What are the biggest mistakes you see companies make when performing a disaster recovery test?
First and foremost, fewer than 50% of companies with plans test them at all. That is a huge mistake. If you go to the trouble of defining a continuity capability and provisioning your strategies with people and resources, you ought to test the result to make sure your theory of operation matches the reality of a disaster event. These days, with budget dollars in short supply, too many firms skip DR testing -- or postpone it into oblivion. Not a good idea.
When companies do test, something I am occasionally brought in to observe, the same sort of problems tend to arise. The short list includes:
- Failing to bring the right tapes or other recovery media to the test.
- Too many cooks: Management wants to show their support and attends the test, getting in the way and wasting precious time. If they want to be part of the test, give them a clipboard and make them observe and take notes.
- Lack of standards for test data collection: Taking notes on random scraps of paper makes correlating notes with tested activities and producing summary reports a difficult process.
- Failure to perform post-mortem interviews with test teams while the experience is still fresh in their minds. That's where you obtain some of the best data for procedure refinement.
Tendency to shape results to confirm or validate planning, ignoring failures: There is no such thing as a failed test. Testing produces information that can and should be used to improve procedures so that recovery activity can be accomplished within the specified timeframe. Yet, many planners try to hide "failures" to prevent management from losing faith in the project.
This was first published in July 2013