Testing and Training

Remember that your plan is a living document and it's only as good as the people you have implementing it. You need to test your plan regularly and conduct periodic training to ensure you're prepared when disaster strikes.

Testing the BCP/DRP Plans

There are four main types of tests that help you evaluate your personnel and plans:

• Plan review. Exercises that usually involve the distribution of BCP/DRP copies to all disaster recovery personnel for review. This accomplishes two goals. First, it ensures that personnel are aware of their disaster recovery responsibilities. Second, it forces a review of the plan to ensure it meets the organization's current requirements.

• Tabletop exercises. Theoretical disaster simulations in which key personnel gather in a conference room and role-play a disaster scenario. The exercise leader provides details of a disaster (usually keeping the details secret until the time of the exercise). Participants, armed with copies of the BCP/DRP, discuss how they would respond to the incident in real life.

• Hot site exercises. Simulations that take things a step further. Disaster recovery personnel actually relocate to the hot site and simulate the recovery operations on real equipment. During this type of exercise, all operations remain at the production site and are not disrupted.

• Disaster simulations. The most intrusive type of test. The exercise team actually takes physical action that simulates a disaster (such as cutting off the power supply to the building) and observes how the disaster recovery team responds. These can often have a detrimental short-term effect on the business because of lost time, but are the best way to learn how well your plan works.

Training Key Personnel

People are your most valuable asset. It's an overused cliché, but it's just as true in disaster planning as any other discipline. You should conduct three types of training for your personnel:

• Initial training. Should be provided to all personnel when they enter the company. Those personnel that will be intimately involved in the disaster recovery process should receive extensive indoctrination. Other employees should receive a broad overview of the plan so that they are familiar with the procedures to follow in the event of an emergency.

• Refresher training. Should take place on a periodic basis. Many organizations conduct this training on an annual basis. As with initial training, the length and depth of this program should be custom-tailored to the type of personnel being trained.

• Exercises. Also play a vital role in the training process. It's quite true that you learn best through experience, and exercises allow the disaster recovery team to learn the practical aspects of recovery.