1. Who is responsible for running exercise scenarios?
It’s everyone’s responsibly to get involved, but you need someone to ‘take charge’ and orchestrate the whole thing. Depending on the size of the organisation, that person should be a senior manager or specifically, a business continuity manager. Don’t just focus your attention on the people who are directly involved in the exercise, ‘outside players’ such as the note takers have a very important role to play as they record the points of progress.
2. Who should take part?
Following on from the previous point, here is a rough idea of the people who need to take part in your exercise scenarios…
· Business Continuity Leader
· Executive Director
· Experts (if you require specific knowledge about a situation)
· Key Staff
· Facilitators
· A note-taker
3. How can I tell my staff?
Let your staff know that the exercise is going to take place and that they need to refresh your business’s continuity procedures in their mind. Tell them to have a think about the roles and responsibilities your continuity procedures identify for them. Providing them with an explanation about what the exercise will involve is crucial. Try saying something like this…
“We will be running an exercise to see how we would cope in a disruption. This is to see whether the plans we have been developing will meet our needs. We will be testing the plans and not individuals. All staff should update themselves on the plan contents and roles they will undertake. The exercise will take place at…”
4. How to avoid pitfalls?
Get all your players together and tell them that the exercise is not designed to catch them out, if they are feeling on edge or act in a certain way just because of the situation at hand you will not get a true performance from the players. Stress that they aren’t to prejudge the scenario or try to ‘plan it out’ before it actually comes to pass. For the exercise to be successful, it should be as ‘natural’ as possible so the players don’t feel like they must channel their inner ‘actor’!
5. What about the expense?
This is the question everyone loves to ask… it can be the reason why many exercises are talked about but never planned or played. However, the question we must ask ourselves is this…
“How much is this all going to cost?” … Less than a badly handled disaster!
Ensure you allow for planning time… how long should an exercise scenario take to plan? Have a feasible target in mind so time is not taken away from ‘business as usual’ unnecessarily. If you think it would be beneficial to get away from your usual location, make sure you consider room hire (remember to tell everyone to bring their own ham sandwiches!) Running a live exercise that ceases business activity for a while will cost a lot more.
Sit down, weigh up your options, think about your budget and take it from there.
Follow Renaissance on LinkedIn / Twitter for daily cyber security news and updates