Testing and Exercising. Continuity Forum May 17, 2012

Transcription

1 Testing and Exercising Continuity Forum May 17, 2012

2 Agenda Business DOT The Exercise Management Model Our Approach Exercising In Practice Moving Forward Considerations Resources Discussion

3 Business DOT DOT BCM Program commenced in 2005 DOT BCM Program Revitalisation Project from SEMD takes over administration of the DOT BCM Program in Sept 2009 BCM Enhancement Strategy April 2011 Decentralised Program: Department of Transport Public Transport Victoria (April 2012) Authorities Regional Offices DOT BCM Journey 6 Training modules BCP development & maintenance BCM Database new 2012 Annual Exercise Program BCM General Awareness

4 What is an exercise? An exercise is a controlled, objective driven activity used for training or assessing personnel or testing, training or evaluating processes or capabilities Australian Emergency Management Institute A Business Continuity Management (BCM) capability cannot be considered reliable until it has been exercised BS It is one of the most visible activities within business continuity management It s where the rubber meets the road Global Information Security Survey 2011 BCM Results, Ernst & Young: Overall 67% of companies globally test their plans periodically 78% of Australian companies test their plans periodically

5 Exercise Management Model Australian Emergency Management Institute (AEMI)

6 Identify the Need: Why are you conducting an exercise? Evaluate the organisation s current BCM competence Build team capacity and confidence Validate Business Continuity Plan (BCP) content (procedures, resources, Recovery Time Objectives) Highlight assumptions which need to be questioned Evaluate equipment and arrangements Identify vulnerabilities and opportunities for BCP improvement Raise awareness of BCM within the organisation

7 Analyse the Need: What is the purpose or aim? What objectives do you want the team to achieve? Who do you need to gain commitment from? - Senior Management - Middle Management - Subject Matter Experts Me You Us Ask the question: what is in it for the BCM program, for the participants and for the organisation?

8 Design the Exercise: What is the scope of the exercise? Size, complexity, type of scenario What type of exercise is consistent with your objectives and capability? Discussion - Based Functional Operations - Based Simulation/ Drill Game Tabletop Workshops/ Walkthrough Deskcheck Full Scale/ Field Capability Planning/Training

9 Design the Exercise: Identify who should participate - Senior Management - Middle Management - Subject Matter Experts - General Staff - Junior Staff - New People - Internal Stakeholders (ie. Those you share interdependencies with) - External Stakeholders (eg. Contractors, Suppliers etc) Identify what resources are available How much will it cost? Conduct a risk assessment associated with the exercise and put a risk management plan in place

10 Conduct the Exercise Pre-Briefing Brief participants on aims, objectives, expectations & roles Exercise Facilitation Facilitate the exercise within a defined timetable Monitor the progress of decisions Capture observations and recommendations Exercise Completion Conduct a hot debrief to capture initial thoughts & lessons learned Provide opportunity for participants to evaluate the exercise & provide feedback (surveys)

11 Debrief, Evaluation & Reporting Debrief Prepare a formal report that reviews outcomes against objectives Include all the observations and recommendations from the exercise Identify actions for improvement: give owners and timelines for completion Conduct a cold (formal) debrief with appropriate stakeholders Evaluation Prepare a report of all participant surveys Identify actions for exercise program improvement Compile exercise feedback and prepare report for Senior Management Reporting Share results of exercise as well as the exercise evaluation with Risk Management Committee and Senior Management to reinforce the BCM program budget and activities

12 Tips Make sure you have the right people in the room and your participants know why they are there and what role they play A realistic scenario connects your participants feasible is better Exercising should be conducted with minimal exposure (manage the risks!) Plan your exercise timeline backwards Encourage everyone in the room to participate Take evaluation seriously Incorporate it into all stages of exercise planning Keep your objectives in mind when evaluating Allow participants to provide feedback into the process

13 Our Approach Conduct Business Impact Analysis Implement Improvements BC Education &Awareness Prepare Business Continuity Plans Conduct Exercises

14 Our Approach Exercise Temperature Rising: Power Outage due to Extreme Heat Pre-exercise Briefing ( 1 week prior) - 30 minutes Business Continuity Coordinator Communication of objectives and roles Exercise & Hot Debrief - 90 minutes Divisional Recovery Team General Observers Senior Management Observers BC Team Observer Facilitator Post Exercise Debrief & Report (1 week post) - 60 minutes Business Continuity Coordinator & Executive Director Observations, Recommendations & Post Exercise Actions

15 In Practice 12 desktop discussion exercises completed 2011/2012 Use of exercise software Avalias More realistic injects Easy to use Dynamic facilitation Outcomes: Appetite for more exercising Ready for incorporation of some functional elements Ready for more targeted and specific objectives Value in exercising through change There is no perfect time

16 Moving Forward Functional exercising the first four hours Joint exercising bringing it all together Examining dependencies: processes and relationships Shorter exercises, more often + Opportunities for engagement (more people, more often) + Keeps Business Continuity fresh in people s thoughts + Ability to target specific parts of plans and procedures + Build an exercise culture Less expensive Less disruptive to operations Reduce risks (safety, business disruption etc.) Less time to plan Increased use of technology Emergency Communication Notification drills BCM Database Avalias Exercise Software Virtual exercises using people in different locations via technology based systems

17 Considerations Appetite within the organisation Maturity of the BCM program Availability of people, time, budget & material resources Internal and external processes Culture of the organisation Time of year Organisational change Assumptions Past experiences (exercising and incidents) Need to balance the + and the - to achieve your objectives

18 Resources The Design, Management and Evaluation of Exercises/Tests: The Canadian Centre for Emergency Preparedness provides a straight forward approach to Business Continuity and Emergency Management Exercises. The Two Sentence Exercise: Simple and Very Effective: Continuity in Business provides free, user friendly resources. This article provides an approachable way to engage people and get them thinking about business continuity. Research Paper 1: CEO Perspectives on Organisational Resilience: This research paper was developed by the Australian Attorney-General s Department. It provides a discussion on the perspectives and understanding that the CEOs of some of Australia s largest companies have with regard to organisational resilience and how this concept is applied to their organisations. Interestingly, there was a relatively high level of importance placed on exercising but there was little mention of business continuity plans as a source of Organisational Resilience. %20CEO%20perspectives%20on%20organisational%20resilience.pdf Course: Design and Manage Activities that Exercise Elements of Emergency Management: The Australian Institute of Emergency Management runs an excellent course rgencymanagement.aspx Business Continuity Planning Tabletop Exercise White Paper: Written by John M Hayes, Posted in the Disaster Recovery Journal. This article provides a high level framework for tabletop exercises. The Business Continuity Exercise: Where the Rubber Meets the Road: Written by Christopher Burton, Posted in the Disaster Recovery Journal. This article provides a practical approach to planning business continuity exercises. Top Tips for Fantastic Business Continuity Desktop Exercises: Written by Charley Newnham, Posted on Continuity Central. This article provides a very practical approach to creating effective exercises with proactive solutions to common problems that are often encountered.

19 Training Opportunities The Australian Emergency Management Institute Design and Manage Activities that Exercise Elements of Emergency Management: ning/pages/designandmanageactivitiesthatexerciseelementsofem ergencymanagement.aspx

20 A wise man once said Tell me and I will forget. Show me, and I may remember. Involve me, and I will understand. Confucius 450 BC

21 DISCUSSION

22 Question 1 How do you get the most bang for your buck from Business Continuity exercises?

23 Question 2 What are the key steps to achieving buy in for exercises in your organisation? Senior Management Middle Management Operational Staff Stakeholders

24 Question 3 What types of exercises do you feel are most effective? How often do you hold them? What time of year? Who do you engage?

25 Question 4 How can exercising be used to effectively reinforce the investment of time, money, people and material resources in your BCM program?