TESTING

Scenarios In BC Plan Validation

By CHRIS ROHRS

According to the Wordsmyth Dictionary, a scenario is “a hypothesized set of circumstances or course of action.”
We use scenarios every day as we think about something that might happen, and then try to decide how we will act. Scenarios are a critical piece of the validation exercises for our business continuity plans.
This article will discuss the use of scenarios in validating business continuity plans.
Some of the validation exercises can be as simple as a notification test to make sure that all the branches of the calling trees are still attached, or they can be as elaborate as a full scale exercise covering several days involving the police, fire and FBI.
Whatever the scale or type of exercise, most exercises have the same basic objectives:
• Insure that the continuity plan, or some part of it, can actually be executed
• Train and familiarize the users and business continuity staff with the plan
• Demonstrate that the plan is accurate, thorough and complete
• Validate the plan’s assumptions, and
• Show that the plan will help the recovery of the business processes in a timely manner.
A scenario is a hypothetical situation that gives the participants a problem to work on. They also give an exercise focus and structure, and (hopefully) a sense of reality. Without some sort of scenario, without a problem to work through, the validation exercise would be almost useless.
Some of the criteria for selecting a scenario are:
• Realistic to engage the minds of the participants
• Powerful enough give the plan (or selected pieces of it) a thorough workout
• Solvable so participants can work thru to a solution
• Broad enough to involve a sufficient number of business and functional units to make the exercise valuable, and
• Specific enough to attain the objectives of the exercise.
Unless the objective of the exercise is a surprise “fire drill,” the scenario should be developed using people from all of the functional units that may be involved. The operational units, network staff, infrastructure, facilities and other units can advise on the realism of the scenario, and help refine it. They should also be involved so they can buy in to the problem being set and the objectives of the exercise.
The scenario that is picked for an exercise can also serve as a tool in evaluating the exercise and the plan. Participants can report on how effective the plan was in solving the problem posed by the scenario.
Good sources of scenarios are results from previous exercises, concerns expressed by business partners, analysis of assumptions made in plans, or assessments of risks/threats.

Chris Rohrs is a business continuity/disaster recovery planner with extensive experience in the financial sector. He also has many years experience as a team leader and project manager working on IT projects. Rohrs lives in northern California. You can contact him at derhexer@aol.com.

To comment on this article, go to 1501-12 at www.drj.com/feedback.

«BACK to the Articles Index