When and What to Test

Some tests only involve two people while others can include an entire department. All tests require preparation time. This is necessary to coordinate schedules of people, exercise control rooms, and equipment. At a minimum, every plan should be tested annually. Plans to test should include business processes, IT systems, work area recovery, pandemic, and more. The following is a typical testing schedule and what to include:

• Quarterly
  • Inspect Command Center sites for availability and to ensure their network and telecommunication connections are live.
  • Data Backups
    • Verify that data backups are readable.
    • Ensure that every disk in the data center and key personal computers are included in the backups.
    • Inspect safe and secure transportation of media to off-site storage.
    • Inspect how the off-site storage facility handles and secures the media.
  • All business process owners verify that their employee recall lists are current.
  • Issue updated versions of plans.
• Annually
  • Conduct an IT simulation at the recovery site.
  • Conduct a work area recovery simulation at the recovery site.
  • Conduct a pandemic table-top exercise.
  • Conduct an executive recovery plan exercise with all simulations.
  • Review Business Continuity Plans of key vendors.
  • All managers submit a signed report that their recovery plans are up to date.
  • Practice a data backup recall from the secured storage area to the hot site.