Business Continuity Exercises: Quick Exercises to Validate Your Plan

Business Continuity

Exercises

Quick Exercises to Validate

Your Plan

By Charlie Maclean-Bristol

MA (Hons), PgD, FBCI, FEPS

Print - ISBN: 978-1-944480-68-4

EPUB - 978-1-944480-69-1

WEB PDF - 978-1-944480-70-7

www.rothsteinpublishing.com

COPYRIGHT ©2020, Charlie Maclean-Bristol

All Rights Reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form by any means, electronic, mechanical, photocopying, recording or otherwise, without express, prior permission of the Publisher.

No responsibility is assumed by the Publisher or Authors for any injury and/or damage to persons or property as a matter of product liability, negligence or otherwise, or from any use or operation of any methods, products, instructions or ideas contained in the material herein. Local laws, standards and regulations should always be consulted first before considering any advice offered in this book.

Print - ISBN: 978-1-944480-68-4

EPUB - 978-1-944480-69-1

WEB PDF - 978-1-944480-70-7

Library of Congress Control Number: 2020938670

4 Arapaho Road

Brookfield, Connecticut 06804 USA

203.740.7400

[email protected]

www.rothsteinpublishing.com

WHAT YOUR COLLEAGUES ARE SAYING ABOUT BUSINESS CONTINUITY EXERCISES

"A great addition to the Business Continuity practitioner’s toolkit!

"Charlie’s personality shines through. and his unique approach and many years’ combined experience makes this an easy-to-read, practical guide to running short exercises. Applicable to any organization of any type or size, this book can be used to plan and execute a wide range of exercises for anyone with limited time and budget.

"As we are all being impacted by COVID-19, there is no better time to challenge our assumptions and validate the plans we have. As a profession, we need to reflect on the business continuity arrangements we have in place and ask how effectively they are working. We are faced with the challenge of how we can exercise safely in a socially-distanced work environment, and seeking ways to utilize technology to support this.

Charlie drives home the importance of continuing to identify lessons from real-life incidents and crises, but more importantly how to learn the lessons and bring them into our plans. Running an exercise, no matter how simple, is always an opportunity to learn.

Deborah Higgins

Head of Cabinet Office, Emergency Planning College, United Kingdom

Overall a very interesting & informative, sometimes funny and in-depth publication that will be of great use to a wide audience worldwide I am sure, including me.

Tim Marjuson

BCM & Crisis Management Consultant and Instructor, Dubai

Charlie’s new book is a real tour de force of how to exercise Business Continuity Plans and Programs. As a former consultant, I immediately recognized many of the difficulties and pitfalls he has identified. One is the perennial problem of getting buy-in or even interest from senior management. Another is trying to do too much in a single exercise which requires a large number of participants, excessive time commitments from busy managers, complex scenario-building and often difficulty in creating enough challenges to engage non-core attendees. The book neatly deals with many of these issues. I really liked the concept of speed exercising and I can envisage it being both fun and informative.

Lyndon Bird

Chief Knowledge Officer, DRI International

"Business Continuity Exercising has never received the attention it truly deserves, until now. Charlie’s experience in this area shines through in this volume. Applicable to the novice or the seasoned professional, this book is a welcome addition to the Business Continuity industry.

"Charlie takes the reader from the basics through to the planning and carrying out of an exercise, which is extremely valuable. Even though I’ve over twenty years’ experience in this area, it helped me to think about areas of Business Continuity I hadn’t considered for some time.

The structure of the book, going from planning through to conducting the exercises is well thought out and packed full of useful ideas, with templates and examples throughout the book. It's a book I would happily recommend for the content, style and detail.

Gary Hibberd

Professor, Cyberfort Group, UK

Exercising means many things to many people, and in this context, this book has been written to support the development and delivery of business continuity quick exercises. The book has something to offer everyone, with a range of exercises to suit diverse scenarios and sectors.

Jacqui Semple

Chair, The Emergency Planning Society, UK

Charlie Maclean-Bristol captures well the essence of the exercise purpose and process with concise, easy-to-read notes. The challenge, as he rightly points out, is engagement and often the biggest collective corporate block to engagement is complacency.

James Royds

Independent Consultant: risk, crisis and continuity management

Reading, United Kingdom

"Charlie Maclean-Bristol has provided an excellent guide and toolset for delivering ‘Proof.’ His book Business Continuity Exercises: Quick Exercises to Validate Your Plan provides valuable material across all levels of Business Continuity experience. Simple constructs such as ‘What, So What and Now What’ have a significant power-to-weight ratio: very easy to apply and to deliver significant value to the pursuit of proof. ‘Red-Team-Blue-Team’ is an example of what I call Challenged Collaboration which delivers benefits greater than the sum of the individual participants working the same problem.

While the book provides a plethora of clever techniques and scenario suggestions, I was very pleased to see an appropriate focus and depth in the aspects of debriefing and reporting - the realization of the proof and the requirements for improvement. Charlie has added real value to the Business Continuity domain and in doing so, has shown that exercises need not be arduous, drawn out, mysterious or scary.

Saul Midler

BC+R Executive, Terra Firma Pty Ltd, Melbourne, Australia

Dedication and

Acknowledgements

Dedication

This book is dedicated to my father Nicholas Maclean-Bristol who inspired me to write this book.

Acknowledgements

Nina Sooky for her patience is proofreading my drafts.

Kim Maclean-Bristol and Ken Wratten for the invention of speed exercising.

John Arney for teaching me Structured Debriefing.

Jacqui Semple for promoting the Three Minute Brief.

Past and present colleagues at PlanB Consulting for helping me refine the exercises.

Preface

Exercising contingency programs of any form, particularly business continuity, is a subject near and dear to me. As the saying goes, I wrote the book on business continuity/disaster recovery exercises - literally! In 1997 I published the first book ever written on this subject, Disaster Recovery Testing: Exercising Your Contingency Plan. Looking back at that book now, I can see that while I had much to learn, the Disaster Recovery industry (as it was then known) was far more focused on developing recovery procedures than exercises.

I believe many practitioners as well as business leaders were motivated by that book and have often considered a new edition over the years. Charlie Maclean-Bristol has now brought us this work to provide, simple, quick exercise materials you can use to kick-start your own business continuity program.

I have long believed that inertia is often the biggest obstacle to getting the exercise process going. Simple, engaging and nonthreatening exercises are often the best way to get the ball rolling. In this book, Charlie Maclean-Bristol provides just the right combination to make this happen.

For over thirty years, I have asserted repeatedly, an unexercised contingency plan can be worse than no plan at all. Now, with Charlie’s expert guidance and the benefit of his broad experience, you have no excuse!

Philip Jan Rothstein

FBCI, President

Rothstein Associates Inc.

Publisher, Rothstein Publishing

Brookfield, Connecticut USA

October, 2020

Foreword

by Dr. Claire MacRae

I was delighted to be asked to write this foreword to support my colleague in his fantastic endeavour in writing this book which contributes formally to the fields of crisis management and business continuity.

When I was writing this foreword, the Covid-19 global crisis was prevalent and so the timing and publication of this book has never been more relevant. This crisis has exposed organisations to unprecedented challenges and risks, giving rise to new ways of working and the new normal. In recovering from crises such as the Covid-19 pandemic, this book is a useful toolkit in preparing for future events to validate business continuity plans and to continue with business as usual.

This book takes a proactive approach focusing on building resilience within organisations to mitigate the negative impact of an event. It focuses on prevention of, rather than reaction to, crises as they occur by building resilience to mitigate the impact of crises. It is a must-have for both the experienced practitioner when training colleagues, or those with little or no experience in business continuity. The book is applicable to all industry sectors, public and private due to the diverse exercises provided.

The style of the book provides a simple but effective guide for those with little or no experience in business continuity but with a need to develop their skills and knowledge. It outlines a holistic approach to business continuity considering the critical elements of team meetings, briefings which are focused, identification of key stakeholders and reporting linked to the analysis of risk.

The use of practical examples creates a narrative to engage others in planning exercises supported by an extensive variety of short exercise examples pertinent to all types of organisation - whether small, medium or large, public or private. The innovative use of techniques, for example war gaming in chapter 13, provides an exciting approach to business continuity and crisis management which will unquestionably engage individuals and overcome inertia.

Charlie’s forward-thinking contributions to innovative practice in business continuity, crisis management and resilience should make practice and learning dynamic and motivating.

Charlie leads an independent resilience consultancy, PlanB Consulting, which has a long-standing relationship with our University, Glasgow Caledonian University (GCU), in particular our MSc and Undergraduate Risk Management degree programs. Since the 1980s, Risk Management has been taught at GCU and business continuity planning is an integral part of our degree programmes. Charlie supports the academic team at GCU teaching business continuity, crises and resilience within organisations. His diverse background in managing business continuity and contingency planning - including in the Army, large organisations and other consultancies - is a commendation to his extensive leadership skills and capabilities in this area.

As a Senior Lecturer in Risk at GCU and a published commentator and contributor to the area of risk I welcome the underpinning of the approaches in this book, in building resilience to a crisis alongside management and recovery. The role of risk, and its analysis, is a crucial part of this process and this book is a long-awaited opportunity supporting theory as well as the current integration of risk and resilience proactively in my MSc module, Risk and Organisational Resilience.

This book will feature as essential reading for students studying modules in organisational risk, resilience, and business continuity management. Charlie’s extensive knowledge and expertise, both academic and real-life, are highly valued by myself in shaping graduates by providing them with real-life industry experiences.

Dr. Claire MacRae

Senior Lecturer in Risk, Glasgow Caledonian University,

Glasgow School for Business and Society,

Glasgow, Scotland, United Kingdom

Former Programme Leader, MSc Risk Management and BA (Hons) Risk Management

Currently Programme Leader for the Doctorate of Business Administration (DBA) and Senior Postgraduate Research Tutor

Foreword

by James McAlister

I have been a friend and colleague of Charlie for well over a decade. We met at one of the Business Continuity Institute’s annual conference dinners and on first impression I thought who is this cocky Scotsman by the way he was wearing black tie dinner apparel with bright red tartan trews. For those of you who don't know Charlie, he is a true larger-than-life character, with a booming voice, barrel chest and the energy of a springer spaniel. But if you dig beneath the brawny exterior you find a very different character who is very bright, meticulous and a complex thinker. This cocktail of conflicting internal and external qualities are what make Charlie such a terrific planner, speaker and exercise facilitator.

I think the reason we hit it off as friends and later professional rivals is mostly down to our similar working backgrounds. Charlie is ex-military and I was at the time a career police officer; both of us for many years had experienced the realities of real-world disaster and crisis management. Also in common was our 30+-year history in training and exercise development; both of us working with high-profile, global private and public sector clients on a wide range of diverse resilience projects.

That’s Charlie, but what about his book? It manages to bring together the two worlds of hard-earned incident experience and well-practiced exercise development methodology. The book contains an abundance of very detailed exercise preparation and facilitation guidance to cater to both novice and veteran practitioners’ needs. The pages are crammed with truly useful, practical content including tabled information, bullet lists, aides-memoires, things to think about, questions to ask exercise participants, helpful diagrams and so much more.

The aspect that sets this book apart is Charlie’s concept of running quick exercises. Most response teams nowadays don’t have the time to take part in full-day exercises, so a book that enables facilitators to plan, prepare and conduct effective hour-long tests is game changing.

The only thing that worries me is... has Charlie given away TOO many of his exercise secrets for his own good?

James McAlister

MA DipBCM DipEd FICPEM Hon FBCI

Crisis Prepared Limited - Organisational Resilience Consultancy

Burscough, Lancashire, United Kingdom

Table of Contents

Cover

Title page

COPYRIGHT

WHAT YOUR COLLEAGUES ARE SAYING ABOUT BUSINESS CONTINUITY EXERCISES

Dedication and Acknowledgements

Preface

Foreword by Dr. Claire MacRae

Foreword by James McAlister

Introduction

The Aim of This Book

Who is This Book For?

Why Conduct Exercises

Ten Reasons Why You Should Conduct Short Exercises

An Example of a Short Exercise

How to Plan Your Exercise

Types of Short Exercises

1. The Simplest of Exercises: The Plan Walkthrough

1.1 Exercise Overview and Exercise Details

1.2 Delivery of the Exercise

1.3 Reporting and Follow-Up

2. The Most Versatile of Exercises: Speed Exercising

2.1 Exercise Overview and Exercise Details

2.2 Delivery of the Exercise

2.3 Reporting and Follow-Up

3. Simple Tabletop Exercise

3.1 Exercise Overview and Exercise Details

3.2 Delivery of the Exercise

3.3 Reporting and Follow-Up

4. Fire Bell Has Gone Off – Outside NOW

4.1 Exercise Overview and Exercise Details

4.2 Delivery of the Exercise

4.3 Reporting and Follow-Up

5. A Team Agenda for Dynamic Incident Team Meetings

5.1 Exercise Overview and Exercise Details

5.2 How to Use the Team Agenda

5.3 Delivery of the Exercise

5.3.1 An overall scenario for the exercise should be developed

5.4 Reporting and Follow-Up

6. Concise Briefings With NoWaffle, Three-Minute Briefs

6.1 Exercise Overview and Exercise Details

6.2 How to Conduct the Three-Minute Brief

6.3 How to Conduct the Exercise

6.4 Reporting and Follow-Up

7. Identify Key Stakeholders by Using a Communications Matrix

7.1 Exercise Overview and Exercise Details

7.2 How to Conduct the Exercise

7.3 Reporting and Follow-Up

8. Stakeholder Influence Matrix - Understanding Your Stakeholders’ Importance

8.1 Exercise Overview and Exercise Details

8.2 How to Use the Stakeholder Influence Matrix

8.3 How to Conduct the Exercise

8.4 Reporting and Follow-Up

9. Precise Incident Reporting Using the METHANE Mnemonic

9.1 Exercise Overview and Exercise Details

9.2 How to Use METHANE

9.3 How to Conduct the Exercise

9.4 Reporting and Follow-Up

10. Responding to an Incident by Conducting a Dynamic Risk Assessment

10.1 Exercise Overview and Exercise Details

10.2 How to Carry Out a Dynamic Risk Assessment

10.3 How to Conduct the Exercise

10.4 Reporting and Follow-Up

11. What, So What, Now What -Ensuring You Understand the Whole Picture

11.1 Exercise Overview and Exercise Details

11.2 How to Use What, So What, Now What

11.3 How to Conduct the Exercise

11.4 Reporting and Follow-Up

12. Horizon Scanning During Incidents, Anticipating Worst Case

12.1 Exercise Overview And Exercise Details

12.2 How to Use the Worst-Case Scenario

12.3 How to Conduct the Exercise

12.4 Reporting and Follow-Up

13. War Gaming: Red Team Versus Blue Team

13.1 Exercise Overview and Exercise Details

13.2 How to Conduct the Exercise

13.3 Reporting and Follow-Up

14. Randomize Your Exercise Scenarios With a Scenario Generator

14.1 Exercise Overview and Exercise Details

14.2 Using the Scenario Generator

14.3 How to Conduct the Exercise

14.4 Reporting and Follow-Up

15. Accessorize Your Response With Battleboxes and Grab Bags

15.1 Exercise Overview and Exercise Details

15.2 How to Carry Out This Discussion

15.3 How to Conduct the Discussion

15.4 Next Actions

15.5 Annex A - Contents of Grab Bags

16. Keep it Simple: the Hot Debrief

16.1 Exercise Overview and Exercise Details

17. Debrief Military Style: With an After Action Review

17.1 Exercise Overview and Exercise Details

17.2 How to Carry Out an AAR

17.3 How to Conduct the Debrief

17.4 Reporting and Follow-Up

18. Debrief Your Exercise, Incident or Event Using Structured Debriefing

18.1 Exercise Overview and Exercise Details

18.2 How to Carry Out a Structured Debriefing

18.3 How to Conduct the Exercise

18.4 Reporting and Follow-Up

19. Writing a Post-Exercise and Training Report

19.1 Post-Exercise Reports Overview

19.2 Post-Exercise Report Content

19.3 Post Training Reports

20. The Role of the Umpire in Exercises

21. A Framework for Assessing the Exercise

22. Choosing an Exercise Scenario

23. A Selection of Scenario Suggestions

23.1 Denial of Access, Loss of the Building or Impact on Operations

23.2 Reputational Scenarios

23.3 Cyber Scenarios

23.4 Community Scenarios

23.5 Loss of IT and/or Telephony

23.6 Loss of People

23.7 Loss of a Key Supplier

23.8 Recap: Choosing an Exercise Scenario

24. A Syllabus for a Full Day’s Training

25. Summary and Next Steps

Appendix A: Developing a SIMEX

A.1 The Task Given

A.2 Step 1 - What are the Parameters and Reasons for Running Your Exercise?

A.3 Step 2 - Identify the Audience for the Exercise

A.4