In our last Business Continuity blog, We talked about the importance of validating recovery procedures
Practice makes perfect of course… let’s discover the 4 different exercise levels we can implement to find the holes in our plans. The whole point is to learn from exercises so that you can apply the same knowledge to a real situation!
There are important things to remember about the different exercise levels, consider…
1. How far you want to go
2. How tough you want to make the process (but remember a harder exercise doesn’t automatically mean a ‘better’ exercise!)
Level 1 – Walkthrough
- Sit down with key people in the organisation and check to see if all elements have been covered in the plan
Level 2 – Desktop Scenario
- The plan needs to withstand a deeper examination under a specific set of identified circumstances
- Sit down with the same people as in level 1 and work through the entire plan in detail
- Think about possible scenarios and case studies to really put plans to the test
Level 3 – Time-pressure
- Develop a scenario with timed injects (added difficulties), each one making the situation that little bit more difficult!
- A sense of urgency as this tackles a disruption that has an impact on the business for a short period
- Organise a de-brief to gather feedback and to see whether learning objectives have been obtained or not.
- Record decisions for next steps and identify outcomes
Level 4 – In Real Time
- Level 4 can be difficult to pull together, tackle stages 1-3 before attempting 4
- Consider the cost, however, playing out a real situation may give you a jolt to realise that the survival of the business may well just depend on how you react to certain disruptions
- This is the stage when things really come into play. Players concentrate on a time-pressured scenario with injects, in real time.
- The resulting de-brief should lead to a report on the exercise
It is time-consuming, however don’t underestimate the importance of level 4… this is where you realise the small details.
Have all that covered? Then think about how you can you then make the exercise more challenging!
· Change two variables at the same time
· Lengthen the time the exercise runs
· Make the scenario/case study more complex
· Ask trusted advisors to critique performance
Just remember… practice and test!
Follow Renaissance on LinkedIn / Twitter for daily cyber security news and updates