Disaster recovery and business continuity training is one of the most important parts of the BC/DR planning process....
Awareness of the BC/DR program is often included with training activities, as stated in international standard ISO 27031 Section 7.5, “A coordinated program should be implemented to ensure that processes are in place to regularly promote DR awareness in general, as well as assess and enhance competency of all relevant personnel key to the successful implementation of DR activities.”
In this article we’ll provide strategies and tips that will help you develop your own disaster recovery and business continuity training program.
Disaster recovery and business continuity training program strategies -- What’s unique for BC/DR
Let’s begin with strategies and activities to raise awareness of a BC/DR program. First and foremost is to secure senior management support and funding for BC/DR programs, which will include training and awareness activities. Visible and frequently occurring endorsements from senior management will help raise awareness of and increase participation in the training program.
The next key strategy is to engage your human resources (HR) organization in the training process. They have the expertise to help you organize and conduct formal BC/DR training as well as awareness-creating activities, such as department briefings and messages on employee bulletin boards. Encourage HR to include training on BC/DR in new employee orientation programs. If it’s possible to require all employees -- other than BC/DR team members -- to participate in at least one training session annually, that should encourage employee acceptance and reinforce the importance of BC/DR activities.
Another important strategy is to leverage the Internet. If your organization has its own intranet with employee web pages, introduce a BC/DR web page that describes what your overall BC/DR program does, and include sections on training, frequently asked questions (FAQs), and click-on links to forms and services, schedules and other useful materials.
Finally, it’s important to communicate the BC/DR program and its activities to employees. Communications should be informative, educational, and should reinforce the company’s commitment to the BC/DR program.
Building a disaster recovery and business continuity training program
Here is a list of activities for building a successful disaster recovery and business continuity training and awareness program:
- Conduct a training and awareness needs analysis
- Prepare a training and awareness policy and have it reviewed and approved by senior management, BC/DR management, human resources and other key departments
- Assess existing staff competencies and understanding
- Define desired outcomes from the training and awareness program
- Establish an ongoing training and awareness program
- Develop training tools using needs analysis results as a starting point
- Develop and deliver various types of training programs (e.g., classroom, computer-based, test-based and instructional guides and templates)
- Ensure that employees, customers, suppliers and other stakeholders are aware of the BC/DR program
- Establish and use metrics to identify training focus areas, and measure progress in improving training quality
- Identify internal and external trainers, validate their teaching credentials and arrange for appropriate train-the-trainer programs
- Establish recordkeeping of staff training and awareness activities
Types of disaster recovery and business continuity training (differing from traditional business training):
- How to perform a business impact analysis
- How to conduct a risk analysis
- How to write a BC/DR plan
- Emergency response activities, e.g., assessment, evacuation
- Specialized recovery activities, such as recovering to hot sites or cold sites, third-party managed DR services
- How to initiate work area recovery
- Responding to unique situations, such as a pandemic
- Coordination with first responder organizations
- Return-to-normal activities
- Restoration of business systems and processes
Tips for benchmarking a disaster recovery and business continuity training program:
- Compare the BC/DR training program with other organizations
- Periodically survey employees to determine their level of awareness
- Apply lessons learned from actual disasters to training
- Link training activities to annual performance review and compensation
- Provide department managers with monthly status updates on all training and awareness activities
- Examine BC/DR training programs in use by vendors and specialized service providers to see if they can be leveraged into your program
The success of internal BC/DR programs often hinges on the training of BC/DR team members and employees. Include a well-designed training component in your BC/DR program to maximize the value of your BC/DR initiatives and to ensure that employees are ready to respond when the unthinkable happens.
About this author: Paul Kirvan, CISA, FBCVI, CBCP, has more than 20 years experience in business continuity management as a consultant, author and educator. He has been directly involved with dozens of IT/telecom consulting and audit engagements ranging from governance program development, program exercising, execution and maintenance, and RFP preparation and response. Kirvan currently works as an independent business continuity consultant/auditor and is the secretary of the Business Continuity Institute USA chapter. He can be reached at firstname.lastname@example.org.
Elements of a BC/DR training program:
- Prepare an annual schedule of BCDR training programs
- Schedule and conduct ongoing BC/DR training programs that address a variety of issues, such as what to do when an incident occurs
- Educate management at all levels on how the BC/DR program works and what their roles may be during an incident
- In addition to management staff, train BC/DR representatives in their duties and responsibilities during an incident, e.g., assisting with evacuations, coordinating the activation of BC/DR plans within their business units and ensuring post-event follow-up and review
- Train BC/DR representatives on their duties and responsibilities during normal business operations, e.g., collecting relevant data for a business impact analyses and risk assessments, facilitating interviews with subject matter experts and business unit leaders, coordinating exercises within their office site and/or business unit
- Develop and present educational and awareness materials that can be distributed to all employees; update the materials at least annually
- Coordinate BC/DR awareness and training activities, such as classroom training and web-based training, with human resources, public relations and other departments
- Evaluate training program effectiveness and update training materials on a six-month cycle
- Coordinate training activities with employee professional development programs