Introduction to Table Top testing your BCP (Business Continuity Plan)
Table Top Business Continuity and Disaster Recovery Plan Exercises and Tests are becoming more and more popular and for a very good reason.
In today’s competitive and time-poor business landscape, very few organizations have the flexibility to complete Business Continuity or Disaster Recovery exercises that interrupt normal business operations for an extended period.
Benefits of Table Top Testing and Exercises
The Table Top testing method provides a non-disruptive, low-cost, and regulatory-compliant alternative to traditional contingency testing. We believe that a ‘Live Scenario’ test (see table below for explanation) will yield better lessons and results when compared to a Table-top test, however, if conducted frequently and comprehensively the Table Top testing method is another string in your business continuity bow.
The primary purpose of any type of business continuity test is to ensure that the continuity strategies, plans, and procedures that have been put in place are fully understood by all concerned and are fit for purpose on an ongoing basis.
The success of a test cannot be judged solely on whether it worked exactly according to plan (they rarely do!). The success of a test can best be measured by the value that is gained from its performance, particularly in the area of problem identification and resolution.
The objectives of testing and exercising are to ensure that:-
- Staff are aware of their responsibilities and duties;
- Staff training has been adequate
- All necessary resources are available as detailed in the recovery plans
- All supplies can be obtained as anticipated
- The plan is current and reflects current arrangements and procedures
- Bottlenecks, uncertainties, and unreliable procedures are identified and resolved prior to any actual recovery incident
- Alternate facilities to be utilized in recovery meet all requirements; and
- Senior management is comfortable that the plans will work as expected
| Test Type | Activities | Benefits |
|---|---|---|
| Table-Top Test or Exercise Also referred to as a ‘Desk Top Review‘ | Normally conducted as one of the first plan tests, it involves a physical examination and review of the plan documentation. Aims to ensure that:
| Inexpensive and relatively easy to organize. Allows a rapid test to be undertaken on completion or update of a BCP/DRP. |
| Table-Top Scenario Test | Involves a desktop walk-through of the plan(s), with discussion guided by the use of one or more potential scenarios.
The activities are based on a series of questions and answers relating to the deployment of the plans in response to changing issues in the scenario. | Has a similar benefit to the ˜desktop review”, with the additional advantage that it requires more challenging thinking from the participants.
However, this type of test does require a higher commitment of time to undertake and skills to conduct. |
| Notification and Callout Test | Activities are based on the verification of the accuracy, currency, and usefulness of contact lists (who you would need to call) | Test notification and contact lists provide a real-time validation of individuals’ ability to respond to the first (and crucial) stage of plan activation. |
| Live Scenario Test | Can be conducted as a limited activation (narrow/specific scenario and/or targeted areas) up to a full-scale activation of all continuity arrangements. | Such testing provides the most robust testing (and training) of the plan. However, it takes significant time and resources to plan for and conduct. It may also provide a major distraction from normal business operations. |