Introduction to Table Top testing your BCP (Business Continuity Plan)
Table Top Business Continuity and Disaster Recovery Plan Exercises and Tests are becoming more popular. They are gaining popularity for a very good reason.
In today’s competitive and time-poor business landscape, very few organizations have the flexibility for Business Continuity or Disaster Recovery exercises. These exercises often interrupt normal business operations for an extended period.
Benefits of BCP Table Top Testing and Exercises
The Table Top testing method provides a non-disruptive, low-cost, and regulatory-compliant option to traditional contingency testing.
We believe that a ‘Live Scenario’ test (see table below for explanation) will yield better lessons and results than a Table-top test. However, if conducted frequently and comprehensively, the Table Top testing method is another string in your business continuity bow.
The primary purpose of any type of business continuity test is to ensure that the continuity strategies, plans, and procedures are fully understood by all concerned. They must also be fit for purpose on an ongoing basis.
The success of a test cannot be judged solely on whether it worked exactly according to plan (they rarely do!). The real success of a test lies in the value gained from its performance. This is especially true in identifying and resolving problems.
The objectives of BCP testing and exercising are to ensure that:-
- Staff are aware of their responsibilities and duties;
- Staff training has been adequate
- All necessary resources are available as detailed in the recovery plans
- All supplies can be obtained as anticipated
- The plan is current and reflects current arrangements and procedures
- Bottlenecks, uncertainties, and unreliable procedures are identified and resolved prior to any actual recovery incident
- Alternate facilities to be utilized in recovery meet all requirements; and
- Senior management is comfortable that the plans will work as expected
| Test Type | Activities | Benefits |
|---|---|---|
| Table-Top Test or Exercise Also referred to as a ‘Desk Top Review‘ | Normally conducted as one of the first plan tests, it involves a physical examination and review of the plan documentation. Aims to ensure that:
| Inexpensive and relatively easy to organize. Allows a rapid test to be undertaken on completion or update of a BCP/DRP. |
| Table-Top Scenario Test | Involves a desktop walk-through of the plan(s), with discussion guided by the use of one or more potential scenarios.
The activities are based on a series of questions and answers relating to the deployment of the plans in response to changing issues in the scenario. | Has a similar benefit to the ˜desktop review”, with the additional advantage that it requires more challenging thinking from the participants.
However, this type of test does require a higher commitment of time to undertake and skills to conduct. |
| Notification and Callout Test | Activities are based on the verification of the accuracy, currency, and usefulness of contact lists (who you would need to call) | Test notification and contact lists provide a real-time validation of individual’s ability to respond to the first (and crucial) stage of plan activation. |
| Live Scenario Test | Can be conducted as a limited activation (narrow/specific scenario and/or targeted areas) up to a full-scale activation of all continuity arrangements. | Such testing provides the most robust testing (and training) of the plan. However, it takes significant time and resources to plan for and conduct. It may also provide a major distraction from normal business operations. |
One comment