PP6 | Validation Flashcards
Validation - Introduction
Validation is the Professional Practice within the business continuity management lifecycle that confirms that the business continuity programme meets the objectives set in the Business Continuity Policy and that the plans and procedures in place are effective.
The purpose of Validation is to ensure that the business continuity solutions and response structure reflect the size, complexity, and type of organisation, and that the plans are current, accurate, effective, and complete.
There should be a process in place to continually improve the overall level of organisational resilience.
Validation is achieved through a combination of the following three activities:
Exercising - Maintenance - Review
Developing an Exercise Programme - About
An organisation’s continuity capability cannot be considered reliable or effective until it has been exercised.
No matter how well designed a business continuity solution or business continuity plan appears to be, realistic exercises should be used to help identify issues and validate assumptions that may require attention.
The goal of exercising is the continuous improvement of business continuity management capabilities and readiness by ensuring that lessons learned are integrated into prevention, mitigation, planning, training, and future exercising activities.
Developing an Exercise Programme - General Principles
Exercising aims to achieve various outcomes, including:
Evaluating the organisation’s capability to undertake continuity activities and achieve the expected RTOs.
Validating the business continuity solutions and the assumptions on which they are based.
Verifying that the documented procedures in the business continuity plan are relevant, complete, and current.
Verifying the adequacy and practicality of resources that support the continuity solutions.
Identifying areas for improvement or missing information.
Validating competency and building confidence in personnel with relevant roles and responsibilities.
Developing team work.
Raising awareness of business continuity throughout the organisation as described in Embedding Business Continuity.
Exercising is not a one-time activity. It should be scheduled and programmed into a series of events and activities that allow the organisation to gradually improve capability over time.
An exercise programme should ensure the desired level of capability by:
Rehearsing all plans.
Verifying all business continuity solutions.
Verifying all information contained in plans.
Exercising all relevant personnel (including alternates).
Developing an Exercise Programme - Process
The following should be considered in the exercising process:
Define the exercise programme goals, objectives, and scope.
Review past exercises (plans, resources, and activities) to identify areas excluded from previous exercises.
Discuss with top management any perceived areas of weakness and exercising priorities.
Review and assess current risks and threats.
Decide on the types of exercise to be undertaken.
Determine a budget for the exercise programme.
Check the availability of required personnel, facilities, and other resources.
Create an exercise schedule that includes validating the business continuity arrangements of relevant interested parties.
Submit to top management for approval.
Identify any training requirements for exercise participants or planners, and integrate them into the exercise programme.
Developing an Exercise Programme - Outcomes
The outcomes of developing an exercise programme are as follows:
A complete exercise programme which defines:
The objectives to be achieved.
The methods required to achieve the objectives.
Defined resource requirements (including budget).
Proposed timing, and training requirements.
Improved organisational resilience, with a demonstrable capability to respond to, and recover from, an incident or crisis over time.
Developing an Exercise - General Principles
Every exercise within the exercise programme needs to be carefully planned to justify the use of resources required when developing and delivering it.
The exercise development process should be approached like a project, using the appropriate planning steps and controls associated with good practice in project management.
Developing an Exercise - Process
Although a range of different exercises are undertaken in the Validation stage of the business continuity management lifecycle, the following process can be applied for any individual exercise:
Agree the scope, aims, objectives and expected outcomes of the exercise.
Identify the exercise planning team and team roles.
Plan and design the exercise, including setting a budget and time frame as well as conducting a risk assessment to identify the risks of impact on business-as-usual tasks, where appropriate.
Conduct the exercise.
Assess and report the outcome and lessons learned, including a de-brief of the participants immediately after the exercise.
Follow-up to address any issues raised by the exercise and take corrective action(s) as required.
Developing an Exercise - Outcomes
The outcomes of the exercise development and delivery process are:
An exercise plan or brief which outlines the objectives, scope, roles and responsibilities, and approach of how the exercise should be conducted.
Exercise delivery materials and resources required to conduct the exercise.
One or more completed exercises.
A post-exercise report, with recommendations for corrective actions.
The outcomes that exercises should seek to achieve include:
Confirmation that personnel are familiar with their roles, responsibilities, and authority in response to an incident.
Validation of the technical, logistical, and administrative aspects of the business continuity plan.
Validation of suitability of the continuity infrastructure (command centres, work areas, technology, and telecommunications resources).
Confirmation of the availability of personnel and processes for relocation.
Enhanced awareness of business continuity, crisis management, and emergency response procedures.
An increased awareness of the significance of business continuity.
Ideas for further exercises and scenarios relevant to the organisation.
Maintenance - About
Maintenance of the business continuity programme keeps the organisation’s business continuity arrangements up-to-date.
This ensures that the organisation remains ready to respond to, and manage the impacts from incidents effectively, despite periodic organisational change.
Maintenance - General Principles
To be effective, maintenance activities should be embedded within the organisation’s business-as-usual processes rather than being a separate activity that may be overlooked.
Most of the maintenance required will be the result of internal organisational changes.
The most effective way of achieving this is to incorporate maintenance activities into the organisation’s Change Management process.
However, this is not always possible as many organisations do not have such a process. If a change management process exists within an organisation, a time frame should be agreed to implement any changes in the business continuity programme.
Requirements for maintenance activities can be identified using the following:
Lessons learned through exercising.
Changes to the organisation’s structure, products and services, infrastructure, processes, or activities.
Changes to the environment in which the organisation operates.
A review or audit.
A real incident, where lessons learned can be incorporated.
Changes or updates in the business continuity management lifecycle, such as the BIA or continuity solutions.
Maintenance - Process
Responsibility for undertaking the planned maintenance process should be given to an individual or team who should:
Review what has changed since the last update.
Analyse the impacts of any changes.
Agree the changes to be made to specific elements of the business continuity programme.
Make the agreed changes as required.
Identify and advise interested parties of any changes that have an impact on them.
Assess additional requirements to training, awareness and communications, based on changes.
Provide training, awareness, and communications as required.
If plans and documents have changed, distribute the new versions as appropriate.
Identify the date for undertaking the next planned maintenance, and schedule the maintenance.
The impact of any changes should be analysed by:
Reviewing and challenging any assumptions that have been made.
Determining whether any time objectives have changed, for example, MTPDs or RTOs.
Determining the adequacy and availability of external services that might be required, such as asset restoration, recovery sites and subcontracts.
Reviewing the business continuity arrangements of key suppliers.
Maintenance - Outcomes
The outcomes of maintenance of the business continuity programme include:
A documented, planned maintenance schedule.
Regular progress reports.
Effective and up-to-date policies and procedures.
Up-to-date documentation.
Distribution to appropriate interested parties.
Review - About
The purpose of a review is to evaluate the business continuity policy and programme for continuing suitability, adequacy, and effectiveness.
Review - General Principles
There are six basic types of review:
Audit - Self Assessment - Quality Assurance (QA) - Performance Appraisal - Supplier Performance - Management Review
Review - Outcomes
The outcomes of the review should be options for improving the organisation’s level of resilience.
