Information Security Group

Business Recovery Exercise

A business recovery exercise is conducted by the respective project / function manager. The business recovery exercise enables the project / function manager to examine the capability of the continuity of business plan. The exercise enables the project / function manager to test the Memorandum of Understanding (MOU) for IT Services, Facilities services and other dependencies. This ensures that the Project / Function has the ability to meet the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) to meet Availability targets and requirements. Suppliers responsiveness is an integral component of testing to examine the capability of the supplier to support recovery aligned to SLA and Recovery Time Objectives as well as Recovery Point Objectives set.

The strength of the continuity plan documented can be asertained when tested.

To utilize the documented plan and the vital records as available
Check steps as documented Vs the steps taken respond.
Checks the working of the continuity plan when subjected to a crisis scenario, business disruptive event within the crisis scenario and plausible events which are specific to the project or / and function

The engagement in this exercise includes the below agencies.

All relevant stakeholders, associates in the team.
Customer contacts, supplier/s, partner/s end dependencies as documented in the continuity of business plan.
Services both internal, external, direct and indirect essential for response, recovery of important business activities.

Important Things to Remember in Drills / Tests / Exercises

Participating in drills, tests, exercises is a team building activity. People managers must encourage their team members to participate actively.
A business continuity plan only when tested provides an assurance of its capability to enable the purpose of continuous operations.
There can be no claim of being able to respond and recover if the test results do not prove so or we do not have test results to exhibit.
The project manager steers this effort for the project, the function head for the function. The Plan rep , DR Rep , Function Rep, Location Rep engage to support the Project, Functions and bridge the success.
Global business continuity team supports the entire end to end process through Mechanized Tools, Checkpoints, ENS, POSTMAN distributed notification and alerting systems.
People safety, wellness is paramount and Calltree responses are critical and vital for the organization.
Data restore, system rebuild, fail over are important elements to check in the integrated business recovery exercises.
Risk officers, Compliance Leads, Assurance auditors and leads are observers.
Learning and recording risks , gaps and corrections required in continuity plans and memorandum of understanding for support services is vital and essential.
Suppliers, Customers, Partners who provide direct, indirect internal or external support are engaged in the test to check continuity practices are followed to meet the Recovery Time Objectives.

Phases of the exercise

The exercise is divided into the below parts which ensures the adequacy is maintained for the right continuity posture.

Prepare – for the exercise

The following are the activities which must be executed in order to prepare for the planned exercise.

The plan owner (Project Manager, Function Manager ) must ensure the following activities.

Ensure that the business continuity plan in LIGHTHOUSE is complete and adequate.
Generate a copy of the Project Roll Up plan and read.
Engage the team to browse through the plan as a reading in a team meeting.
Ensure that all the direct and indirect dependencies are listed, contact details are available and Memorandum of Understanding as signed up are available for activation with support teams, customer contacts, partners in the exercise.
Ensure team members are aware of the strategies, models as well as a common principle of listening, responding on time, and participating actively in the complete exercise.
Ensure the team is well informed to be successful in the activity.

During the exercise

There are a set of activities which must be performed during the exercise.

INIT – Phase

In this phase the exercise is initiated like in every other potential or real crisis scenario and facilitates the project manager to get into action.

The mechanized call tree will be triggered through ENS (Emergency Notification System – calltree@techmahindra.com ).
The project manager post response to the call tree engages his core team members and assesses the business impact.
The project manager seeks guidance if required from the project management team member.
The business impact analysis for the day is conducted considering work items in queue and plan for the day.
Associates are notified to initiate the business recovery exercise which is none other than work for the day in a event recovery mode as the mind set.
Customer contact is notified around exercise initiation as per the continuity plan documentation.
Suppliers, partners and internal teams are notified by the project manager for being on standby in case of any dependency needs for the day.
Associates are further notified that recovery strategies documented for the day are activated – this would mean work from home, work across split teams, work from office or any other strategy in place.
As teams are working in HYBRID mode most strategies will be in play as a natural activity – intensive monitoring is the upgraded posture during crisis and exercising over the normal monitoring of any other business day.
Respond to the INIT check point as well as track team members to provide their responses ensuring quick turnaround time.
REMEMBER: Engage in referring to your plan, check your data in Lighthouse, update your plan in Lighthouse across the exercise.

MID-WAY – Phase

In this phase the exercise is in progress like in every other potential or real crisis scenario however there are a few intensive monitoring actions below over and above the other activities in play.

Monitor service tickets registered to meet the recovery time objectives and agreed SLA during the event / exercise in the MOU and continuity of business plan.
Monitor uptime and service tickets logged with the suppliers, partners, customer contacts for dependencies on their end.
Provide progress updates to all relevant stakeholders.
Monitor teamwork in progress for drops in SLA, Contractual requirements, Delivery schedules.
Monitor team wellness as well as availability and responsiveness to the MID-WAY check points.
Identify learning from the INIT phase until the MID-WAY phase.
Check continuity of plan documentation and mark changes required in terms of RTO, RPO, Head count, Contingency Head Count, Missed Dependencies as Notes.
Encourage team members to contribute to the learning.
REMEMBER: Check your plan, update your plan in Lighthouse across the exercise.

TERMINAL – Phase

In this phase the exercise window comes to an end like in every other potential or real crisis scenario and it is time to document finding, learning, risks, and action plan.

Identify gaps in the continuity of business plan documentation.
Check if the service tickets logged in as a natural process were resolved within the SLA.
Check what work items have not been delivered due to service disruptions.
Check work items which are delayed due to supplier, customer, partner, internal support team turnaround time.
Document learning as a list of items.
Register the risks of availability as risk identified in the project risk register.
Input the risk treatment plan of action with the beginning date - ending date can be discussed.
Set up time with the team for an After-Action Review.
Engage the Compliance lead, audit team and other relevant teams.
Ensure that the Terminal Check Point is responded by all team members.
Update the results in Lighthouse exercise record for the schedule id you engaged for the exercise.
Encourage team members to contribute to the meetings, calls and documentation process of learnings.

After the Exercise

In this phase the after-action report discussion, convergence and action plan conversations are executed.

Multiple stakeholders who play the role of facilitators, action takers, mitigation advisors, analysts engage with the respective exercise owner.

A debrief session is conducted.
Learnings are shared.
A round table for contributions from every stakeholder is an emphasis.
Activity plan is created.
Risks are identified and recorded.
Risk Treatment plans are documented.
Owners are identified.
Tracking meeting schedules are set up.
Actions are tracked and reported to the Executive Management & Board.

Navigation of Tests / Drills Schedules and Entering Drill / Exercise Results

How do I view the test / drills / exercise schedules ?

The navigation is provided below for necessary access and action

TWINGO=>INFORMATION SECURITY=>DASHBOARD and choose the drop down option Drill Schedule => Select Customer Group ID =>Check for Completed status for Drill Status in the Table on screen

Exercise Results Input in LIGHTHOUSE

How do I navigate to input the drill / test / exercise results ?