TESTING

The success of a business recovery plan depends on testing its assumptions and solutions. Testing and training keep the plan up-to-date and maintain the viability of full recovery.

Tests can be conducted in a variety of ways: from reading through the plan and thinking through the outcome to full parallel system testing, or setting up operations at a hot site or alternate location and having the users run operations remotely. The full parallel system test generally verifies that the hot-site equipment and remote linkages work, but it does not necessarily test the feasibility of the user departments’ plans. Full parallel testing is also generally staged within a limited amount of time, which trains staff to get things done correctly under time constraints.

Advantages of the Distributed Environment for Testing

Because of their size and modularity, distributed client/server systems provide a readily available, modifiable, and affordable system setup for testing. They allow for a testing concept called cycle testing.

Cycle testing is similar to cycle counting, a process used in manufacturing whereby inventory is categorized by value and counted several times a year rather than in a one-time physical inventory. With cycle counting, inventory is counted year long, with portions of the inventory being selected to be counted either on a random basis or on a preselected basis. Inventory is further classified into categories so that the more expensive or critical inventory items are counted more frequently and the less expensive items less frequently. The end result is the same as taking a one-time physical inventory in that, by the end of a calendar year, all the inventory has been counted. The cycle counting method has several advantages:

•  Operations do not have to be completely shut down while the inventory is being taken.

•  Counts are not taken under time pressure, which results in more accurate counts.

•  Errors in inventories are discovered and corrected as part of the continuous process.

The advantages of cycle testing are similar to those of cycle counting. Response and recovery plan tests can be staged with small manageable groups so they are not disruptive to company operations. Tests can be staged by a small team of facilitators and observers on a continual basis. Tests can be staged and debriefings held without time pressure, allowing the participants the time to understand their roles and the planners the time to evaluate team response to the test scenarios and to make necessary corrections to the plan. Any inconsistencies or omissions in a department’s plan can be discovered and resolved immediately among the working participants.

Just as more critical inventory items can be accounted for on a more frequent basis, so can the crucial components required for business recovery (i.e., systems and telecommunications). With the widespread use of LANs and client/server systems, information systems departments have the opportunity to work with other departments in testing their plans.

SUMMARY

Developing a business recovery plan is not a one-time, static task. It is a process that requires the commitment and cooperation of the entire company. To perpetuate the process, business recovery planning must be a company-stipulated policy in addition to being a company-sponsored goal. Organizations must actively maintain and test plans, training their employees to respond in a crisis. The primary objective in developing a business resumption plan is to preserve the survivability of the business.

An organization’s business resumption plan is an orchestrated collection of departmental responses and recovery plans. The information technology department is typically in the best position to facilitate other departments’ plan developments and can be particularly helpful in identifying the organization’s interdepartmental information dependencies and external dependencies for information access and exchange.

A few protective security measures should be fundamental to the information technology department’s plan, no matter what the scope of plausible disasters. From operational mishaps to areawide disasters, recovery planners should ensure that the information technology department’s plan addresses:

•  An adequate backup methodology with off-site storage.

•  Sufficient physical security mechanisms for the servers and key network components.

•  Sufficient logical security measures for the organization’s information assets.

•  Adequate LAN/WAN administration, including up-to-date inventories of equipment and software.

Finally, in support of an organization’s goal to have its business resumption planning process in place to facilitate a quick response to a crisis, the plan must be sufficiently and repeatedly tested, and the key team members sufficiently trained. When testing is routine, it becomes the feedback step that keeps the plan current, the response and recovery strategies properly aligned, and the responsible team members ready to respond. Testing is the key to plan viability and thus to the ultimate survival of the business.