Only 40% of IT organizations have tested their disaster recovery plans in the last 12 months, according to the 2013 InformationWeek State of Storage Survey.
Working at SunGard Availability Services, I see this lack of preparation first hand every day. SunGard offers Mobile MetroCenters® that bring custom-designed, fully equipped office space to customers to support their business continuity plan in the event of an emergency. During roadshows of the Mobile MetroCenter, customers are constantly coming up to me and telling me that they’ve had this service under contract for years, but have never actually been inside one before. And they’ve certainly never tested the Mobile MetroCenter in conjunction with their overall Business Continuity Plan (BCP).
Now testing disaster recovery plans is essential. You can’t just leave your recovery to chance or you’ll take a tremendous risk that your plan won’t work properly when you need it. The trouble is, doing a full “live fire” exercise of your recovery plan is time consuming and expensive. Such a test involves sending your people to a backup site; bringing up the computers; moving tapes from storage to the backup site—not to mention paying the high costs of transportation, housing, meals, test fees and so on. Which means that you want to ensure that your processes and procedures are complete before your schedule one.
Before a ‘Live Fire’ BCP test, Do Some Tabletop Exercises
Here’s where we get to Black Friday, as I hinted at in the title of this post. The way you plan for a Black Friday shopping expedition is a perfect example of how you would run one or more so-called “tabletop exercises” before you run a live fire exercise.
What do I mean?
Well, for many families, Black Friday is the center of their Thanksgiving tradition. Once they’ve gobbled up the turkey and cleared the dishes, the family members gather round the table to build their Black Friday battle plan. They set shopping objectives; search for coupons; create a step-by-step timeline; specify family staging, transportation, and gathering locations; and finally set up a tactical communications plan to relay deals that can’t be missed. They may even develop code words so as not to tip off other shoppers as they discuss a particularly good sale.
A tabletop exercise of your BCP is similar to this Black Friday planning session. You gather around a table and walk though your BCP step-by-step. The purpose is to ensure that you’ve included everything you’ll need to recover your critical business processes when disaster strikes and get your employees back to work. These steps include setting the exercise objectives; ensuring that you have the proper inputs and documentation; creating a step-by-step recovery timeline with employee staging, transportation, and gathering locations; and finally setting up a tactical communications plan to ensure that you can notify your vendors, employees, and stakeholders when disaster strikes. You may even develop a set of “pre-populated” messages as part of your crisis communications plan.
Tabletop exercises don’t cost a lot of money or take a lot of time. But they do help reduce expenses for your live fire exercises by letting you carefully hone your recovery processes before you actually test them out. You can talk through what you need to do. And if you find that you’re missing something, you can include that in your next tabletop go round. Once you’re satisfied that your tabletop exercises have caught all the holes in your planning, you can move to a real “live fire” exercise with a BCP that’s far more likely to succeed.
One final takeaway. When you go on your Black Friday expedition, you may have to leave one or more family members home because they’ve had too much to eat or drink or are in bed with the flu. Similarly, don’t let all your employees participate in the tabletop. If you know that you have a key employee that holds your BCP together, give them a vacation day and see if your company can still run the tabletop without them – after all, you need to know what would happen without that one key person should disaster strike.
This was first published on the SunGard AS blog.
