Establish and Document the Application's Business Continuity and Disaster Recovery Testing When Required

This chapter explains how to establish and document testing of an Application’s business continuity and Disaster Recovery arrangements.

When Business Continuity and Disaster Recovery Testing Is Required

Documented Disaster Recovery procedures, described in the chapter “Establish and Document the Application’s Disaster Recovery Procedures,” are only trustworthy if they have been tested. Business continuity and Disaster Recovery testing is typically required for Applications with demanding recovery objectives, high business criticality, or regulatory obligations to demonstrate recoverability.

Establish Business Continuity and Disaster Recovery Testing

For Applications that require it, establish, with the Business Continuity and Disaster Recovery function, the types of test to perform (for example walkthroughs, partial failovers, and full failover exercises), their frequency, their scope (including dependencies that must be recovered together), the success criteria based on the Application’s Recovery Time Objective and Recovery Point Objective, and how business users participate in confirming that business operations can continue.

Document and Share the Tests

Record each test’s plan, date, participants, actual recovery time and data loss achieved against the objectives, issues found, and the actions taken to address them, in the Operational section of the Application Documentation. Update the Disaster Recovery procedures with every lesson learned.

Best Practice: Establish and Document the Application’s Business Continuity and Disaster Recovery Testing When Required

It is a best practice to both establish and document the solution for proving recoverability where an Application requires it: test business continuity and Disaster Recovery regularly against the Application’s recovery objectives, record actual results, and improve procedures from every test.

Benefits: Testing turns recovery plans from assumptions into demonstrated capabilities, revealing gaps while there is time to fix them. Recorded results also give leadership, auditors, and regulators evidence that critical Applications can be recovered within the limits the business requires.

Connections to Related IF4IT Practices and Inventories

The Application Portfolio Management (APM) Best Practices addresses assessing application resilience and recoverability and Disaster Recovery readiness. The IT Operating Environments Best Practices addresses mirror environments for Disaster Recovery and Business Continuity Planning.