the long run.

• Need help now? Talk to our Incident Response Team
• 605-923-8722
• [email protected]
• Request a Quote
• Cyber-RISK Login
• Join Our Mailing List
• Job Openings
• Network Security Audit
• Vulnerability Assessment
• Penetration Testing
• Social Engineering
• CyberSecurity Partnership / vCISO
• Incident Response Team
• Business Continuity Planning
• Incident Response Planning
• Security Awareness Training
• Full Service Vendor Management
• FTC Safeguards Rule
• Virtual IT Audit
• Remote Work Security Assessment
• Microsoft 365 Controls Assessment
• Cybersecurity Essentials Assessment
• Incident Readiness Assessment
• Certifications
• Hacker Hour
• Free Downloads
• Meet Our Speakers
• Speaker Request
• TRAC: Risk Management Software
• KnowBe4: Phishing Assessment Tool
• FFIEC Cybersecurity Assessment
• Verify: ACH Fraud Detection Software
• Cybersecurity Toolkits
• Join a Weekly Demo!
• Our Company
• Working at SBS
• Words From Our Employees
• Testimonials
• Endorsements

Four Steps to Better Business Continuity Plan Testing

Business continuity planning is a process that is vital to your organization. There is always the possibility that your organization’s critical business processes could be negatively affected for reasons that are often beyond your control, so it's best to be prepared. If a disruption occurs, it’s essential that your organization has a plan to address any potential issues and ensure that your organization can still serve your customers.

However, if you’ve never enacted your plan, it’s hard to be confident that your plan will be sufficient. Testing your business continuity plan (BCP) helps to continuously improve your ability to recover successfully from various scenarios, whether it be a natural disaster or a communications failure. The good news is that there’s not just one way to test your BCP. Here are four steps to help you build a better business continuity plan testing program and ensure you are prepared for any situation that may come your way.

______________________________________________________________________________________________

The first step to better BCP testing is to incorporate different testing methods. You can utilize various methods to test the usability and effectiveness of your business continuity plan. Some of the possible test methods provided by the FFIEC include:

• Tabletop Exercise: A tabletop exercise (sometimes referred to as a walk-through) is a discussion during which personnel review their BCP-defined roles and discuss their responses during an adverse event simulation. The goal of a tabletop exercise is to determine whether targeted plans and procedures are reasonable, personnel understand their responsibilities, and different departmental or business unit plans are compatible with each other.  
• Limited-Scale Exercise: A limited-scale exercise is a simulation involving applicable resources (personnel and systems) to recover targeted business processes. The goal of a limited-scale exercise is to determine whether targeted systems can be recovered and whether personnel understand their responsibilities as defined in the plan.  
• Full-Scale Exercise: A full-scale exercise simulates full use of available resources (personnel and systems) prompting a full recovery of business processes. The goal of a full-scale exercise is to determine whether all critical systems can be recovered at the alternate processing site and whether personnel can implement the procedures defined in the BCP. For example, a full-recovery exercise might simulate the complete loss of primary facilities.

Step two is to understand how often to test. Although there is no hard-and-fast standard for determining how often to test your business continuity plan, some general guidelines are typically recommended. Note that each of these timeframes will depend on your organization’s industry, size, personnel, available resources, and current BCP maturity levels. Don’t take these timelines as gospel, as they are strictly that: guidelines.

SBS recommends reviewing each of your emergency preparedness plans (business continuity, disaster recovery, incident response, and pandemic preparedness) throughout the course of a given year. Testing would typically include an annual tabletop test of all four individual EPP plans, testing multiple scenarios for threats you identify as a higher risk to your organization. Be sure to test the scenarios you believe to be the highest risk to your organization most frequently. You can use your business continuity risk assessment to help identify which threats are particularly impactful/probable to the organization.

Additionally, a limited-scale exercise is recommended at least annually, but such a test is largely dependent on the size and complexity of your organization and the maturity of your failover procedures. For example, if your organization’s goal is to have a fully-functional failover DR backup site, but you have not yet achieved full-failover mirroring and backups, implementing this complex backup process and testing to ensure everything works correctly from failover to failback may take years to achieve. In comparison, testing file-level restores from nightly backups is something any organization can do quickly and frequently today.

However, if your organization has any significant changes in processes, systems, or plan details, you may want to perform these tests more frequently. To reiterate, these timelines are highly dependent on your organization; it may not be feasible or logical to perform some of these tests at a particular frequency. Base this decision on your organization and its specific needs.

If you are looking for somewhere to start and what should be prioritized for testing, refer to your business impact analysis . This is an excellent way to not only identify your most critical processes, but also the assets/systems you rely on the most. Systems that you require to keep your most critical processes functioning should be tested more frequently, allowing you to validate proper recoverability and the timeframes of that recovery. Most organizations benefit greatly by having a testing schedule documenting their plans. This allows for a strategic approach to testing involving the organization's processes, systems, and vendors deemed necessary.

Including your vendors is the next step in improving your BCP testing. In the course of your testing cycle (whether a tabletop test, limited-scale exercise, or full-scale exercise), you’ll want to ensure your critical vendor partners are included in the testing process to whatever extent possible. Involving your vendors in this process not only allows you to test to a greater degree of accuracy and usability but also allows your vendors a chance to provide feedback that may be valuable to your plans or testing process.

Finally, step four is to document your testing. Be sure to document the results of any testing performed, along with any actionable findings from those tests. Following up on these items and incorporating recommendations resulting from tests is the most important process in the BCP testing lifecycle. Testing, documenting the results of your testing, and implementing processes to improve your BCP is the best way to strengthen your organization’s response processes.

Testing, documenting the results of your testing, and implementing processes to improve your BCP is the best way to strengthen your organization’s response processes.

Resources and Testing Options

Numerous additional resources that your organization may use or participate in to continue maturing your BCP testing program are widely available. Here is a list of organizations and resources to help you perform such testing on your own organization’s BCP:

• FS-ISAC (Financial Services Information Sharing and Analysis Center) Exercises - https://www.fsisac.com/Exercises : A range of exercises, performed throughout the year, in which your organization can register and participate, including simulated cyber-attacks on payment and insurance systems, cyber-range, and regional exercises.
• US-CERT (United States Computer Emergency Readiness Team) - https://www.us-cert.gov/ccubedvp/business : A suite of resources focused on cybersecurity resilience and BCP testing resources.
• FDIC Cyber Challenge - https://sbscyber.com/resources/fdic-resource-a-community-bank-cyber-exercise : A set of vignettes created to encourage community financial institutions to discuss operational risk issues and the potential impact of information technology disruptions on common banking functions.
• Department of Homeland Security/FEMA Business Continuity Planning Suite - https://www.ready.gov/business-continuity-planning-suite : Video training series focusing on BCP basics, why a BCP is important, and best practices on generating and updating a BCP.
• FEMA (Federal Emergency Management Agency) Independent Study Courses - https://training.fema.gov/is/crslist.aspx : Free courses provided by FEMA covering a wide range of topics, including DR response (fires/flooding/earthquake/tornado), pandemic response, effective communication, damage assessment, and more. FEMA also maintains Emergency Planning Exercises and free downloadable tabletop exercises here, https://www.fema.gov/emergency-planning-exercises .

Other Sources

• https://ongoingoperations.com/business-continuity-test/
• https://dynamicquest.com/3-ways-test-business-continuity-plan/
• https://www.ready.gov/business-continuity-planning-suite
• BCM (ffiec.gov)

Updated by: Cole Ponto Senior Information Security Consultant - SBS CyberSecurity, LLC

SBS Resources:

• A key piece to any Information Security Program is a high-quality business continuity plan (BCP). Let SBS help design and test a comprehensive plan that encompasses four areas: business impact analysis, business continuity, disaster recovery, and pandemic preparedness. A well-structured plan can help mitigate the negative effects of a natural disaster, unexpected power outage, widespread illness, and many other unexpected events. Learn more.

Related Certifications:

Join our growing community of financial service professionals showing their commitment to strong cybersecurity with a cyber-specific certification through the SBS Institute. Click  here  to view a full list of certifications.

Upcoming Webinars

Cyber Showcase: VCISO - The Gift That Keeps on Giving

Webinar: FDIC InTREx Changes and Their Impact on Your Next IT Exam

Hacker Hour: What's Hot in Social Engineering

Cyber Showcase: The "Other" Risk Assessments

Recent Posts

The New R-SAT: Changes in Latitudes, Changes in Attitudes

Grab and Go Resources for National Cybersecurity Awareness Month

Press Release: SBS CyberSecurity Welcomes Director of Product Management and Chief Revenue Officer

Top 5 Most Common Incident Response Scenarios

• CB Security Manager
• CB Security Technology Professional
• CB Vendor Manager
• CB Cybersecurity Manager
• CB Ethical Hacker
• CB Incident Handler
• CB Security Executive
• CB Business Continuity Professional
• CB Vulnerability Assessor  
• Certified TRAC Professional

(605) 269-0909

[email protected]

Testing, testing: how to test your business continuity plan

Related Articles

Disruptions are by their nature unexpected. but your organisation’s response to hitting pause on normal business operations doesn’t have to be equally as unexpected..

A comprehensive business continuity plan maps out every stage of your business’ response to relevant risks that could affect business-as-usual. This could be a powercut, a cyber-attack or a supply failure. Whatever the disruption, the right continuity plan can ensure that your business minimises downtime and recovers as quickly as possible, reducing the risk of lost revenue or reputation.

However, even the most detailed plan can become ineffective if it is not regularly tested. Businesses rarely stand still, and this means your plan may have to adapt to new circumstances. Lack of knowledge, communication and practice can also compromise your business’ response, which could extend your recovery.

So, how should you test your business continuity plan, and how often should it be put in practice?

How often should a business continuity plan be tested?

There is no hard and fast rule that governs how often your business should test its plan.

It really depends on the complexity of your business and the number, scale and likelihood of the risks it faces. These should be identified as part of a Business Impact Assessment (BIA), which will inform your business’ response.

If your business has high risks for revenue loss, a damaged reputation or the possibility of lengthy downtime, then testing should be carried out more regularly and more areas of the plan should be tested.

The regularity of the testing is also dependent on the type of test being performed.

How can a business continuity plan be tested?

There are three main ways of testing your business continuity plan: checklist or walkthrough exercises, desktop scenarios or simulations.

Checklist or walkthrough exercises

A checklist or walkthrough exercise is one of the easiest forms of test. It consists of a desktop exercise in which senior managers determine if the plan remains current by checking off or ‘walking through’ each step.

When going through the plan they should also ask key questions, such as does the business have the right supplies to cope? Are copies of the plan known by key personnel? Do key personnel know what their roles are?

To make this test as valuable as possible, an emphasis must be placed on any weak areas. The mission is not to find fault or assign blame, but to promote improvement, which will make your plan more effective if the worst should happen.

Desktop scenarios

A desktop scenario test is a little more specific than the checklist. Using a scenario relevant to the business, this test can help you to establish all the processes of your business’ response to a specific disruption. For example, you can check the processes of your plan in the event of sudden data loss.

Simulations

Simulations are full re-enactments of business continuity procedures and could involve most, if not all, of your workforce. They also tend to take place on site in the relevant business areas.

In this test, each employee involved will need to physically demonstrate the steps needed in order to react to the disruption and recover from it. This could involve driving to a back-up location, making phone calls, completing communication templates or visiting server rooms. These kinds of tests are good for establishing staff safety, asset management, leadership response, relocation protocols and any loss recovery procedures.

Due to the large scale of a full simulation, these kinds of tests may be limited to annual occurrences. They may also need to be moved to quieter business days or even non-operational days so that disruption to normal work is minimised.

Organising a test

Before beginning a test, you will need to set out a clear objective as well as define exactly what is being tested. For example, you may want to check your continuity plans in the event of a power outage.

For a desktop exercise, you need to ensure that key personnel or top management are available to participate. A venue also needs to be arranged, but this doesn’t necessarily have to be in a key location unless you are planning a simulation.

Before the test, circulate the testing plan along with the objective to everyone involved. This team should also familiarise themselves with the current business continuity plan.

Assign some people within the team to record the test’s performance and any shortcomings that are identified. After the test, feedback should also be sought. These findings then need to be formally recorded and used to update the business continuity plan. Once finalised, the revised plan should be shared among the workforce.

Remember that testing a business continuity plan is not about passing or failing – it is about improving processes to give your business the best possible chance of dealing with disruption. Regular testing asserts the effectiveness of your processes, trains your staff in what to do for faster, more confident responses and highlights areas that need strengthening.

Solution for disruption

Business continuity plans give your business a blueprint for disruption survival, but only if they are fit for purpose.

An internationally recognised mark of best practice, ISO 22301 will enable you to implement, maintain and improve a business continuity management system, which will support your business before, during and after disruption.

To find out more, visit our dedicated webpage for  ISO 22301 .

You can also get in touch on  0333 259 0445  or by emailing  [email protected] .

Sign up to get the latest in your inbox

• Email address

About the author

Claire Price

Content Marketing Executive

Claire worked for Citation ISO Certification between 2020 and 2022 writing creative and informative content on ISO certification and consultation to help businesses reach their potential.

Looking for some guidance? Join us for one of our upcoming seminars!

QMS International use cookies to provide you with a better site experience, enable features and to help us understand how our website is being used.

By continuing, you consent to the use of cookies in accordance with our Cookie Policy

Allow All Cookies

Allow Strictly Necessary Cookies Only

Please Wait...

• Español (LATAM)
• Português (LATAM)
• English (APAC)

How to Maintain and Test a Business Continuity and Disaster Recovery Plan

Proactively planning for how to respond to a disaster and get your business operations back online is key to building business resiliency. And in today’s tempestuous business environment, resiliency is everything.

A comprehensive, thoroughly tested business continuity and disaster recovery plan is one of the best ways to protect your organization from data and revenue loss during an outage, cyberattack, or natural disaster. 

Though they are technically two separate plans, business continuity and disaster recovery work symbiotically to create a robust safety net for your business operations, systems, and data.

A business continuity plan defines the business’s critical processes and gives detailed instructions for your organization to follow in order to continue operating during an emergency. This plan must identify and include all time-sensitive and mission-critical business functions and processes, as well as company assets, human resources, business partners, and stakeholders. 

Your disaster recovery plan should focus on getting the IT infrastructure back up and running after an unplanned disruption or natural disaster. This is just one step in business continuity—albeit a crucial one—which is why businesses need to ensure they have both plans ready, waiting, and tested before a crisis hits.

Four Steps for Maintaining and Testing Your Business Continuity and Disaster Recovery Plan

Business continuity and disaster recovery are not set-and-forget initiatives. Business objectives and processes change frequently, employees move into and out of roles, and technology is in a constant state of flux. So once you have your initial business continuity and disaster recovery plans established, integrated, and fully tested, you move into maintenance mode . During this phase, your focus becomes anticipating and adapting to changes and ensuring your continuity and recovery plan stays up to date and functional.

Here are the four main steps to future-proofing your crisis response efforts so you can be confident your business continuity plan will work when it needs to.

1. Plan for change management. 

Many organizations are experiencing an unprecedented level of change these days. To ensure continuity in the event of a crisis, it is important to monitor changes in the organization and its external environment, including people, processes, and resources. Have a documented process in place to control changes or revisions to the plan, and be sure to update the plan regularly.

2. Conduct testing.

When was the last time you fully tested your business continuity plan from end to end? If it’s been a while, stop reading and put it on the calendar now. The middle of a 100-year flood is no time to discover your backups are corrupt. 

Regularly scheduled testing will help prevent massive data loss and get your business operations up and functioning quickly after an emergency. A full, end-to-end test of your plan will be time consuming, so for expediency’s sake, schedule different types of testing at repeating intervals:

• Checklist test (bi-annually): This is a high-level check to ensure objectives are still being met by the current plan. Correct the plan as needed and recirculate it to all stakeholders.
• Walkthrough test (annually): Sit down with all stakeholders, leadership, and your business continuity response team to look for gaps and out-of-date information. This should be a business-driven (not IT-driven) review to address changes to business objectives and priorities, not the technology.
• Comprehensive test (every other year): This review should include a reassessment of risks, a new impact assessment, and an updated recovery plan.
• Full interruption test (every 2-3 years): Simulate a real disaster and walk through your business continuity plan from start to finish so you are confident that operations can be quickly restored after an unplanned disruption, cyberattack, or natural disaster.

Just to keep things interesting, conduct periodic, unannounced “emergency” tests to help you observe the plan in action and test employees to make sure they know how to respond to a real crisis.

3. Require training.

Your business continuity plan is only helpful if your employees know how to implement it. When you initially create your plan, it’s important to form a business continuity team that will own the process and educate others.

During maintenance, your business continuity team will select a set of training methods, then create an ongoing schedule of business continuity awareness and training activities. These sessions will address any gaps in business continuity and disaster response knowledge so the organization can take unified, appropriate action to respond to threats as needed.

4. Perform an audit.

The final step in effectively maintaining your business continuity and disaster recovery plan is to invest in a third-party, impartial review of the plan.

This audit will determine whether the plan is in compliance with the organization’s internal policies and whether it meets external regulations and standards. It will also identify gaps and weaknesses in any of the maintenance steps. 

When the audit is complete, update the business continuity plan with any needed changes identified by the audit.

These four steps can help you maintain and test your business continuity plan so your organization recovers quickly after a disaster, technology failure, or cyberattack. 

For optimal protection, consider investing in a business continuity solution that provides a cohesive data security, protection, and retention strategy. A comprehensive continuity and disaster recovery solution can streamline your business continuity processes and provide additional data and cybersecurity features for greater peace of mind.

If you don’t have an up-to-date business continuity plan or world events have prompted you to reassess your current plan, download Arcserve’s How to Build a Disaster Recovery Plan to learn how to protect your business-critical systems and data in an emergency.

• Business Continuity
• Disaster Recovery

Business continuity plan maintenance: How to review, test and update your BCP

We've written before about how all organizations need to have a robust business continuity plan . A comprehensive BCP gives your business assurance that it can continue operations, even in the event of an unexpected incident or full-blown crisis.

Putting in place a plan is the first stage in this process, but far from the only on Business continuity plan review checklist. Business continuity plan maintenance, review and testing form equally vital steps in your business continuity strategy.

Is Business Continuity Plan Maintenance Important?

Those who were best-prepared have shown themselves to be most resilient when it comes to facing the challenges of Covid-19 . The pandemic has provided an all-too-live example of the need for a plan B. If ever there was a time to be confident in your business continuity strategy, it's now. However, it's a mistake to think that creating a BCP is a one-time exercise; that once you've put your plan in place, you can sit back and breathe a sigh of relief. There's no room for complacency in business continuity ' the threats you face are ever-changing, and the potential remedial actions need to evolve in tandem. Your business continuity plan might follow best practice guidelines. You might be certified to ISO23301 standards and have put in place the ideal team to manage your disaster planning and BCP strategy. But none of this compensates for a BCP that has grown stale, failing to move with the times when it comes to identifying the latest threats and using the newest approaches to tackle them. That's why reviewing, testing and updating your BCP is as vital as the process of creating a plan in the first place.

Questions You Should Ask When Scheduling BCP Reviews and Drills

Your BCP   plan needs to be a   living document . Creating a BCP isn't a one-off; once you have put your plan in place, you should ask yourself the following questions:

• How often should a business continuity plan be reviewed?
• How often should a business continuity plan be tested?
• How often should a business continuity plan be updated?

Here we look at each of these questions and identify the best strategies for testing, updating and reviewing your plan.

The Importance of the Business Continuity Plan Review

Why is it important for the business continuity plan reports to be submitted and reviewed regularly? There are several reasons:

• The nature and severity of the threats you face may change
• Your business operations may have evolved, leading to, for instance, a larger number of entities or subsidiaries to consider in your planning or new operating geographies . You may have taken your company public , which brings with it a range of new regulatory obligations
• Your personnel may have changed, so the people responsible for continuity planning may re no longer be current

Your business continuity plan should be reviewed when any of these situations apply. How often you should review your plan is another question organizations often ask; cio.com recommends that you '''Bring key personnel together at least annually to review the plan and discuss any areas that must be modified.''' Feedback from employees is essential in the review. Intentionally seek input from those involved in creating the plan and those involved in its execution. What can they tell you about changes to staff, operations or other factors that impact the plan? This is particularly important if you have numerous locations or remote operations where changes might not be immediately apparent to people sitting in a headquarters building. Ensuring your plan is based on comprehensive, accurate information about all your entities and subsidiaries ' a '''single source of truth' for your entire organization ' is vital. Putting in place a checklist is often a good strategy for any business review, and your BCP is no exception. Consider creating a business continuity plan review checklist to ensure you capture all the elements you need to consider. And of course, if you've been unfortunate enough to face a business continuity issue that forced the enactment of your plan, you can use the real-life experience you gained to finesse it. What worked well; what should be changed?

Business Continuity Plan Testing Considerations and Best Practices

Testing is an equally essential stage in ongoing BCP management. What should testing your business continuity plan look like? And during what stage of the business continuity lifecycle do we need to test the business continuity plan? Of course, the real test is an incident itself. But doing business continuity drills will give you the reassurance that your plan is robust enough to face a real incident ' and enables you to determine this in a less pressured way than waiting for a real crisis. 

Business Continuity Plan Testing Types

When it comes to types of business continuity plan testing, there are three main routes: a table-top exercise, a structured walk-through or full disaster simulation testing.

First: Table-top or role-playing exercises allow everyone involved in the plan to go through it and identify any missing steps, inconsistencies or errors. Second: A walk-through is a more in-depth test of your approach, with everyone involved examining their own responsibilities to spot any weak points. Third: A full simulation of a possible disaster goes a step further, creating a scenario that mirrors an actual disaster to determine whether your plan enables you to maintain operations. It should include your internal team, alongside any vendors or relevant external partners like security or maintenance companies. However you test your plan, it should be rigorous - CIO suggests that '''you try to break it' to ensure that it's fit for purpose. And whatever route ' or combination of approaches ' you choose, you should carry out business continuity plan testing at least once a year.

How To Keep Your Business Continuity Plan Current

Of course, however comprehensive your reviews and testing, they're of no benefit if you don't act on the findings. Updating your BCP is the final stage in the business continuity plan maintenance lifecycle, taking on board the results of your walk-through or simulation and finessing your plan to adopt any improvements noted during your reviews and tests. How often should a business continuity plan be updated? Every time you identify any shortcomings ' whether this is due to your testing/reviewing regime or whenever any errors or omissions come to light. What elements should you consider in an update? While all aspects of your plan are worth checking to ensure they remain current, some areas deserve singling out for special attention:

• Your contact list: To ensure you have up-to-date details of everyone you need to contact in the event of an incident.
• Your business entities and subsidiaries data : This forms the basis for your plan. Do you have an up-to-date picture of your organizational structure? Do you have accurate information on all your legal entities and critical functions?
• Challenge assumptions: Play devil's advocate to challenge your beliefs about incidents that could occur.
• Your technologies and systems: Including entity data management software , CRM systems and other IT systems central to supporting your operations.

Maintain Confidence in Your BCP

It's clear, then, that putting in place a BCP is only the first step. Reviewing, testing and updating your plan are all equally important stages. In other words, business continuity plan maintenance is crucial. Underpinning all of this is the need for reliable data on your organizational structure, people, systems and dependencies. Diligent's software suite can help you create the single source of truth you need to manage all your business entities effectively. Find out more by getting in touch with us for a no-obligation demo.

Solutions Solutions

• Board Management
• Enterprise Risk Management
• Audit Management
• Market Intelligence

Resources Resources

• Research & Reports

Company Company

Your data matters.