Disaster Recovery Tabletop Exercises Prepare You to Bounce Back
Even a company like Coca-Cola, which leads many disaster response efforts, can face gaps in its plan. A disaster recovery tabletop exercise can help.
The rule of threes is a survival fundamental. A human can endure three minutes without breathable air, three days without water, and three weeks without food. That’s why, when disaster strikes, Coca-Cola is ready to provide one of the three: safe drinking water for communities recovering from disasters. However, even the companies that assist in emergency response and recovery can encounter gaps in their preparedness.
“We were thrown a curveball with Hurricane Michael because we did not prepare for the telephone infrastructure, and cell service was severely damaged.”Gianetta Jones Vice President and Chief People Officer, Coca-Cola Bottling
When Hurricane Michael struck in 2018, Coca-Cola Bottling Company faced a significant setback in its disaster recovery efforts. Cell phone service was down, and they had no means of communication. The company had to adapt quickly, investing in expensive satellite phones to reestablish communication lines. They learned about a critical gap in their disaster recovery plan the hard way, and it might have been avoidable if they had conducted a disaster recovery tabletop exercise.
Coca-Cola Pivots During a Natural Disaster
The period following a disaster can be as risky and demanding as the storm. Additional crisis management challenges can emerge that you still need to consider. Plans that seemed well-written during the prep phase may not be practical for real-world situations, leading to recovery delays.
When Gianetta Jones, Vice President and Chief People Officer at Coca-Cola Bottling, had to contend with the strongest storm to hit the Florida panhandle on record, Hurricane Michael, the company had dozens of plans in place. They were well-prepared to support an estimated 3,000 employees across 14 affected locations in the Gulf. Then, the unexpected intensity of the hurricane took out the cell phone infrastructure on which they relied for communication.
It was a stark reminder that incident management goes beyond initial planning. Even the most comprehensive business continuity strategies can face unexpected setbacks. “You can never underestimate a storm,” said Gianetta. “We were thrown a curveball with Hurricane Michael because we did not prepare for the telephone infrastructure and cell service was severely damaged. We had to pivot and purchase several expensive satellite phones for our local operators to communicate with us at the corporate office.” Their situation underscored the importance of continuous adaptability and readiness throughout the recovery phase.
The team was able to pivot that quickly because they’re seasoned at dealing with disaster recovery and implementing incident response plans. However, companies without experienced disaster recovery team members in place would struggle. The only way to improve is through practice, but in the middle of a natural disaster, active shooter event, cybersecurity breach, or pandemic is not the time to do so. Instead, you can prepare now with a tabletop exercise for disaster recovery preparedness.
Test Your Plan With a Disaster Recovery Tabletop Exercise
A tabletop exercise allows you to test out your disaster recovery plans and identify gaps. You don’t have to test every part of a business continuity plan or disaster response at once. You can test in segments.
A disaster recovery tabletop exercise helps you assess your recovery capabilities in the context of an emergency management plan for a natural disaster, cyberattack, infrastructure failure, or other crisis. Every disaster has two distinct phases: the disaster itself and the recovery period that follows. While the immediate disaster may cause the greatest damage, the long-term effects on critical infrastructure are often more challenging to address. Your tabletop exercise is a discussion-based opportunity to test your risk management strategy during that latter phase.
In this video, Alert Media’s Senior VP of Safety Solutions, Peter Steinfeld, explores different types of exercises and tabletop exercise scenarios you can adapt for your organization.
This video will walk you through everything you need to know to run effective tabletop exercises.
A tabletop exercise involves three broad steps you can adapt to test your disaster recovery readiness.
Step #1: Designing Your Disaster Recovery Exercise
To prepare for your disaster recovery tabletop exercise, determine your goals, your participants, and your scenario script. Specifically, you need to test your existing plan with the individuals who will be directly responsible for implementing it in a realistic scenario.
Setting SMART exercise objectives for your TTX
As you’re testing your disaster recovery plan, you’ll want to build goals around it. These goals should be SMART, which stands for specific, measurable, achievable, relevant, and time-bound.
Smart exercise objectives for your disaster recovery might center on your IT systems and the networks needed to run your business. You might focus on metrics related to your systems and services’ recovery time and recovery point objectives.
You may also set goals around how long it takes to get critical infrastructure up and running or how well your emergency communication plan works. This will help you identify clear success metrics you can aim for as you refine your plan and help your team members improve their individual responses.
For more guidance on setting goals and planning your tabletop exercise, download our helpful tabletop exercise template.
Preparing your disaster response team members
Brief everyone involved on the exercise goals and their roles, and provide copies of the exercise plan.
There are four key parties in a tabletop exercise:
FacilitatorA facilitator guides the exercise in real time and keeps it moving forward toward the exercise objectives.
| ParticipantsMost of the parties involved will be participants who will answer questions and respond to scenarios.
| ObserversObservers might monitor the process and provide insight specific to their jobs. Someone from HR or facilities is a typical example.
| EvaluatorAn evaluator acts as an unbiased reviewer, tracking both strengths and opportunities in the plan as part of the evaluation program.
|
Everyone who falls into one of these roles should have a clear outline of all their responsibilities for disaster recovery. This ensures each individual understands their specific tasks, knows how to execute them effectively, and can contribute to the overall success of the recovery plan.
These outlined responsibilities help maintain organization and coordination during tabletop exercises and, more importantly, in real disaster scenarios, where a well-prepared team is essential for a swift and effective response.
Setting up your tabletop exercise scenarios
Your disaster scenario doesn’t have to be as detailed as the most recent Hollywood blockbuster, but it should be clear and realistic. The script should center on the aftermath of a specific disaster, such as a hurricane or earthquake. A common scenario might look like this:
A Category 3 hurricane has struck the coastal region, causing widespread power outages and road blockages. Your organization’s main data center, located in the affected area, has lost power, and the roads leading to the center are impassable due to fallen trees and debris. Current estimates from utility providers say power will be restored in the next few days, and cleanup crews are working to clear the roads in the coming week. Your goal is to mitigate disruptions in your service from the data center outage until power is restored.
Present the scenario, along with a brief, the disaster recovery plan, and a copy of the goals to your participants, observers, and evaluators. With this information in hand, you’re ready to start your exercise.
Step #2: Run Your Tabletop Exercise
The facilitator begins the tabletop exercise with a brief. They provide a disaster scenario to all the participants, observers, and evaluators, outlining the exercise objectives, responsibilities, and resources. They should read this information aloud and go over any questions in detail.
Once the initial introduction is complete, the facilitator guides a walkthrough of the emergency response plan. To stimulate active engagement, they use direct questions such as, “In facility four, the power is out. What’s the initial response?” This prompts a discussion on the emergency response plan where participants can request further information. For instance, a participant might respond with, “The facilities manager will activate the building’s generator.” The facilitator should then delve deeper by posing follow-up questions such as:
- What’s the process for activating the generator?
- Who is responsible for coordinating with the facilities manager?
- What happens if the facilities manager is unavailable? Who is the alternate authorized to act?
- What resources will be needed to continue running the generator?
- How will those resources be accessed?
- Are there any other stakeholders who will be affected?
Each question is an opportunity to deepen the participants’ answers and help them think about potential gaps in their emergency preparedness. By probing for additional details and exploring different aspects of the response, the facilitator ensures that the exercise thoroughly tests the organization’s readiness and identifies areas for improvement in the disaster recovery plan. This constructive dialogue during the exercise fosters better preparation and a more effective response in real-life scenarios.
The facilitator should also include “injects” to keep the participants thinking. Injects are a functional exercise that tests the adaptability of the group by introducing new information. They’re scenarios that complicate the emergency situation, which is common in disaster recovery.
For example, you could introduce a scenario like the failure of cell phone infrastructure due to high winds and flooding, as seen in the case of Coca-Cola in Panama City during Hurricane Michael. These injects test the adaptability of the recovery plan and help participants think on their feet.
Finally, as you’re running the exercise, be sure to document any new information that comes up. For example, you may have discovered there was no alternative assigned for your facility’s manager’s role of turning on the generator. You would document this and then establish an alternate to fill that gap and revisit it during the review stage.
Step #3: Reflect on Your TTX With an After-Action Report
The final stage of every tabletop exercise is to complete an after-action review. The AAR allows you to examine your response and identify gaps in your plan so you can improve. Specifically, during the AAR, you answer four questions:
- What was the goal and our plan to reach it?
- Did we reach it?
- Why did we achieve those results?
- How can we improve?
When you capture the answers in an after-action report, you can reflect and improve. You can share the highlights of that report with your team and encourage everyone to enhance their preparedness. You can also take this information into your full-scale exercise to test your plan from beginning to end and involve even more stakeholders in the recovery test.
Preparing to Face the Unknown
A disaster recovery tabletop exercise is an interactive opportunity to practice your response. Even the best-prepared organizations can face unexpected setbacks, like when Coca-Cola Bottling discovered a communications gap during a Category 5 hurricane. A tabletop exercise ensures you don’t discover these gaps when emotions are high and resources are low. Instead, you’re prepared well in advance for any unexpected challenges.
