BCP Test Scenarios
The purpose of basing a BCP test on a specific scenario is to create an element of realism by simulating a threat scenario that could significantly affect the organisation. Simulations introduce a realistic stress level so that plans and delegates are challenged in a robust and meaningful way.
A scenario can be thought of as a root cause - the event that created the impact on our organisation, and which resulted in an operational impairment on people, processes and things that is significant enough to warrant invoking incident management and business continuity plans. So when considering a BCP test scenario we need to make sure that it adds realism and relevance to the BCP test.
To do this we need to consider two things: what the precise BCP test scenario is and what impact it will have. The impact of the chosen scenario will have a significant bearing on the usefulness of the test: if the impact is too small, then the BCP test will become a “near miss” and will not require the business continuity plan to be invoked. An excessively large impact could become overwhelming – meaning that the BCP test is halted because the planned impact creates a “meltdown” that cannot be managed.
Below we provide a list of scenarios categorised by the impact they can create:
BCP test scenarios that can be used to support BCP tests where the primary impact is loss of access to buildings or workplace:
Bomb / bomb scare
Water services outage or infection
Structural damage to buildings (caused by weather or accidental damage)
BCP test scenarios that can be used to support BCP tests where people are the primary impact
BCP test scenarios that can be used to support BCP tests where critical infrastructure is the main impact
Critical application failures
External telecoms failures
Of course, some of these scenarios can impact more than one thing – a flood can not only damage or deny access to the workplace it could affect IT systems and external networks. These considerations will be part of the BCP test objectives and the BCP test plan.
RiskCentric provide a range of services to support the design and execution of BCP tests