There are 8.2 million reasons to do business continuity testing in your organization. That’s because, as of July 2019, the average cost for a data breach or business disruption in the U.S. was $8.2 million per company. Companies have learned that it’s better to perform business continuity testing than being held hostage to disruption of services. Consistent business continuity testing that’s held on a semi-annual or quarterly basis can help gain buy-in throughout the organization and save you millions of dollars in the long-run.

Once your organization decides to proceed with the essential business continuity plan test (BCP), there is an exemplary 5-tier approach to BCP testing that’s worth implementing. Read on to learn how BCP builds resilience in your company and helps establish your organization as a business continuity expert.

What is BCP Testing?

Before you determine the benefits and how often you need to perform BCP testing, let’s understand its core definition, and how it can impact your company. Business Continuity Planning   involves developing a document that gives your company an outline of how the business will continue operating if there’s an unplanned disruption in service. The document is a plan that’s much more comprehensive than a disaster recovery plan because it contains contingencies that address every aspect of business that may be affected during a disruption. The BCP can even provide a contingency plan for business partners or any other company division that needs to be functioning in case of a disruption of service.

Reasons for Performing BCP Testing

Your business has to be able to respond quickly to interruptions of service so it can minimize the negative impact   the downtime is costing you. When you perform BCP testing, you also create an integral business document that helps your company fix, recover, and continue its day-to-day operations during disruptions. There are specific reasons for doing BCP testing, and all of them help contribute to minimizing the immense damage an interruption of service causes your company.

BCP testing helps you identify your company’s interdependencies, as well as gaps and areas for improvements. BCP testing also provides clients with a sense of confidence that you’re a company that demonstrates a commitment to delivering your services even with things seen and unseen happen to your company unexpectedly. BCP testing also allows for your company to have a continual process that helps you validate and improve your day-to-day operational plans, so they meet safety compliance requirements and reduce recovery time and cost.

Barriers to BCP Testing

It’s not always clear why any company wouldn’t perform BCP testing because they gain so much business continuity by having it in place. Some companies have managers in place who are afraid they may fail a BCP test, and other companies, clients, or employees will find out. In this case, one has to remember BCP isn’t about failing or passing. It’s about improving your business continuity plan and process in case of a disruption of service. There are some problems with organizational buy-in that sometimes prevent BCP testing from happening because executive support or leadership doesn’t see the value  in performing the test. Such logic needs to change because every company can and will benefit from BCP testing. If the leadership team involves itself with the testing procedures, the BCP test has the best validator of value possible.

What are Some BCP Tests in the Marketplace Today?

Every BCP test in a company has very targeted and specific ways and types of tests used to ascertain information in different areas within the company. The list below gives you some but not all the information about BCP test types and reasons.

1. Plan Review: Includes a BCP team with c-level management or department heads to see if their current BCP plan needs revisions. The plan review goes over recovery contract validity, business continuity management, and any disaster recovery scenarios that can be shared with other company teams.
2. Tabletop Test: Includes role-playing discussion exercises that are scenario-based, and you usually have employees participate so they can practice their roles and responsibilities in case of any disruptive emergency from an active shooter to a hurricane or tornado.

There’s also the BCP walk-through, which mimics the tabletop test discussions with planned details but takes those details and turns it into a simulation test that combines real recovery actions. The real scenario ranges from data loss backups and restoring to emergency notifications and physical recoveries.

The Five Tiers of BCP Testing

There is one best way to approach testing strategy, and that’s to apply the five tiers of BCP testing to get it done. BC expert Marc Easley devised the five tiers of how he approaches business continuity testing.

1.  A tabletop exercise is done with a third party solution working a full day at a test site. The tabletop exercises go over everything from prioritizing disrupting events to analyzing their cause and impact on the business. This includes things like reduced production capacity, severed communication or transportation lines, part shortages, etc.
2. Experienced user participants are an integral part of tier two in the recovery operation because they’re the ones critical to planning actions that treat disruption problems.
3. You’ll need to have a multi-site and multi-day strategy that includes sending some employees to work from home and some—to a mobile recovery unit.
4. There needs to be a dry run event where you shut down the office, send key personnel to the mobile recovery unit, and complete a dry run of the planned activities and solutions.
5. Finally, you need to choose a full-capacity day where there are as many employees as possible working and perform a mock test with no warning given to the employees.

This unannounced mock-up test will send some employees to work from a different location. The challenge in the different location scenarios is not everyone will have their laptops with them yet will still have the same roles and responsibilities. The element of surprise will also allow for testing how secure and fast their connections are at their homes.

The Final Step

The final step in performing and fine-turning your business continuity testing can provide clarity in company and employee responsibilities and locates resources for recovery should the worst happen in a disruption of services. There is only one way a business can do that well, and that’s by learning about BCP testing from the experts.

One of the most important things your business can do is test its business continuity plan. You might assume that because you have a written plan, your company is prepared for a disaster or business interruption, but how do you know your plan works until you test it? Below are four reasons that testing is essential.

1. Testing Your BCP Finds Interdependencies

Performing business continuity tests helps you identify interdependencies and gaps within your system databases and technology. For example, let’s say you were completing a test for a customer. During the test, they were able to recover their main application and network environment. However, they discovered there was a particular database the application made a call to for a subroutine. That specific database was housed in a separate environment and wasn’t being backed up. As a result, the entire system application that relied on that database wouldn’t have been able to operate during a real-world recovery scenario. It would have prevented an entire business unit from functioning. But because they chose to test, they were able to identify that interdependency ahead of time.

2. Testing Validates Compliance Requirements

Many businesses are required to have specific security protocols in place for compliance purposes. They also need to meet specific recovery time objectives (RTOs) driven by business objectives, regulatory requirements, or both. Unfortunately, sometimes when businesses are in the middle of an event, they tend to try to recover as quickly as they can, which can open up security issues. With testing, you can assess your ability to recover within your RTOs while validating that the required security controls are in place.

3. Testing Reveals Expectations vs. Reality

Differences between your current production environment and the recovered environment could cripple your employees’ productivity. People are used to using an application or software in a certain way daily. If an application isn’t configured to allow users to perform the desired functions, it will become ineffective to your employees. Testing will reveal any configuration changes you need to make.

4. Testing Business Continuity Produces Vital Documents

It’s critical for people going through an exercise to document work issues in a recovery scenario . Doing so will ensure the legacy of your work. If other people are involved in a recovery situation in the future, they have a written plan that can expedite recovery, rather than working out logistics that were resolved during a previous test. If you work with a business continuity services provider, that third party can leverage documentation on the customer’s environment to speed up the recovery. After a disaster strikes, people are typically dealing with the effects of the event and making sure their families are taken care of. That’s why key personnel are not always available to initiate the business’s recovery. In our experience, having detailed documentation can cut about six to 12 hours off the recovery process. By proactively identifying weaknesses in your business continuity plan, you can save yourself a lot of headaches down the road.

Our monthly report on the number and types of business interruptions we have responded to and companies we have recovered, providing our unparalleled business continuity and disaster recovery solutions.

DOWNLOAD REPORT

Synopsis

In a busy month of July, our Operations Team received and responded to 46 different alerts, and 9 declares for business interruptions. Assisting with recoveries across 10 states and one province, our team helped companies avoid downtime and continue serving their communities.

Among all interruptions our team managed, 39 of the 46 were weather-related. In addition, the Operations Team also orchestrated 12 customer test exercises across our operations facilities.

Here are three successful recoveries we’ve completed in July:

• A Global Healthcare Company requested six generators due to an approaching hurricane.

  A global healthcare company with more than 13,000 employees in 25 countries contacted our operations team. The company requested 6 generators, as hurricane Barry was approaching them. Our team deployed the necessary equipment within 24 hours from an initial phone call.

• An advertising media company conducted a company-wide drill to test their IT capabilities. For a company that has thousands of employees across the globe, the reliability of its network is a high priority when their business continuity is concerned. After making all the necessary arrangements, this client reached out to us to deliver 500 laptops across 4 different locations in a week.

We invite you to learn more about what we do or connect with us to chat about how we can help your business avoid any interruptions.

The importance of testing your business continuity and disaster recovery (BCDR) plan has never been a dry subject for us at Agility. With wildfire season around the corner, we wanted to learn a little bit more about the value fire departments find in testing their hydrants, as well as how we can learn from their examples. Here are several similarities we found between testing fire hydrants and BCDR plans.

Compliance

The National Fire Protection Association (NFPA) sets a standard for the minimum water flow that hydrants must meet. Testing hydrants ahead of time not only ensures the codes are satisfied but also maintains quality. If hydrants aren’t regularly maintained, they can rust, causing parts to snap off. If your business is subject to industry regulations like fire hydrants are, it’s important to test your BCDR plan regularly to ensure you’re meeting the compliance requirements . Otherwise, you expose yourself to potential regulatory violations, such as excessive downtime or rusty procedures, endangering you to security breaches.

Maintenance

Facilitating your business growth requires you to revise, modernize, and develop your current and future products and services, as well as the tools you use to deliver them. Hydrants are a part of a huge underground network that provides water access to an entire community. Sometimes valves have to be temporarily closed to allow for maintenance, but due to the complexities of this network, water flow can be reduced without ever being fully cut off from users. Unfortunately, after the work is completed, these closed valves are sometimes forgotten about and not reopened. While this omission doesn’t affect the community on a day-to-day basis, the reduced water flow wouldn’t be sufficient to put out a fire when needed for an emergency. Similar to hydrants, your BCDR plan needs to be updated and maintained to coincide with the progress of your company. Facilitating your business growth requires you to revise, modernize, and develop your current and future products and services, as well as the tools you use to deliver them. However, if you don’t consistently update and test your BCDR plan to ensure that it keeps up with the innovation of your business, your plan won’t offer the full flow of information you need to calm the fire, so to speak, when it comes.

Avoiding Neglect

One of the dangerous consequences of not regularly testing hydrants is that they become hidden, either by overgrown plants or by decorations placed by residents who find the sight of hydrants unpleasant. Unfortunately, when a crisis occurs, these obstructions can make it almost impossible for firefighters to find hydrants and carry out their jobs. Just as residents don’t want to look at fire hydrants, many companies don’t like to dwell on BC/DR planning because it’s not always pleasant to think about. Instead, they focus on revenue, shareholders, or customer growth. A common issue that we’ve seen over the years is businesses that have a plan but don’t make it a priority to regularly test. This leaves the BC/DR plan to get buried under more gratifying things, such as profits. We recommend taking the time to fully test your BC/DR plan at least once a year to help you work out any kinks before a disaster actually strikes. How often do you test your BC/DR plan?