It’s a good thing to have a business continuity plan in place, and an even better thing to have a proper set of exercises to support and test that plan. For many organizations, however, these exercises are viewed more as an obligation to be endured, rather than a source of long-term benefit, leading to people going through them by rote. Instead of providing insight into what the organization and plan is doing well, the exercises represent only a box to be checked whenever the business continuity plan calls for it.
Companies should instead consider what they can get out of these exercises, redesigning them to both improve employee engagement and to be better targeted toward testing various aspects of their plans, according to an article in Continuity Central. Similarly, organizations need to better consider what can be done via exercise, and what should be handled by separate meetings or technical discussions – certain topics, like how to respond to requests for payment in the event of ransomware attacks, are best discussed outside of exercises so that key people are not left arguing over organization approaches. Complexity of exercises also needs to be considered, as not every test needs to engage all aspects of the plan or organization. Instead, smaller and more focused exercises can help to test the understanding of subteams or functions, while also providing valuable feedback to higher levels.
Source:
