Chapter 6: Testing and Maintenance
TESTING
Appendix 5 "Test Plan Example")In order to evaluate the test, there must be a pre-defined criteria. A typical method used is to produce a set of reports during a live production period and then to try to produce exact copies of those reports using backed-up equipment, operating systems, software, and data. The test could then be evaluated upon the accuracy of the reports that were run with backed-up resources. The time required to produce the second set of data should be compared against the RTO as a further measure of the test's success.Once the test is completed there should be follow up activities to ensure identified action items are quickly resolved.Testing can be done in parts (component testing) or all at once (full business testing). Component tests are actual physical exercises designed to assess the readiness and effectiveness of discrete plan elements and recovery activities. The isolation of key recovery activities allows team members to focus their efforts while limiting testing expense and resources. This methodology is effective for identifying and resolving issues that may adversely affect the successful completion of a full operations test.The full business test requires extensive planning and preparation and should not be performed until most, if not all, of the plan components have been tested. This test requires the simulated recovery of critical business functions across a business unit. It is the closest exercise to an actual disaster. Although a full business test requires weeks of planning and considerable coordination of personnel and resources, the exercise provides a business unit with a level of confidence about their ability to recover in an actual event.Devoting one page to testing is insufficient. For a more in depth look at this facet of business continuity planning, I would suggest a book by Philip Jan Rothstein entitled "Disaster Recovery Testing: Exercising Your Contingency Plan" (Rothstein Associates Inc.).