What is a BCP drill and its types?
What is a BCP drill? Creating a business continuity plan (BCP) is just one small part of any successful business continuity strategy. Unless you test your plan in a number of ways, then you won’t find any issues until it is too late – right when you need it to work because a disaster has happened.
The only way is to run tests to answer questions like:
- Can we survive a cyberattack?
- Does everyone know what to do in an emergency?
- What can we do if we can’t get into our offices?
These are known as BCP drills, and there are many different ways to do them. These are a critical component of continuity planning. If you don’t do any BCP drill exercise, then you won’t know if you’re prepared for a disaster until it’s too late.
The exact BCP drill meaning will vary in detail between different organizations, but in essence, a BCP drill is a test of your business continuity plan. You can run just one BCP drill, but it’s a good idea to do several with each drill testing a different scenario or run in a different way. How you design and run the BCP drills is, of course, entirely up to you, but taking a comprehensive approach is the best way to guarantee that you will have business continuity no matter what happens.
Why run BCP drills?
BCP drill exercises will help you to:
- Assure that you can meet your strategic objectives for business continuity.
- Reduce the risk to your staff, your assets, and your business.
- Identify any gaps or weaknesses in your business continuity plan.
- Check your response to a range of different disruptive events.
- Validate staff awareness of the BCP and what their role is.
- Continually improve your plan and procedures.
- Satisfy any external or internal audit requirements.
What are the different types of BCP drills?
There are several different types of BCP drills. These range from simple desk-based drills, testing just one aspect of your BCP plan, to complex real-life drills that cover multiple scenarios and involve the whole organization. Every one of the types of BCP drill described below serves a different purpose. When you run these yourself, you should tailor each drill to your particular business continuity plan and circumstances.
Each of the following five types of BCP drill builds on the results of the preceding ones:
- BCP walkthrough: A desk-based walkthrough of the plan is an excellent way for staff to get to know the format and content. This type of BCP drill can be done informally using communication techniques, including videos, presentations, and physical copies of the business continuity plan. This drill can also give an early indication of where improvements are needed to the documentation.
- Facilitated discussion: BCP drills using a facilitated discussion can be used to test a particular scenario for a selected disruptive event, e.g., a fire that requires the building to be evacuated. These are also desk-based but are more formal than the BCP walkthrough drill. The facilitator sets out the selected scenario and helps the drill participants go through the necessary actions. This should include the activation and the recovery stages. Potential issues and problems are recorded. The participants then use group discussion to find solutions. The whole BCP drill is typed up into a BCP drill report, with a summary of what happened, the findings, and any recommendations. This BCP drill report is then used to make the necessary updates to the BCP plan.
- Single-team simulation: This type of BCP drill uses a life-like simulation, bringing people together from one team. A scenario is chosen for the team, and the BCP drill tests how they manage a fictional incident. This includes managing communications, making decisions, recording activities and expenses, resolving issues, and working together as a team. This type of drill should be as life-like as possible, so it is not really desk-based. If done well, it will be a good test of the BCP and how the team works under pressure. Ideally, these drills should be done for every team in the organization using a range of different scenarios. As in the facilitated discussions, a formal BCP drill report should be produced for each drill, and the BCP plans updated as required.
- Multi-team simulation: This type of drill extends the concept of the single-team simulation to involve multiple interacting. It will test the co-ordination between teams and how they are controlled. This type of drill is useful to highlight issues with communications between teams and where actions have been omitted or duplicated. BCP drill reports should be produced and used for plan improvements.
- Full-scale exercise: This is the most comprehensive form of drill that includes all teams in a life-like exercise. They should not be considered until all of the preceding drills have been completed and all of the necessary improvements have been made to the business continuity plans. A pre-requisite is that all teams are fully conversant with the plans and are confident in executing their responsibilities. Again, formal BCP drill reports should be produced.
Let’s start with a high-level comparison of the difference between business continuity and disaster recovery. Business continuity planning (BCP) is concerned with keeping all essential functions of an organization going when there is a significant disruption to any part of the organization, including IT systems, essential infrastructure, people, and premises. Disaster recovery (DR) is usually only concerned with the IT and technology infrastructures that support critical business functions. DR is aimed at restoring these critical technology-based systems and services in an emergency after a major event stops them from working. This often involves switching services from the primary site to an alternative location, then switching back again once the emergency is over. Disaster recovery is often considered to be a subset of business continuity.
BCP DRP difference
Business continuity planning (BCP) and disaster recovery planning (DRP) are not the same things. BCP is concerned with keeping all essential functions of an organization going when there is a significant disruption to any part of the organization, including IT systems, essential infrastructure, people, and premises. DRP is usually only concerned with the IT and technology infrastructures that support critical business functions. DR is aimed at restoring these critical technology-based systems and services in an emergency after a major event stops them from working. This often involves switching services from the primary site to an alternative location, then switching back again once the emergency is over. Disaster recovery is often considered to be a subset of business continuity.
The approach to testing BRP can be applied to testing DRP, using the same types of drill described above but tailored to test different parts of the infrastructure instead of different teams:
- DRP walkthrough: A desk-based walkthrough of the disaster recovery plan with the IT teams.
- Facilitated discussion: DRP drills using a facilitated discussion to test a particular technical failure e.g., a complete server failure. A disaster recovery drill report should be produced for this type of drill.
- Single component simulation: This type of DRP drill uses a life-like simulation of the failure of one technical component, e.g., the connection to the Internet.
- Multi-component simulation: This type of drill extends the concept of the single component simulation to involve multiple component failures at the same time, e.g., a power supply failure that affects multiple servers.
- Full-scale exercise: This is the most comprehensive form of drill that considers the failure of an entire data center.
There can also be links between BCP drills and DRP drills for the scenarios where the trigger for involving business continuity is a technical failure that also requires the disaster recovery plan to be invoked. These can be some of the most difficult drills to plan and manage, as they typically involve most of the organization, but they can be very useful to provide confidence to the organization that they could withstand a serious disaster such as a cyber attack.
Conclusion
Testing business continuity plans using drills must be an essential part of any business continuity strategy. Untested plans have very little value and can, in fact, lull organizations into a false sense of security. Drills not only test the robustness of any BCP, but they also verify the preparedness of all staff for a disaster. Using a structured testing approach with the different types of drill is strongly recommended for every organization.
