Disaster Recovery Journal Fall 2023

Maximize Exercising Preparation By MARGARET J. MILLETT T he business continuity manage ment (BCM) profession contin ues to grow and evolve. With an ever-changing workplace, regula tions, employees, leadership, etc., are companies as prepared for an incident as they should be? Now may be a good time to evaluate what is needed for your exercise program to be successful today, tomorrow, and in the years to come. Executive sponsorship is critical. Review your company BCM policy to ensure it defines their requirements to 1) select/review BCM team leadership, 2) provide funding to support BCM initia tives, 3) review key performance indica tors (KPIs), and 4) create a BCM culture. If executive management, board of directors, or internal audit ask the BCM team to classify the organization’s readi ness state, how would you respond? How would employees respond? 1) well pre pared, 2) moderately prepared, 3) slightly unprepared, and 4) very unprepared. Do you have the right tools in your tool kit? Determining what exercise templates are required depends on the results of the risk assessment. Here are some top threats to consider 1) severe weather, 2) power outages, 3) IT, 4) natural disasters, and 5) epidemic. Saying there are BCM exercise tem plates on file is great! Annually, take the time to determine 1) what new templates are required, 2) does a template need more details, 3) should any templates be retired, and 4) what templates should be in a park ing lot for the future. Having a business continuity plan on

to improve metrics, 2) executive mandate to create standardized approach, 3) execu tive support to champion company-wide effort, 4) flexible tools and templates, 5) annually documented BCM plans, 6) flex ibility since a real-life world event will be different from an exercise, and 7) systems which are used in daily operations which have been exercised. Work within your organization to ensure your company remains resilient and not a statistic. We have all read articles about the percentage of small businesses closing each year due to the inability to recover from an event. After number of events X number of business out of Y number of businesses never reopened. Exercise annually to find the gaps which could make your company a statistic. v

paper and making it work in a real event are not one and the same. Conducting exercises is critical for 1) validating plan effectiveness, 2) team training, 3) break ing down silos, and 4) exercising tools. Annually, take time to determine if your exercise framework is effective based on your program. Ensure the framework includes 1) creating the plan, 2) design and development, 3) conduct exercise, 4) post exercise report, and 5) updating plan. Determine if you have the right exer cise tools to support the program and the organization. BCM has gone virtual for good reasons: 1) redundancy/systems access key in an incident, 2) geographic dispersion of BCM teams and employees, 3) automation of tools, and 4) better deci sion-making and communication tools. Exercise KPIs do matter. BCM pro grams which track and report on key per formance indicators may reach maturity faster. Some KPIs to consider tracking are 1) number of exercises completed, 2) clear objectives and completion, 3) exercise issues, and 4) success rate. The keys to a successful exercise pro gram are 1) regulatory driven requirement

Margaret J. Millett, MsBC, FBCI (Hon), MBCP, has held board-level positions with business continuity organizations, written publications, and spoken at business con tinuity management conferences in North

America, Europe, Asia, and the Middle East. Margaret received the BCI Americas Award for Continuity and Resilience Contributor 2022. She was a 2023 DRII Lifetime Achievement Award nominee and a 2023 CIR Lifetime Achievement Award nominee.

24 DISASTER RECOVERY JOURNAL | FALL 2023