Whatever the scale or type of exercise, most exercises have the same basic objectives:
• Insure that the continuity plan, or some part of it, can actually be executed
• Train and familiarize the users and business continuity staff with the plan
• Demonstrate that the plan is accurate, thorough and complete
• Validate the plan’s assumptions, and
• Show that the plan will help the recovery of the business processes in a timely manner.
A scenario is a hypothetical situation that gives the participants a problem to work on. They also give an exercise focus and structure, and (hopefully) a sense of reality. Without some sort of scenario, without a problem to work through, the validation exercise would be almost useless.
Some of the criteria for selecting a scenario are:
• Realistic to engage the minds of the participants
• Powerful enough give the plan (or selected pieces of it) a thorough workout
• Solvable so participants can work thru to a solution
• Broad enough to involve a sufficient number of business and functional units to make the exercise valuable, and
• Specific enough to attain the objectives of the exercise.
Unless the objective of the exercise is a surprise “fire drill,” the scenario should be developed using people from all of the functional units that may be involved. The operational units, network staff, infrastructure, facilities and other units can advise on the realism of the scenario, and help refine it. They should also be involved so they can buy in to the problem being set and the objectives of the exercise.
The scenario that is picked for an exercise can also serve as a tool in evaluating the exercise and the plan. Participants can report on how effective the plan was in solving the problem posed by the scenario.
Good sources of scenarios are results from previous exercises, concerns expressed by business partners, analysis of assumptions made in plans, or assessments of risks/threats.
Chris Rohrs is a business continuity/disaster recovery planner with extensive experience in the financial sector. He also has many years experience as a team leader and project manager working on IT projects. Rohrs lives in northern California. You can contact him at derhexer@aol.com.
