Disaster recovery exercises prepare organisations for existential threats.
For a company executive, it is a challenge to anticipate potential risks that may lead to the business cease trading. These leaders are accountable for making important decisions to maintain the survival and growth of the company. It is their responsibility to prepare both staff and systems for the most severe business interuptions.
It is however not uncommon for teams to lack formal training on business continuity. This can result in panic and poor decision making and, in some instances, the failure of the company.
As an analogy, anti-virus software used to rely on signatures. Modern systems are more proactive measures without reliance on all known threats. The company may continue to grow without issue until a major disruption occurs, much like the Christmas turkey, the company grows week-on-week, until that fateful day in December.
The events of 11th September 2001 serve as a prime example of the importance of Business Continuity planning. Earlier that year, a director at the Deutsche Bank offices in New York conducted a Business Continuity / Disaster Recovery exercise, imagining the scenario of a neighbouring building collapsing onto their own. Unfortunately, this scenario became a reality as part of one of the Twin Towers tore a gash down the side of the Deutsche Bank building.
In November and December 2023, several organisations fell victim to a CitrixBleed vulnerability cyberattack. While such events may initially appear to be unpredictable Black Swan (Opens a new window) occurrences, they often align more closely with the concept of a Grey Rhino (Opens a new window): a more probable and obvious threat that organisations fail to address in time. A Grey Rhino represents a looming danger, clearly visible and charging towards the business, demanding proactive action to prevent, or at least mitigate, its impact.
How to Conduct Disaster Recovery Exercises
- Identify critical business functions and risks.
- Create realistic disaster scenarios.
- Develop recovery plans and assign responsibilities.
- Run simulations and document results.
- Analyse outcomes and update plans as necessary.
Benefits of Disaster Recovery Exercises
- Identify and address vulnerabilities before disasters occur.
- Improve team coordination and communication during crises.
- Reduce downtime and financial losses.
Frequently Asked Questions
- What is a disaster recovery exercise?
- A simulation that tests your organisation's ability to recover from a disaster.
- How often should we conduct these exercises?
- Unless there is a cause for concern, conducting exercises annually is recommended or whenever significant changes occur in your operations.
- Why involve an external consultant?
-
- Internal teams can often be too close to the problem, making it difficult to see gaps or inefficiencies in processes. An external consultant provides an unbiased, objective view. You may even already suspect existing exercises are flawed in some way.
- We can ask the "dumb question" that insiders are too scared to broach.
- Having an external consultant facilitates organisational buy-in, especially from leadership, as their involvement signals the seriousness of the exercise.
- Consultants can act as neutral facilitators in resolving disagreements about risks or responsibilities within the organisation.
- Consultants are not influenced by internal politics or preconceived notions, allowing them to challenge assumptions and ask critical questions that might otherwise go unasked.
- We have experience conducting similar exercises, giving us insights into pitfalls others have overlooked.
- External consultants can create scenarios that are more demanding than an internal team would consider.
- Consultants not only guide the exercise but also share knowledge and techniques that enhance the organisation's long-term capabilities.
- What was your most memorable exercise?
- A scenario that the Infrastructure Manager insisted could not happen.
